{"version":"https://jsonfeed.org/version/1","title":"BSD Now","home_page_url":"https://www.bsdnow.tv","feed_url":"https://www.bsdnow.tv/json","description":"Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as a platform for support and questions. We love and advocate FreeBSD, OpenBSD, NetBSD, DragonFlyBSD and TrueOS. Our show aims to be helpful and informative for new users that want to learn about them, but still be entertaining for the people who are already pros.\r\n\r\nThe show airs on Wednesdays at 2:00PM (US Eastern time) and the edited version is usually up the following day. ","_fireside":{"subtitle":"A weekly podcast and the place to B...SD","pubdate":"2024-11-14T08:00:00.000-05:00","explicit":false,"copyright":"CC Attribution + Noncommercial + ShareAlike (BY-NC-SA) by JT Pennington","owner":"JT Pennington","image":"https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/c/c91b88f1-e824-4815-bcb8-5227818d6010/cover.jpg?v=4"},"items":[{"id":"137023c9-3a8f-495e-8b66-8db48e5b1ee7","title":"585: Infrastructure Administration Workstation","url":"https://www.bsdnow.tv/585","content_text":"From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFrom Proxmox to FreeBSD - Story of a Migration\n\n\n\nFreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS\n\n\n\nNews Roundup\n\nUsing a dedicated administration workstation for my infrastructure\n\n\n\nLibreSSL 4.0.0 Released\n\n\n\nPlasma6 and FreeBSD 14\n\n\n\ngit: world - Replace gnu diff, diff3, and sdiff with BSD versions\n\n\n\n\n\nBeastie Bits\n\n- How to Upgrade FreeBSD KDE 5 to KDE 6\n\n\n***\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/10/21/from-proxmox-to-freebsd-story-of-a-migration/\" rel=\"nofollow\">From Proxmox to FreeBSD - Story of a Migration</a></p>\n\n<hr>\n\n<p><a href=\"https://hackaday.com/2024/10/28/freebsd-at-30-the-history-and-future-of-the-most-popular-bsd-based-os/\" rel=\"nofollow\">FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-10-19-my-admin-workstation.html\" rel=\"nofollow\">Using a dedicated administration workstation for my infrastructure</a></p>\n\n<hr>\n\n<p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20241015084629\" rel=\"nofollow\">LibreSSL 4.0.0 Released</a></p>\n\n<hr>\n\n<p><a href=\"https://euroquis.nl//kde/2024/10/08/freebsd14.html\" rel=\"nofollow\">Plasma6 and FreeBSD 14</a></p>\n\n<hr>\n\n<p><a href=\"https://lists.dragonflybsd.org/pipermail/commits/2024-October/923274.html\" rel=\"nofollow\">git: world - Replace gnu diff, diff3, and sdiff with BSD versions</a></p>\n\n<hr>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<h2>- <a href=\"https://www.youtube.com/watch?v=2OZtnqK3iMU\" rel=\"nofollow\">How to Upgrade FreeBSD KDE 5 to KDE 6</a></h2>\n\n<ul>\n<li>***</li>\n</ul>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"From Proxmox to FreeBSD - Story of a Migration, FreeBSD At 30: The History And Future Of The Most Popular BSD-Based OS, Using a dedicated administration workstation for my infrastructure, LibreSSL 4.0.0 Released, Plasma6 and FreeBSD 14, Replace gnu diff, diff3, and sdiff with BSD versions, and more","date_published":"2024-11-14T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/137023c9-3a8f-495e-8b66-8db48e5b1ee7.mp3","mime_type":"audio/mpeg","size_in_bytes":47151744,"duration_in_seconds":2946}]},{"id":"ba88ee59-1fde-4f54-a013-b0a8b34ae9b3","title":"584: ZFS Copy Offloading","url":"https://www.bsdnow.tv/584","content_text":"New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNew CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices\n\n\n\nAccelerating ZFS with Copy Offloading: BRT\n\n\n\nNews Roundup\n\nThe uncertain possible futures of Unix graphical desktops\n\n\n\nJailfox - Firefox in a Freebsd Jail\n\n\n\nMake Your Own Read-Only Device With NetBSD\n\n\n\nex/vi/nvi editor: .exrc file (config file) advanced topics (undocumented?): Adding comments, escaping the pipe, mapping key combinations\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nMatthew - CI CD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/new-cis-freebsd-14-benchmark-secure-your-systems-with-expert-guided-best-practices/\" rel=\"nofollow\">New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices</a></p>\n\n<hr>\n\n<p><a href=\"https://klarasystems.com/articles/accelerating-zfs-with-copy-offloading-brt/\" rel=\"nofollow\">Accelerating ZFS with Copy Offloading: BRT</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixDesktopFutures\" rel=\"nofollow\">The uncertain possible futures of Unix graphical desktops</a></p>\n\n<hr>\n\n<p><a href=\"https://forums.FreeBSD.org/threads/jailfox-firefox-ingithub-a-freebsd-jail.94848/\" rel=\"nofollow\">Jailfox - Firefox in a Freebsd Jail</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/09/10/make-your-own-readonly-device-with-netbsd/\" rel=\"nofollow\">Make Your Own Read-Only Device With NetBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://forums.FreeBSD.org/threads/ex-vi-nvi-editor-exrc-file-config-file-advanced-topics-undocumented-adding-comments-escaping-the-pipe-mapping-key-combinations.95095/\" rel=\"nofollow\">ex/vi/nvi editor: .exrc file (config file) advanced topics (undocumented?): Adding comments, escaping the pipe, mapping key combinations</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/584/feedback/matthew%20-%20cicd.md\" rel=\"nofollow\">Matthew - CI CD</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"New CIS® FreeBSD 14 Benchmark: Secure Your Systems with Expert-Guided Best Practices, Accelerating ZFS with Copy Offloading: BRT, The uncertain possible futures of Unix graphical desktops, Jailfox - Firefox in a Freebsd Jail, Make Your Own Read-Only Device With NetBSD, ex/vi/nvi editor: .exrc advanced,","date_published":"2024-11-07T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ba88ee59-1fde-4f54-a013-b0a8b34ae9b3.mp3","mime_type":"audio/mpeg","size_in_bytes":55618176,"duration_in_seconds":3476}]},{"id":"523b42f8-cd1e-4919-a5ad-d6de0bb137a2","title":"583: A host of self-hosters","url":"https://www.bsdnow.tv/583","content_text":"Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD 7.6 Released\n\n\n\nOpen Source FreeBSD NAS: Maintenance Best Practices\n\n\n\nNews Roundup\n\nSelf-hosting Bitwarden / VaultWarden on FreeBSD\n\n\n\nI most definitely should (self-host)!\n\n\n\nMy 71 TiB ZFS NAS After 10 Years and Zero Drive Failures\n\n\n\nMake Your Own CDN With OpenBSD Base and Just 2 Packages\n\n\n\nBeastie Bits\n\n- BSD History archive\n\n\n***\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nMischa - feedback\nlars - feedback\nMessage from JT... the problem is spam, sometimes real messages get lost in flood of spam, if we don't cover your email within a few weeks, please email back in.\n\n\nAnd now... for some laughs, I shall share with you all, some of the delightful spam we have gotten for your entertainment.\n\n\nKim\nAlexander\nLee\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20241007204213\" rel=\"nofollow\">OpenBSD 7.6 Released</a></p>\n\n<hr>\n\n<p><a href=\"https://klarasystems.com/articles/open-source-freebsd-nas-maintenance-best-practices/?utm_source=BSD%20Now&utm_medium=Podcast\" rel=\"nofollow\">Open Source FreeBSD NAS: Maintenance Best Practices</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dan.langille.org/2024/09/30/self-hosting-bitwarden-vaultwarden-on-freebsd/\" rel=\"nofollow\">Self-hosting Bitwarden / VaultWarden on FreeBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://michal.sapka.me/blog/2024/i-will-self-host-this-site/\" rel=\"nofollow\">I most definitely should (self-host)!</a></p>\n\n<hr>\n\n<p><a href=\"https://louwrentius.com/my-71-tib-zfs-nas-after-10-years-and-zero-drive-failures.html\" rel=\"nofollow\">My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/08/29/make-your-own-cdn-openbsd/\" rel=\"nofollow\">Make Your Own CDN With OpenBSD Base and Just 2 Packages</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<h2>- <a href=\"https://m.youtube.com/watch?v=a3f889FXuGw\" rel=\"nofollow\">BSD History archive</a></h2>\n\n<ul>\n<li>***</li>\n</ul>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Mischa%20-%20Feedback.md\" rel=\"nofollow\">Mischa - feedback</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/tree/master/episodes/583/feedback\" rel=\"nofollow\">lars - feedback</a></p></li>\n<li><p>Message from JT... the problem is spam, sometimes real messages get lost in flood of spam, if we don&#39;t cover your email within a few weeks, please email back in.</p></li>\n</ul>\n\n<p>And now... for some laughs, I shall share with you all, some of the delightful spam we have gotten for your entertainment.</p>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/kim%20-%20spam.md\" rel=\"nofollow\">Kim</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Alexander%20-%20spam.md\" rel=\"nofollow\">Alexander</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/583/feedback/Lee%20-%20spam.md\" rel=\"nofollow\">Lee</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Run Linux Containers on FreeBSD 14 with Podman, Open Source FreeBSD NAS: Maintenance Best Practices, Self-hosting Bitwarden / VaultWarden on FreeBSD, I most definitely should (self-host)!, My 71 TiB ZFS NAS After 10 Years and Zero Drive Failures, Make Your Own CDN With OpenBSD Base and Just 2 Packages, and more","date_published":"2024-10-31T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/523b42f8-cd1e-4919-a5ad-d6de0bb137a2.mp3","mime_type":"audio/mpeg","size_in_bytes":66302976,"duration_in_seconds":4143}]},{"id":"e95e7d3d-6bca-4594-a5ee-2155c7bc98ef","title":"582: Introducing ZBM","url":"https://www.bsdnow.tv/582","content_text":"Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install \"standard\" TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhy laptop support, why now: FreeBSD’s strategic move toward broader adoption\n\n\n\nZBM 101: Introduction to ZFSBootMenu\n\n\n\nNews Roundup\n\nHow I batch apply and save one-liners\n\n\n\nMoving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps\n\n\n\nHow to install \"standard\" TTF Microsoft fonts\n\n\n\nWe need more zero config tools\n\n\n\nReasons I still love the fish shell\n\n\n\nYou Have Installed OpenBSD. Now For The Daily Tasks.\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nChris - choosing show items\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install &quot;standard&quot; TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/why-laptop-support-why-now-freebsds-strategic-move-toward-broader-adoption/\" rel=\"nofollow\">Why laptop support, why now: FreeBSD’s strategic move toward broader adoption</a></p>\n\n<hr>\n\n<p><a href=\"https://klarasystems.com/articles/zbm-101-introduction-to-zfsbootmenu/?utm_source=BSD%20Now&utm_medium=Podcast\" rel=\"nofollow\">ZBM 101: Introduction to ZFSBootMenu</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://lmno.lol/alvaro/how-i-batch-apply-and-save-one-liners\" rel=\"nofollow\">How I batch apply and save one-liners</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/09/16/moving-freebsd-installation-new-host-vm/\" rel=\"nofollow\">Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps</a></p>\n\n<hr>\n\n<p><a href=\"https://forums.FreeBSD.org/threads/how-to-install-standard-ttf-microsoft-fonts.95009/\" rel=\"nofollow\">How to install &quot;standard&quot; TTF Microsoft fonts</a></p>\n\n<hr>\n\n<p><a href=\"https://arne.me/blog/we-need-more-zero-config-tools\" rel=\"nofollow\">We need more zero config tools</a></p>\n\n<hr>\n\n<p><a href=\"https://jvns.ca/blog/2024/09/12/reasons-i--still--love-fish/\" rel=\"nofollow\">Reasons I still love the fish shell</a></p>\n\n<hr>\n\n<p><a href=\"https://bsdly.blogspot.com/2024/09/you-have-installed-openbsd-now-for.html\" rel=\"nofollow\">You Have Installed OpenBSD. Now For The Daily Tasks.</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/582/feedback/Chris%20-%20choosing%20show%20items.md\" rel=\"nofollow\">Chris - choosing show items</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Why laptop support, why now: FreeBSD’s strategic move toward broader adoption, ZBM 101: Introduction to ZFSBootMenu, How I batch apply and save one-liners, Moving an Entire FreeBSD Installation to a New Host or VM in a Few Easy Steps, How to install \"standard\" TTF Microsoft fonts, We need more zero config tools, Reasons I still love the fish shell, You Have Installed OpenBSD. Now For The Daily Tasks, and more","date_published":"2024-10-24T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e95e7d3d-6bca-4594-a5ee-2155c7bc98ef.mp3","mime_type":"audio/mpeg","size_in_bytes":55983744,"duration_in_seconds":3498}]},{"id":"c6329e3b-eb96-4db0-9bb0-27d65a4ecddc","title":"581: Releasing more BSDs","url":"https://www.bsdnow.tv/581","content_text":"Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDebunking Common Myths About FreeBSD - Part 2\n\n\n\nFreeBSD 13.4-RELEASE Announcement\nFreeBSD 14.0 end-of-life - You should have upgraded to 14.1 by now\n\n\n\nOpenBSD -current has moved to version 7.6\n\n\n\nNews Roundup\n\nacpidumping\n\n\n\nInstall snac2 on FreeBSD – An ActivityPub Instance for the Fediverse\n\n\n\nInstalling Uptime-Kuma on a FreeBSD Jail\n\n\n\nManaging dotfiles with chezmoi\n\n\n\nPodman testing on FreeBSD\n\n\n\nUndeadly Bits\n\n\nOpenSSH 9.9 released!\nOpenBSD now enforcing no invalid NUL characters in shell scripts\nEuroBSDCon 2024 presentations are now up\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nrel4x - Secure by default\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/debunking-common-myths-about-freebsd-2/?utm_source=BSD%20Now&utm_medium=Podcast\" rel=\"nofollow\">Debunking Common Myths About FreeBSD - Part 2</a></p>\n\n<hr>\n\n<p><a href=\"https://www.freebsd.org/releases/13.4R/announce/\" rel=\"nofollow\">FreeBSD 13.4-RELEASE Announcement</a><br>\n<a href=\"https://bsdsec.net/articles/freebsd-14-0-end-of-life\" rel=\"nofollow\">FreeBSD 14.0 end-of-life</a> - You should have upgraded to 14.1 by now</p>\n\n<hr>\n\n<p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20240918052239\" rel=\"nofollow\">OpenBSD -current has moved to version 7.6</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://adventurist.me/posts/00325\" rel=\"nofollow\">acpidumping</a></p>\n\n<hr>\n\n<p><a href=\"https://gyptazy.com/install-snac2-on-freebsd-an-activitypub-instance-for-the-fediverse/\" rel=\"nofollow\">Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/22/install-uptime-kuma-freebsd-jail/\" rel=\"nofollow\">Installing Uptime-Kuma on a FreeBSD Jail</a></p>\n\n<hr>\n\n<p><a href=\"https://stoddart.github.io/2024/09/08/managing-dotfiles-with-chezmoi.html\" rel=\"nofollow\">Managing dotfiles with chezmoi</a></p>\n\n<hr>\n\n<p><a href=\"https://github.com/oci-playground/freebsd-podman-testing\" rel=\"nofollow\">Podman testing on FreeBSD</a></p>\n\n<hr>\n\n<h2>Undeadly Bits</h2>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20240921181110\" rel=\"nofollow\">OpenSSH 9.9 released!</a></li>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20240924105732\" rel=\"nofollow\">OpenBSD now enforcing no invalid NUL characters in shell scripts</a></li>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20240924092154\" rel=\"nofollow\">EuroBSDCon 2024 presentations are now up</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/581/feedback/rel4x%20-%20Secure%20by%20default.md\" rel=\"nofollow\">rel4x - Secure by default</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Debunking Common Myths About FreeBSD - Part 2, FreeBSD 13.4-RELEASE Announcement, OpenBSD -current has moved to version 7.6, acpidumping,Install snac2 on FreeBSD – An ActivityPub Instance for the Fediverse, Managing dotfiles with chezmoi, Podman testing on FreeBSD, and more","date_published":"2024-10-17T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6329e3b-eb96-4db0-9bb0-27d65a4ecddc.mp3","mime_type":"audio/mpeg","size_in_bytes":77142272,"duration_in_seconds":3214}]},{"id":"a994539c-8d64-4bca-904d-9e2a5c7e07ae","title":"580: EuroBSDcon 2024 - Part 2","url":"https://www.bsdnow.tv/580","content_text":"Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterviews\n\nColin Percival\n\nAndrew Hewus\n\nWolfgang\n\nLiam Proven\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interviews</h2>\n\n<h3>Colin Percival</h3>\n\n<h3>Andrew Hewus</h3>\n\n<h3>Wolfgang</h3>\n\n<h3>Liam Proven</h3>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Jason is still on location at EuroBSDcon getting interviews with those in the BSD Community.","date_published":"2024-10-10T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a994539c-8d64-4bca-904d-9e2a5c7e07ae.mp3","mime_type":"audio/mpeg","size_in_bytes":58487040,"duration_in_seconds":3655}]},{"id":"22c6b8d0-ef8b-4925-b6a7-ea8a666dec26","title":"579: EuroBSDcon 2024","url":"https://www.bsdnow.tv/579","content_text":"Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterviews\n\nVanja Cvelbar\n\nStefano Marinelli\n\nDave Cottlehuber\n\nChristos Margiolis\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n\n\nJason is on location at EuroBSDcon getting interviews with those in the BSD Community.","content_html":"<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interviews</h2>\n\n<h3>Vanja Cvelbar</h3>\n\n<h3>Stefano Marinelli</h3>\n\n<h3>Dave Cottlehuber</h3>\n\n<h3>Christos Margiolis</h3>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>\n\n<p>Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.</p>","summary":"Jason is on location at EuroBSDcon getting interviews with those in the BSD Community.","date_published":"2024-10-03T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/22c6b8d0-ef8b-4925-b6a7-ea8a666dec26.mp3","mime_type":"audio/mpeg","size_in_bytes":54336384,"duration_in_seconds":3396}]},{"id":"9ccb83c4-7aca-44f6-85bd-8e3e3487f781","title":"578: KVM, but Smol","url":"https://www.bsdnow.tv/578","content_text":"Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Tips and Tricks: Limiting Process Priority in a FreeBSD Jail\n\n\n\nWhy You Should Use FreeBSD\n\n\n\nNews Roundup\n\nThe web fun fact that domains can end in dots and canonicalization failures\n\n\n\nReplacing postfix with dma + auth\n\n\n\nmodern unix tool list\n\n\n\nSmol KVM\n\n\n\nThe Computers of Voyager\n\n\n\nBeastie Bits\n\n\nNo unmodified files remain from original import of OpenBSD\nThe BSDCan 2024 Playlist is now complete\nUDP parallel input committed to -current\nYour browser is your Computer\nFor the member-berries\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/11/limiting-process-priority-in-freebsd-jail/\" rel=\"nofollow\">FreeBSD Tips and Tricks: Limiting Process Priority in a FreeBSD Jail</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/why-you-should-use-freebsd/\" rel=\"nofollow\">Why You Should Use FreeBSD</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/web/DomainDotsAndCanonicalization\" rel=\"nofollow\">The web fun fact that domains can end in dots and canonicalization failures</a></p>\n\n<hr>\n\n<p><a href=\"https://dan.langille.org/2024/08/02/replacing-postfix-with-dma-auth/\" rel=\"nofollow\">Replacing postfix with dma + auth</a></p>\n\n<hr>\n\n<p><a href=\"https://notes.billmill.org/computer_usage/cli_tips_and_tools/modern_unix_tool_list.html\" rel=\"nofollow\">modern unix tool list</a></p>\n\n<hr>\n\n<p><a href=\"https://adventurist.me/posts/00324\" rel=\"nofollow\">Smol KVM</a></p>\n\n<hr>\n\n<p><a href=\"https://hackaday.com/2024/05/06/the-computers-of-voyager/\" rel=\"nofollow\">The Computers of Voyager</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.undeadly.org/cgi?action=article;sid=20240824114631\" rel=\"nofollow\">No unmodified files remain from original import of OpenBSD</a></li>\n<li><a href=\"https://www.undeadly.org/cgi?action=article;sid=20240814053159\" rel=\"nofollow\">The BSDCan 2024 Playlist is now complete</a></li>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20240727110501\" rel=\"nofollow\">UDP parallel input committed to -current</a></li>\n<li><a href=\"https://www.exaequos.com\" rel=\"nofollow\">Your browser is your Computer</a></li>\n<li><a href=\"https://defrag98.com\" rel=\"nofollow\">For the member-berries</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Limiting Process Priority in a FreeBSD Jail, Why You Should Use FreeBSD, The web fun fact that domains can end in dots and canonicalization failures, Replacing postfix with dma + auth, modern unix tool list, Smol KVM, The Computers of Voyager","date_published":"2024-09-26T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9ccb83c4-7aca-44f6-85bd-8e3e3487f781.mp3","mime_type":"audio/mpeg","size_in_bytes":55824384,"duration_in_seconds":3489}]},{"id":"ceb7dc79-e714-4083-b2c3-51e9e247b8ea","title":"577: Multi-Threaded LZ4","url":"https://www.bsdnow.tv/577","content_text":"New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD's vm-bhyve, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n[New Host Introduction]\n\n\n\nEvolving the BSD Cafe Network Setup: From Bridging to Routing With FreeBSD\n\n\n\nSovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization\n\n\n\nNews Roundup\n\nThe Dying Computer Museum\n\n\n\nIn practice, abstractions hide their underlying details\n\n\n\nLZ4 Compression Algorithm Gets Multi-Threaded Update\n\n\n\nUsing Windows or Linux on FreeBSD's vm-bhyve\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nhttps://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD&#39;s vm-bhyve, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p>[New Host Introduction]</p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/08/01/evolving-bsd-cafe-from-bridging-to-routing/\" rel=\"nofollow\">Evolving the BSD Cafe Network Setup: From Bridging to Routing With FreeBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/sovereign-tech-fund-to-invest-e686400-in-freebsd-infrastructure-modernization/\" rel=\"nofollow\">Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://ascii.textfiles.com/archives/5672\" rel=\"nofollow\">The Dying Computer Museum</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/tech/AbstractionsHideUnderlyingDetails\" rel=\"nofollow\">In practice, abstractions hide their underlying details</a></p>\n\n<hr>\n\n<p><a href=\"https://hardware.slashdot.org/story/24/07/28/0057247/lz4-compression-algorithm-gets-multi-threaded-update\" rel=\"nofollow\">LZ4 Compression Algorithm Gets Multi-Threaded Update</a></p>\n\n<hr>\n\n<p><a href=\"https://srobb.net/vm-bhyve.html\" rel=\"nofollow\">Using Windows or Linux on FreeBSD&#39;s vm-bhyve</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/577/feedback/Derek%20-%20Thanks.md</a></p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"New Host Introduction 🤭, From Bridging to Routing With FreeBSD, Sovereign Tech Fund to Invest €686,400 in FreeBSD Infrastructure Modernization, The Dying Computer Museum, In practice, abstractions hide their underlying details, LZ4 Compression Algorithm Gets Multi-Threaded Update, Using Windows or Linux on FreeBSD's vm-bhyve, and more","date_published":"2024-09-19T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ceb7dc79-e714-4083-b2c3-51e9e247b8ea.mp3","mime_type":"audio/mpeg","size_in_bytes":57201024,"duration_in_seconds":3575}]},{"id":"d7fcf7cf-acc7-48a6-955f-7eaf8ebe4f52","title":"576: The Forever Workaround","url":"https://www.bsdnow.tv/576","content_text":"From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFrom Cloud Chaos to FreeBSD Efficiency\n\n\n\nAugust 2024 Foundation Update\n\n\n\nNews Roundup\n\nEmails encryption at rest on OpenBSD using dovecot and GPG\n\n\n\nWorkarounds are often forever (unless you work to make them otherwise)\n\n\n\nRemote Desktop using RDP and VNC\n\n\n\nIconography of the X Window System: The Boot Stipple\n\n\n\nPlan 9 is a Uniquely Complete Operating System\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/\" rel=\"nofollow\">From Cloud Chaos to FreeBSD Efficiency</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/news-and-events/newsletter/august-2024-foundation-update/\" rel=\"nofollow\">August 2024 Foundation Update</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-08-14-automatic-emails-gpg-encryption-at-rest.html\" rel=\"nofollow\">Emails encryption at rest on OpenBSD using dovecot and GPG</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/WorkaroundsAreForeverByDefault\" rel=\"nofollow\">Workarounds are often forever (unless you work to make them otherwise)</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tumfatig.net/2024/remote-desktop-using-rdp-and-vnc/\" rel=\"nofollow\">Remote Desktop using RDP and VNC</a></p>\n\n<hr>\n\n<p><a href=\"https://matttproud.com/blog/posts/x-window-system-boot-stipple.html\" rel=\"nofollow\">Iconography of the X Window System: The Boot Stipple</a></p>\n\n<hr>\n\n<p><a href=\"https://posixcafe.org/blogs/2024/07/27/0/\" rel=\"nofollow\">Plan 9 is a Uniquely Complete Operating System</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"From Cloud Chaos to FreeBSD Efficiency, August 2024 Foundation Update, Email encryption at rest on OpenBSD using dovecot and GPG, Workarounds are often forever (unless you work to make them otherwise), Remote Desktop using RDP and VNC, Iconography of the X Window System: The Boot Stipple, Plan 9 is a Uniquely Complete Operating System, and more","date_published":"2024-09-12T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d7fcf7cf-acc7-48a6-955f-7eaf8ebe4f52.mp3","mime_type":"audio/mpeg","size_in_bytes":59358336,"duration_in_seconds":3709}]},{"id":"3c950f6d-fcf3-4fdf-a58b-df606f01192c","title":"575: Missing BSD/Linux","url":"https://www.bsdnow.tv/575","content_text":"X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD's 'root on ZFS' is appealing, I Miss BSD/Linux, Simple automated deployments using git\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nX Window System At 40\n\n\n\nLessons from Ancient File Systems\n\n\n\nNews Roundup\n\nHardenedBSD July 2024 Status Report\n\n\n\nFreeBSD's 'root on ZFS' default appeals to me for an odd reason\n\n\n\nI Miss BSD/Linux\n\n\n\nSimple automated deployments using git push\n\n\n\nBeastie Bits\n\n\nEuroBSDCon 2024\nEbook of “Run Your Own Mail Server” off to early backers\nInteractive UNIX\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD&#39;s &#39;root on ZFS&#39; is appealing, I Miss BSD/Linux, Simple automated deployments using git</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://blog.dshr.org/2024/07/x-window-system-at-40.html\" rel=\"nofollow\">X Window System At 40</a></p>\n\n<hr>\n\n<p><a href=\"https://madcompiler.blogspot.com/2024/02/lessons-from-ancient-file-systems.html\" rel=\"nofollow\">Lessons from Ancient File Systems</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://hardenedbsd.org/article/shawn-webb/2024-08-03/hardenedbsd-july-2024-status-report\" rel=\"nofollow\">HardenedBSD July 2024 Status Report</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FreeBSDZFSRootAppeal\" rel=\"nofollow\">FreeBSD&#39;s &#39;root on ZFS&#39; default appeals to me for an odd reason</a></p>\n\n<hr>\n\n<p><a href=\"https://brainbaking.com/post/2024/05/i-miss-bsd-linux/\" rel=\"nofollow\">I Miss BSD/Linux</a></p>\n\n<hr>\n\n<p><a href=\"https://garrido.io/notes/simple-automated-deployments-git-push/\" rel=\"nofollow\">Simple automated deployments using git push</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://2024.eurobsdcon.org\" rel=\"nofollow\">EuroBSDCon 2024</a></li>\n<li><a href=\"https://mwl.io/archives/23731\" rel=\"nofollow\">Ebook of “Run Your Own Mail Server” off to early backers</a></li>\n<li><a href=\"https://computeradsfromthepast.substack.com/p/interactive-unix\" rel=\"nofollow\">Interactive UNIX</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"X Window System At 40, Lessons from Ancient File Systems, HardenedBSD July 2024 Status Report, FreeBSD's 'root on ZFS' is appealing, I Miss BSD/Linux, Simple automated deployments using git","date_published":"2024-09-05T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3c950f6d-fcf3-4fdf-a58b-df606f01192c.mp3","mime_type":"audio/mpeg","size_in_bytes":49908864,"duration_in_seconds":3119}]},{"id":"915df8c4-be34-4de6-b7ad-7c756f7e835f","title":"574: Hypervisor Determination","url":"https://www.bsdnow.tv/574","content_text":"Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAntithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve\n\n\n\nOur slowly growing Unix monoculture\n\n\n\nNews Roundup\n\nThe six dumbest ideas in computer security (2005) + HN Thread\n\n\n\nVideo Edition notes on OpenBSD\n\n\n\nFull-featured email server running OpenBSD\n\n\n\nAnyone ever heard of teaching a case study of Initial Unix?\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n574 - extrowerk - dumb ideas in computer security\n\n574 - Ep 569: on deprecation and support\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/antithesis-pioneering-deterministic-hypervisors-with-freebsd-and-bhyve/\" rel=\"nofollow\">Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurGrowingUnixMonoculture\" rel=\"nofollow\">Our slowly growing Unix monoculture</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"http://ranum.com/security/computer_security/editorials/dumb/index.html\" rel=\"nofollow\">The six dumbest ideas in computer security (2005)</a> + <a href=\"https://news.ycombinator.com/item?id=34513806\" rel=\"nofollow\">HN Thread</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tumfatig.net/2024/video-edition-notes-on-openbsd/\" rel=\"nofollow\">Video Edition notes on OpenBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-07-24-openbsd-email-server-setup.html\" rel=\"nofollow\">Full-featured email server running OpenBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tuhs.org/pipermail/tuhs/2024-July/030407.html\" rel=\"nofollow\">Anyone ever heard of teaching a case study of Initial Unix?</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<h2>574 - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/extrowerk%20-%20dumb%20ideas%20in%20computer%20security.md\" rel=\"nofollow\">extrowerk - dumb ideas in computer security</a></h2>\n\n<h2>574 - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/574/feedback/Ep%20569%3A%20on%20deprecation%20and%20support\" rel=\"nofollow\">Ep 569: on deprecation and support</a></h2>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Antithesis: Pioneering Deterministic Hypervisors with FreeBSD and Bhyve, Our slowly growing Unix monoculture, The six dumbest ideas in computer security (2005), Video Edition notes on OpenBSD, Full-featured email server running OpenBSD, ever heard of teaching a case study of Initial Unix?, and more","date_published":"2024-08-29T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/915df8c4-be34-4de6-b7ad-7c756f7e835f.mp3","mime_type":"audio/mpeg","size_in_bytes":58220928,"duration_in_seconds":3638}]},{"id":"aec16048-9802-4728-a4b9-33cacc3e00c3","title":"573: Kyua Graduation","url":"https://www.bsdnow.tv/573","content_text":"What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhat Would It Take to Recreate Bell Labs?\n\n\n\nHuman Scale Software vs Open Source\n\n\n\nNews Roundup\n\nHow to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14\n\n\n\nWhy are some emails from Charlie Root and others are from root?\n\n\n\nBackward compatibility, even for settings, has real costs\n\n\n\nKyua graduates\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n573 - Vedran - linuxulator\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.construction-physics.com/p/what-would-it-take-to-recreate-bell\" rel=\"nofollow\">What Would It Take to Recreate Bell Labs?</a></p>\n\n<hr>\n\n<p><a href=\"https://posixcafe.org/blogs/2024/07/31/0/\" rel=\"nofollow\">Human Scale Software vs Open Source</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://group.miletic.net/en/blog/2024-06-14-how-to-run-visual-studio-vs-code-remote-over-ssh-on-freebsd-13-and-14\" rel=\"nofollow\">How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14</a></p>\n\n<hr>\n\n<p><a href=\"https://dan.langille.org/2024/07/27/why-are-some-emails-from-charlie-root-and-others-are-from-root/\" rel=\"nofollow\">Why are some emails from Charlie Root and others are from root?</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/programming/BackwardCompatibilityHasCosts\" rel=\"nofollow\">Backward compatibility, even for settings, has real costs</a></p>\n\n<hr>\n\n<p><a href=\"https://jmmv.dev/2024/08/kyua-graduates.html\" rel=\"nofollow\">Kyua graduates</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<p>573 - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/573/feedback/Vedran%20-%20linuxulator\" rel=\"nofollow\">Vedran - linuxulator</a></p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"What Would It Take to Recreate Bell Labs?, Human Scale Software vs Open Source, How to run Visual Studio (VS) Code Remote over SSH on FreeBSD 13 and 14, Why are some emails from Charlie Root and others are from root?, Backward compatibility has real costs even for settings, Kyua graduates, and more","date_published":"2024-08-22T08:30:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/aec16048-9802-4728-a4b9-33cacc3e00c3.mp3","mime_type":"audio/mpeg","size_in_bytes":52131072,"duration_in_seconds":3258}]},{"id":"a12099e3-91b5-4c50-bfd6-6c4e80cbbefb","title":"572: Where's my backup?","url":"https://www.bsdnow.tv/572","content_text":"OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD Workstation for the People\n\n\n\nBridging Networks Across VPS With Wireguard and VXLAN on FreeBSD\n\n\n\nNews Roundup\n\nUpdating FreeBSD the Manual Way\n\n\n\nPart of (computer) security is convincing people that it works\n\n\n\nWhere’s my backup?\n\n\n\nVi and Vim: A Brief Overview\n\n\n\nHello FreeBSD\n\n\n\nBeastie Bits\n\n\nDeadBSD #5 EnigmOS\nTHE WORKSTATION YOU WANTED IN 1990, IN YOUR POCKET\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\nJohnny - Nyxt\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.tumfatig.net/2024/openbsd-workstation-for-the-people/\" rel=\"nofollow\">OpenBSD Workstation for the People</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/15/bridging-networks-across-vps-wireguard-vxlan-freebsd/?utm_source=bsdweekly\" rel=\"nofollow\">Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://blog.feld.me/posts/2024/07/updating-freebsd-the-manual-way/\" rel=\"nofollow\">Updating FreeBSD the Manual Way</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/tech/SecurityNeedsToConvince\" rel=\"nofollow\">Part of (computer) security is convincing people that it works</a></p>\n\n<hr>\n\n<p><a href=\"https://dan.langille.org/2024/07/16/wheres-my-backup/\" rel=\"nofollow\">Where’s my backup?</a></p>\n\n<hr>\n\n<p><a href=\"https://machaddr.substack.com/p/vi-and-vim-a-brief-overview\" rel=\"nofollow\">Vi and Vim: A Brief Overview</a></p>\n\n<hr>\n\n<p><a href=\"https://garrido.io/posts/2024/07/21/hello-freebsd/\" rel=\"nofollow\">Hello FreeBSD</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=bPkX5UypCAQ\" rel=\"nofollow\">DeadBSD #5 EnigmOS</a></li>\n<li><a href=\"https://hackaday.com/2024/07/03/the-workstation-you-wanted-in-1990-in-your-pocket/\" rel=\"nofollow\">THE WORKSTATION YOU WANTED IN 1990, IN YOUR POCKET</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/572/feedback/Johnny%20-%20Nyxt.md\" rel=\"nofollow\">Johnny - Nyxt</a></p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"OpenBSD Workstation for the People, Bridging Networks Across VPS With Wireguard and VXLAN on FreeBSD, Updating FreeBSD the Manual Way, Part of (computer) security is convincing people that it works, Where’s my backup?, Vi and Vim: A Brief Overview, and more","date_published":"2024-08-15T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a12099e3-91b5-4c50-bfd6-6c4e80cbbefb.mp3","mime_type":"audio/mpeg","size_in_bytes":57835776,"duration_in_seconds":3614}]},{"id":"84f1031b-d3b0-4f29-ab3e-baec15d00f33","title":"571: Cloud Chaos","url":"https://www.bsdnow.tv/571","content_text":"Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNavigating FreeBSD’s New Quarterly and Biennial Release Schedule\n\n\n\nhttps://mccd.space/posts/netbsd-review/\n\n\n\nEuroBSDCon 2024 Schedule\n\n\n\nNews Roundup\n\nFrom Cloud Chaos to FreeBSD Efficiency\n\n\n\nEnable local-to-anchors tables in PF rules\n\n\n\nCloudBSD\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\nRick - Feedback about Docs Bugs\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/navigating-freebsds-new-quarterly-and-biennial-release-schedule/\" rel=\"nofollow\">Navigating FreeBSD’s New Quarterly and Biennial Release Schedule</a></p>\n\n<hr>\n\n<p><a href=\"https://mccd.space/posts/netbsd-review/\" rel=\"nofollow\">https://mccd.space/posts/netbsd-review/</a></p>\n\n<hr>\n\n<p><a href=\"https://events.eurobsdcon.org/2024/schedule/\" rel=\"nofollow\">EuroBSDCon 2024 Schedule</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/04/from-cloud-chaos-to-freebsd-efficiency/\" rel=\"nofollow\">From Cloud Chaos to FreeBSD Efficiency</a></p>\n\n<hr>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240714154257\" rel=\"nofollow\">Enable local-to-anchors tables in PF rules</a></p>\n\n<hr>\n\n<p><a href=\"https://cloudbsd.xyz/\" rel=\"nofollow\">CloudBSD</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/571/feedback/Rick%20-%20Feedback%20about%20Docs%20Bugs.md\" rel=\"nofollow\">Rick - Feedback about Docs Bugs</a></p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Navigating FreeBSD’s New Quarterly and Biennial Release Schedule, EuroBSDCon 2024 Schedule, From Cloud Chaos to FreeBSD Efficiency, Local-to-anchors tables in PF rules, CloudBSD, and more","date_published":"2024-08-08T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/84f1031b-d3b0-4f29-ab3e-baec15d00f33.mp3","mime_type":"audio/mpeg","size_in_bytes":66814464,"duration_in_seconds":4175}]},{"id":"4654582b-5a43-46d1-ac04-0be04cf72754","title":"570: RIP dhclient","url":"https://www.bsdnow.tv/570","content_text":"The FreeBSD-native-ish home lab and network, FreeBSD 14.1: What’s new, and how did we get here?, The Old Computer Challenge v4 (Olympics edition), MicroMac, a Macintosh for under £5, Adding a USB Port to the ThinkPad X1 Nano (the Hard Way), Reasons to use your shell's job control, RIP dhclient(8)\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe FreeBSD-native-ish home lab and network\n\n\n\nFreeBSD 14.1: What’s new, and how did we get here?\n\n\n\nNews Roundup\n\nThe Old Computer Challenge v4 (Olympics edition)\n\n\n\nMicroMac, a Macintosh for under £5\n\n\n\nAdding a USB Port to the ThinkPad X1 Nano (the Hard Way)\n\n\n\nReasons to use your shell's job control\n\n\n\nRIP dhclient(8)\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\nSpecial Guest: Brad Alexander.","content_html":"<p>The FreeBSD-native-ish home lab and network, FreeBSD 14.1: What’s new, and how did we get here?, The Old Computer Challenge v4 (Olympics edition), MicroMac, a Macintosh for under £5, Adding a USB Port to the ThinkPad X1 Nano (the Hard Way), Reasons to use your shell&#39;s job control, RIP dhclient(8)</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://antranigv.am/posts/2024/06/freebsd-server-network-homelab/\" rel=\"nofollow\">The FreeBSD-native-ish home lab and network</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/freebsd-14-1-whats-new-and-how-did-we-get-here/\" rel=\"nofollow\">FreeBSD 14.1: What’s new, and how did we get here?</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-06-24-old-computer-challenge-v4-announce.html\" rel=\"nofollow\">The Old Computer Challenge v4 (Olympics edition)</a></p>\n\n<hr>\n\n<p><a href=\"https://axio.ms/projects/2024/06/16/MicroMac.html\" rel=\"nofollow\">MicroMac, a Macintosh for under £5</a></p>\n\n<hr>\n\n<p><a href=\"https://jcs.org/2024/05/29/x1usb\" rel=\"nofollow\">Adding a USB Port to the ThinkPad X1 Nano (the Hard Way)</a></p>\n\n<hr>\n\n<p><a href=\"https://jvns.ca/blog/2024/07/03/reasons-to-use-job-control/\" rel=\"nofollow\">Reasons to use your shell&#39;s job control</a></p>\n\n<hr>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240701055457\" rel=\"nofollow\">RIP dhclient(8)</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr><p>Special Guest: Brad Alexander.</p>","summary":"The FreeBSD-native-ish home lab and network, FreeBSD 14.1: What’s new, and how did we get here?, The Old Computer Challenge v4 (Olympics edition), MicroMac, a Macintosh for under £5, Adding a USB Port to the ThinkPad X1 Nano (the Hard Way), Reasons to use your shell's job control, RIP dhclient(8)","date_published":"2024-08-01T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4654582b-5a43-46d1-ac04-0be04cf72754.mp3","mime_type":"audio/mpeg","size_in_bytes":56421504,"duration_in_seconds":3526}]},{"id":"766ceaa1-9d99-40fc-8a8c-b640d050e19e","title":"569: The ZFS Pi","url":"https://www.bsdnow.tv/569","content_text":"Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and\nmore\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nEnhancing FreeBSD Stability With ZFS Pool Checkpoints\n\n\n\nPlaintext is not a great format for (system) logs\n\n\n\nNews Roundup\n\nInitial playlist of 28 BSDCan Videos released\n\n\n\nInstalling FreeBSD 14 on Raspberry Pi 4B with ZFS root\n\n\nThe following components make up my setup:\n\n\nRaspberry Pi 4B, 8 GB RAM\nOfficial Raspberry Pi 4 Power Supply\nGeekworm Raspberry Pi 4 11mm Embedded Heatsink (P165-B)\nGeekworm for Raspberry Pi 4, X862 V2.0 M.2 NGFF SATA SSD Storage Expansion Board with USB 3.1 Connector Support Key-B 2280 SSD\nWD Blue SA510 SATA SSD 2 TB M.2 2280\n4K 60Hz Micro HDMI to HDMI Adapter (to connect to a monitor, can also run headless with just power and network cable connected)\n\n\n\n\n\nA practical guide to VPNs, IPv6, routing domains and IPSEC\n\n\n\nHow to mount ISO or file disk images on OpenBSD\n\n\n\nBeastie Bits\n\n\nDeadBSD Series - There have been a few FreeBSD derived OS’s over the years, some stay, many others fade away. In this series, DeadBSD’s, we will be revisiting those long gone BSD’s and see what we missed out on.\nFury\nCultBSD\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n569 - RobN - A Thanks\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and<br>\nmore</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/07/01/enhancing-freebsd-stability-with-zfs-pool-checkpoints/\" rel=\"nofollow\">Enhancing FreeBSD Stability With ZFS Pool Checkpoints</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/PlaintextNotGreatLogFormat\" rel=\"nofollow\">Plaintext is not a great format for (system) logs</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240630100913\" rel=\"nofollow\">Initial playlist of 28 BSDCan Videos released</a></p>\n\n<hr>\n\n<p><a href=\"https://axcella.com/blog/2024/02/03/installing-freebsd-14-on-raspberry-pi-4b-with-zfs-root/\" rel=\"nofollow\">Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root</a></p>\n\n<ul>\n<li>The following components make up my setup:\n\n<ul>\n<li><a href=\"https://www.raspberrypi.com/products/raspberry-pi-4-model-b/\" rel=\"nofollow\">Raspberry Pi 4B, 8 GB RAM</a></li>\n<li><a href=\"https://www.raspberrypi.com/products/power-supply/\" rel=\"nofollow\">Official Raspberry Pi 4 Power Supply</a></li>\n<li><a href=\"https://geekworm.com/products/raspberry-pi-4-11mm-embedded-heatsink-p165-b\" rel=\"nofollow\">Geekworm Raspberry Pi 4 11mm Embedded Heatsink (P165-B)</a></li>\n<li><a href=\"https://geekworm.com/products/x862\" rel=\"nofollow\">Geekworm for Raspberry Pi 4, X862 V2.0 M.2 NGFF SATA SSD Storage Expansion Board with USB 3.1 Connector Support Key-B 2280 SSD</a></li>\n<li><a href=\"https://www.westerndigital.com/products/internal-drives/wd-blue-sa510-sata-m-2-ssd?sku=WDS200T3B0B\" rel=\"nofollow\">WD Blue SA510 SATA SSD 2 TB M.2 2280</a></li>\n<li>4K 60Hz Micro HDMI to HDMI Adapter (to connect to a monitor, can also run headless with just power and network cable connected)</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240706084626\" rel=\"nofollow\">A practical guide to VPNs, IPv6, routing domains and IPSEC</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-06-15-mount-iso-file-openbsd.html\" rel=\"nofollow\">How to mount ISO or file disk images on OpenBSD</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li>DeadBSD Series - There have been a few FreeBSD derived OS’s over the years, some stay, many others fade away. In this series, DeadBSD’s, we will be revisiting those long gone BSD’s and see what we missed out on.</li>\n<li><a href=\"https://www.youtube.com/watch?v=3xl2BdlBjg0\" rel=\"nofollow\">Fury</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=hmT1fXuOyos\" rel=\"nofollow\">CultBSD</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<p>569 - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/569/feedback/Rob%20-%20A%20Thanks.md\" rel=\"nofollow\">RobN - A Thanks</a></p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Enhancing FreeBSD Stability With ZFS Pool Checkpoints, Plaintext is not a great format for (system) logs, Initial playlist of 28 BSDCan Videos released, Installing FreeBSD 14 on Raspberry Pi 4B with ZFS root, A practical guide to VPNs, IPv6, routing domains and IPSEC, How to mount ISO or file disk images on OpenBSD, and more","date_published":"2024-07-25T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/766ceaa1-9d99-40fc-8a8c-b640d050e19e.mp3","mime_type":"audio/mpeg","size_in_bytes":45727104,"duration_in_seconds":2857}]},{"id":"a0464306-5fee-4eba-a81c-b26393ebd0f2","title":"568: regreSSHion","url":"https://www.bsdnow.tv/568","content_text":"regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nregreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems and OpenBSD 9.8\n\n\n\nImproving and debugging FreeBSDs Intel wifi support\n\n\n\nFreeBSD adds an implementation of the 9P filesystem\n\n\n\nNews Roundup\n\nFreeBSD Zero to Desktop Speedrun Challenge\n\n\n\nWhy and how to run your own FreeBSD package cache\n\n\n\nGame of Trees Hub: A Git Repository Hosting Service Based on OpenBSD\n\n\n\nWhy Does FreeBSD Default to Csh/Tcsh? Exploring Its Advantages\n\n\n\nAI-assisted computer interfaces of the future\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt\" rel=\"nofollow\">regreSSHion: RCE in OpenSSH&#39;s server, on glibc-based Linux systems</a> and <a href=\"https://undeadly.org/cgi?action=article;sid=20240701102851\" rel=\"nofollow\">OpenBSD 9.8</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/improving-and-debugging-freebsds-intel-wi-fi-support-cheng-cuis-key-role-in-the-iwlwifi-project/\" rel=\"nofollow\">Improving and debugging FreeBSDs Intel wifi support</a></p>\n\n<hr>\n\n<p><a href=\"https://cgit.freebsd.org/src/commit/?id=e97ad33a89a78f55280b0485b3249ee9b907a718\" rel=\"nofollow\">FreeBSD adds an implementation of the 9P filesystem</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://vermaden.wordpress.com/2024/04/05/freebsd-zero-to-desktop-speedrun-challenge/\" rel=\"nofollow\">FreeBSD Zero to Desktop Speedrun Challenge</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.rlwinm.de/why-and-how-to-run-your-own-freebsd-package-cache-3wbg\" rel=\"nofollow\">Why and how to run your own FreeBSD package cache</a></p>\n\n<hr>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240621074337\" rel=\"nofollow\">Game of Trees Hub: A Git Repository Hosting Service Based on OpenBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://lobste.rs/s/iuzuge/why_does_freebsd_default_csh_tcsh\" rel=\"nofollow\">Why Does FreeBSD Default to Csh/Tcsh? Exploring Its Advantages</a></p>\n\n<hr>\n\n<p><a href=\"https://whynothugo.nl/journal/2023/03/23/ai-assisted-computer-interfaces-of-the-future/\" rel=\"nofollow\">AI-assisted computer interfaces of the future</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"regreSSHion vulnerability, Improving and debugging FreeBSDs Intel wifi support, FreeBSD adds an implementation of the 9P filesystem, FreeBSD Zero to Desktop Speedrun Challenge, Why and how to run your own FreeBSD package cache, Game of Trees Hub, Why Does FreeBSD Default to Csh/Tcsh, and more","date_published":"2024-07-18T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a0464306-5fee-4eba-a81c-b26393ebd0f2.mp3","mime_type":"audio/mpeg","size_in_bytes":78023565,"duration_in_seconds":3250}]},{"id":"d7de607e-7822-486f-8649-0053e89207a6","title":"567: To the Core","url":"https://www.bsdnow.tv/567","content_text":"SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nSSH as a sudo replacement\n\n\n\nCore.13 is Now In Office\n\n\n\nNews Roundup\n\nRunning GoToSocial on NetBSD\n\n\n\nA DMD package for OpenIndiana\n\n\n\nAdding more swap space to Omnios\n\n\n\nOpenBSD added initial support for Qualcomm Snapdragon Elite X after 1 day\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nIsa - Pinebook Question.md\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://whynothugo.nl/journal/2024/06/13/ssh-as-a-sudo-replacement/\" rel=\"nofollow\">SSH as a sudo replacement</a></p>\n\n<hr>\n\n<p><a href=\"https://lists.freebsd.org/archives/freebsd-announce/2024-June/000136.html\" rel=\"nofollow\">Core.13 is Now In Office</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://www.tumfatig.net/2024/running-gotosocial-on-netbsd/\" rel=\"nofollow\">Running GoToSocial on NetBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://briancallahan.net/blog/20240609.html\" rel=\"nofollow\">A DMD package for OpenIndiana</a></p>\n\n<hr>\n\n<p><a href=\"https://neirac.srht.site/posts/omnios-add-swap.html\" rel=\"nofollow\">Adding more swap space to Omnios</a></p>\n\n<hr>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240620105457\" rel=\"nofollow\">OpenBSD added initial support for Qualcomm Snapdragon Elite X after 1 day</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/567/feedback/Isa%20-%20Pinebook%20Question.md\" rel=\"nofollow\">Isa - Pinebook Question.md</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"SSH as a sudo replacement, Core.13 is Now In Office, Running GoToSocial on NetBSD, A DMD package for OpenIndiana, Adding more swap space to Omnios, OpenBSD adds initial support for Qualcomm Snapdragon Elite X after 1 day, and more","date_published":"2024-07-11T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d7de607e-7822-486f-8649-0053e89207a6.mp3","mime_type":"audio/mpeg","size_in_bytes":60410304,"duration_in_seconds":2517}]},{"id":"6d99d221-b4fa-4373-b5df-1a36548bfd9e","title":"566: Open Source Excellence","url":"https://www.bsdnow.tv/566","content_text":"A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD's, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nCelebrating FreeBSD Day: A Journey Through 31 Years of Open Source Excellence\n\n\n\nProxmox vs FreeBSD: Which Virtualization Host Performs Better?\n\n\n\nNews Roundup\n\nUpstreaming FreeBSD Code to the Linux Vector Packet Processor Project\n\n\n\nFreeBSD Tips and Tricks: Creating Snapshots With UFS\n\n\n\nMy Concern With Rust, or a Case for the BSD's\n\n\n\nBeastie Bits\n\n\nInstall FreeBSD 14.1 and KDE Plasma 6 in QEMU VM tutorial - June 2024 - 2da0c933\nLet's Try BSD, Part 1 of 7: Introduction\nOpenBSD, the computer appliance maker's secret weapon\nFreeBSD Day: Interview with Deb Goodkin\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nJohnny - Thanks\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD&#39;s, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://hamradio.my/2024/06/celebrating-freebsd-day-a-journey-through-31-years-of-open-source-excellence/\" rel=\"nofollow\">Celebrating FreeBSD Day: A Journey Through 31 Years of Open Source Excellence</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/06/10/proxmox-vs-freebsd-which-virtualization-host-performs-better/\" rel=\"nofollow\">Proxmox vs FreeBSD: Which Virtualization Host Performs Better?</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://thenewstack.io/upstreaming-the-linux-vector-packet-processor-vpp-to-freebsd/\" rel=\"nofollow\">Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/06/04/freebsd-tips-and-tricks-creating-snapshots-with-ufs/\" rel=\"nofollow\">FreeBSD Tips and Tricks: Creating Snapshots With UFS</a></p>\n\n<hr>\n\n<p><a href=\"https://superserverhero.com/reports/my-concern-with-rust\" rel=\"nofollow\">My Concern With Rust, or a Case for the BSD&#39;s</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><p><a href=\"https://www.youtube.com/watch?v=mmjYuDjWXto&t=1s\" rel=\"nofollow\">Install FreeBSD 14.1 and KDE Plasma 6 in QEMU VM tutorial - June 2024 - 2da0c933</a></p></li>\n<li><p><a href=\"https://lowendbox.com/blog/lets-try-bsd-part-1-of-7-introduction-freebsd-openbsd-netbsd-dragonflybsd/\" rel=\"nofollow\">Let&#39;s Try BSD, Part 1 of 7: Introduction</a></p></li>\n<li><p><a href=\"https://hiandrewquinn.github.io/til-site/posts/openbsd-the-computer-appliance-maker-s-secret-weapon/\" rel=\"nofollow\">OpenBSD, the computer appliance maker&#39;s secret weapon</a></p></li>\n<li><p><a href=\"https://youtu.be/xuYBsRAMvA8\" rel=\"nofollow\">FreeBSD Day: Interview with Deb Goodkin</a></p></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/566/feedback/johnny%20-%20thanks.md\" rel=\"nofollow\">Johnny - Thanks</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"A Journey Through 31 Years of Open Source Excellence, Proxmox vs FreeBSD: Which Virtualization Host Performs Better?, Upstreaming FreeBSD Code to the Linux Vector Packet Processor Project, FreeBSD Tips and Tricks: Creating Snapshots With UFS, My Concern With Rust, or a Case for the BSD's, and more","date_published":"2024-07-04T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6d99d221-b4fa-4373-b5df-1a36548bfd9e.mp3","mime_type":"audio/mpeg","size_in_bytes":80745408,"duration_in_seconds":3364}]},{"id":"0e1b5cea-6e44-44e4-ac3a-f6f0fe49814c","title":"565: Secure by default","url":"https://www.bsdnow.tv/565","content_text":"NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts '42% less Unix philosophy', Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.\nDate: 2024.06.17\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNetBSD 10 on a Pinebook Pro\n\n\n\nOpenBSD extreme privacy setup\n\n\n\nNews Roundup\n\nVersion 256 of systemd boasts '42% less Unix philosophy'\n\n\n\nPosix.1 2024 is out\n\n\n\nBlocking Access From or to Specific Countries Using FreeBSD and Pf\n\n\n\nBeastie Bits\n\n\nBSD User Group Düsseldorf Juli 2024\nAnother cool UNIX workstation, that was never released\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;, Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.<br>\nDate: 2024.06.17</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.idatum.net/netbsd-10-on-a-pinebook-pro-laptop.html\" rel=\"nofollow\">NetBSD 10 on a Pinebook Pro</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-06-08-openbsd-privacy-setup.html\" rel=\"nofollow\">OpenBSD extreme privacy setup</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://www.theregister.com/2024/06/13/version_256_systemd/\" rel=\"nofollow\">Version 256 of systemd boasts &#39;42% less Unix philosophy&#39;</a></p>\n\n<hr>\n\n<p><a href=\"https://ieeexplore.ieee.org/document/10555529\" rel=\"nofollow\">Posix.1 2024 is out</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/06/16/freebsd-blocking-country-access/\" rel=\"nofollow\">Blocking Access From or to Specific Countries Using FreeBSD and Pf</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.meetup.com/de-DE/bsd-user-group-dusseldorf-bsd-nrw/events/301557512/\" rel=\"nofollow\">BSD User Group Düsseldorf Juli 2024</a></li>\n<li><a href=\"https://www.reddit.com/r/unix/comments/1dd60re/another_cool_unix_workstation_that_was_never/\" rel=\"nofollow\">Another cool UNIX workstation, that was never released</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"NetBSD 10 on a Pinebook Pro, OpenBSD extreme privacy setup, Version 256 of systemd boasts '42% less Unix philosophy', Posix.1 2024 is out, Blocking Access From or to Specific Countries Using FreeBSD and Pf, and more.\r\nDate: 2024.06.17","date_published":"2024-06-27T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0e1b5cea-6e44-44e4-ac3a-f6f0fe49814c.mp3","mime_type":"audio/mpeg","size_in_bytes":74142504,"duration_in_seconds":3089}]},{"id":"75f62433-2e69-4de9-ad72-000a03d75e16","title":"564: Computation Poems","url":"https://www.bsdnow.tv/564","content_text":"Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nResults from the 2024 FreeBSD Community Survey Report\n\n\n\nWhat is Computer Science? ~1967\n\n\n\nNews Roundup\n\nComputation Poems\n\n\n\nOld Info, but still good -- HOWTO: Set up and configure security/sshguard-pf\n\n\n\nobservium-freebsd-install\n\n\n\nFreeBSD Tips and Tricks: Native Read-Only Root File System\n\n\n\nOpenSSH introduces options to penalize undesirable behavior\n\n\n\nBeastie Bits\n\n\nA Unix* Primer\nRunning Xvnc through the INETD\nifconfig\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/results-from-the-2024-freebsd-community-survey-report/\" rel=\"nofollow\">Results from the 2024 FreeBSD Community Survey Report</a></p>\n\n<hr>\n\n<p><a href=\"https://www.cs.cmu.edu/%7Echoset/whatiscs.html\" rel=\"nofollow\">What is Computer Science? ~1967</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://nickm.com/poems/\" rel=\"nofollow\">Computation Poems</a></p>\n\n<hr>\n\n<p><a href=\"https://forums.FreeBSD.org/threads/howto-set-up-and-configure-security-sshguard-pf.39196/\" rel=\"nofollow\">Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf</a></p>\n\n<hr>\n\n<p><a href=\"https://github.com/pmhausen/observium-freebsd-install\" rel=\"nofollow\">observium-freebsd-install</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/05/31/freebsd-tips-and-tricks-native-ro-rootfs/\" rel=\"nofollow\">FreeBSD Tips and Tricks: Native Read-Only Root File System</a></p>\n\n<hr>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240607042157\" rel=\"nofollow\">OpenSSH introduces options to penalize undesirable behavior</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://archive.org/details/unixprimer0000lomu/mode/2up\" rel=\"nofollow\">A Unix* Primer</a></li>\n<li><a href=\"https://bugs.dragonflybsd.org/issues/3300#change-14548\" rel=\"nofollow\">Running Xvnc through the INETD</a></li>\n<li><a href=\"https://man.ifconfig.se/\" rel=\"nofollow\">ifconfig</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Results from the 2024 FreeBSD Community Survey Report, What is Computer Science? ~1967, Computation Poems, Old Info, but still good -- HOWTO: Set up and configure security/sshguard-pf, observium-freebsd-install, FreeBSD Tips and Tricks: Native Read-Only Root File System, OpenSSH introduces options to penalize undesirable behavior, and more","date_published":"2024-06-20T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/75f62433-2e69-4de9-ad72-000a03d75e16.mp3","mime_type":"audio/mpeg","size_in_bytes":74329664,"duration_in_seconds":3096}]},{"id":"6f802912-a29d-4285-ac35-22bd8efcebeb","title":"563: 14.1","url":"https://www.bsdnow.tv/563","content_text":"FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD 14.1-RELEASE Announcement\n\n\n\nNews Roundup\n\nAutomatic dark mode with OpenBSD and dwm\n\n\n\ndhcp6leased(8) imported to -current\n\nDHCPv6-PD - First steps by florian@\n\n\n\nReplacing my OPNsense gateway hardware by a Protectli appliance\n\n\n\nHow to alter file owernship and permissions with a feedback information\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nSad News\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.freebsd.org/releases/14.1R/announce/\" rel=\"nofollow\">FreeBSD 14.1-RELEASE Announcement</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://plexwave.org/blog/auto-dark-mode\" rel=\"nofollow\">Automatic dark mode with OpenBSD and dwm</a></p>\n\n<hr>\n\n<p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20240604085042&utm_source=bsdweekly\" rel=\"nofollow\">dhcp6leased(8) imported to -current</a></p>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240606180535\" rel=\"nofollow\">DHCPv6-PD - First steps by florian@</a></p>\n\n<hr>\n\n<p><a href=\"https://www.ncartron.org/replacing-my-opnsense-gateway-hardware-by-a-protectli-appliance.html\" rel=\"nofollow\">Replacing my OPNsense gateway hardware by a Protectli appliance</a></p>\n\n<hr>\n\n<p><a href=\"https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/\" rel=\"nofollow\">How to alter file owernship and permissions with a feedback information</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/563/feedback/sad_news.md\" rel=\"nofollow\">Sad News</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"FreeBSD 14.1-RELEASE Announcement, Automatic dark mode with OpenBSD and dwm, dhcp6leased(8) imported to -current, DHCPv6-PD - First steps by florian@, Replacing my OPNsense gateway hardware by a Protectli appliance, How to alter file owernship and permissions with a feedback information, and more","date_published":"2024-06-13T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f802912-a29d-4285-ac35-22bd8efcebeb.mp3","mime_type":"audio/mpeg","size_in_bytes":47132160,"duration_in_seconds":2945}]},{"id":"fc1d93fb-8b7a-40cd-8141-6a2a676e6545","title":"562: All by myself","url":"https://www.bsdnow.tv/562","content_text":"My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n\n\nFreeBSD Devsummit 2024 Schedule\n\nBSDCan 2024 Schedule\n\n\n\nNews Roundup\n\nA list of things I was drawn deeper into, got excited about, and wanted to tell you more about.\n\n\n\nSyncthing\n\n\n\nPaperless-ngx\n\n\nFreeBSD ports man page\n\n\n\n\nNeovim\n\n\nList of popular plugins and themes\nNeovim for Newbs (by the Typecraft guy)\nJosean Martinez does a step by step tutorial\nBlog post about the setup\nTJ DeVries (Neovim developer) reads the entire manual in 9:27:42\n\n\n\n\nThings we always remind ourselves while coding\n\n\n\nBeastie Bits\n\n\nMe giving a ZFS intro talk, Sci-fi style (German)\nGulaschprogrammiernacht (GPN) 22 (some English talks, but most in German)\nA RAM-disk based workflow\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/news-and-events/event-calendar/may-2024-freebsd-developer-summit/\" rel=\"nofollow\">FreeBSD Devsummit 2024 Schedule</a></p>\n\n<p><a href=\"https://indico.bsdcan.org/event/1/timetable/?#20240531.detailed\" rel=\"nofollow\">BSDCan 2024 Schedule</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p>A list of things I was drawn deeper into, got excited about, and wanted to tell you more about.</p>\n\n<hr>\n\n<p><a href=\"https://syncthing.net\" rel=\"nofollow\">Syncthing</a></p>\n\n<hr>\n\n<p><a href=\"https://docs.paperless-ngx.com\" rel=\"nofollow\">Paperless-ngx</a></p>\n\n<ul>\n<li><a href=\"https://man.freebsd.org/cgi/man.cgi?query=paperless&apropos=0&sektion=0&manpath=FreeBSD+14.0-RELEASE+and+Ports&arch=default&format=html\" rel=\"nofollow\">FreeBSD ports man page</a></li>\n</ul>\n\n<hr>\n\n<p><a href=\"https://neovim.io\" rel=\"nofollow\">Neovim</a></p>\n\n<ul>\n<li><p><a href=\"https://neovimcraft.com\" rel=\"nofollow\">List of popular plugins and themes</a></p></li>\n<li><p><a href=\"https://www.youtube.com/playlist?list=PLsz00TDipIffreIaUNk64KxTIkQaGguqn\" rel=\"nofollow\">Neovim for Newbs (by the Typecraft guy)</a></p></li>\n<li><p><a href=\"https://www.youtube.com/watch?v=6pAG3BHurdM&list=PLnu5gT9QrFg36OehOdECFvxFFeMHhb_07&index=11&pp=iAQB\" rel=\"nofollow\">Josean Martinez does a step by step tutorial</a></p></li>\n<li><p><a href=\"https://www.josean.com/posts/how-to-setup-neovim-2024\" rel=\"nofollow\">Blog post about the setup</a></p></li>\n<li><p><a href=\"https://www.youtube.com/watch?v=rT-fbLFOCy0\" rel=\"nofollow\">TJ DeVries (Neovim developer) reads the entire manual in 9:27:42</a></p></li>\n</ul>\n\n<hr>\n\n<p><a href=\"https://changelog.com/posts/things-we-always-remind-ourselves-while-coding\" rel=\"nofollow\">Things we always remind ourselves while coding</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://media.ccc.de/v/fsck-2024-66-disk-space-the-final-frontier-\" rel=\"nofollow\">Me giving a ZFS intro talk, Sci-fi style (German)</a></li>\n<li><a href=\"https://cfp.gulas.ch/gpn22/schedule/\" rel=\"nofollow\">Gulaschprogrammiernacht (GPN) 22 (some English talks, but most in German)</a></li>\n<li><a href=\"https://people.freebsd.org/%7Edch/posts/2014-09-05-a-ramdisk-based-workflow/\" rel=\"nofollow\">A RAM-disk based workflow</a></li>\n</ul>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"My personal BSDCan Devsummit and Schedule, Syncthing, Paperless-ngx, neovim, Things we always remind ourselves while coding, and more.","date_published":"2024-06-06T00:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fc1d93fb-8b7a-40cd-8141-6a2a676e6545.mp3","mime_type":"audio/mpeg","size_in_bytes":70874112,"duration_in_seconds":4429}]},{"id":"499e2b62-bfa6-43ac-95b3-3b9962a113de","title":"561: Kicked off ARPANET","url":"https://www.bsdnow.tv/561","content_text":"Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle's algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhy FreeBSD Continues to Innovate and Thrive\n\n\n\nWhy BSD\n\n\n\nNews Roundup\n\nA BSD person tries Alpine Linux\n\n\n\nThis message does not exist\n\n\n\nDemise of Nagle's algorithm (RFC 896 - Congestion Control) predicted via sysctl\n\n\n\nHow Jerry Pournelle Got Kicked Off the ARPANET\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle&#39;s algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/why-freebsd-continues-to-innovate-and-thrive/\" rel=\"nofollow\">Why FreeBSD Continues to Innovate and Thrive</a></p>\n\n<hr>\n\n<p><a href=\"https://michal.sapka.me/bsd/why-bsd/\" rel=\"nofollow\">Why BSD</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://rubenerd.com/a-bsd-pserson-trying-alpine-linux/\" rel=\"nofollow\">A BSD person tries Alpine Linux</a></p>\n\n<hr>\n\n<p><a href=\"https://www.kmjn.org/notes/message_existence.html\" rel=\"nofollow\">This message does not exist</a></p>\n\n<hr>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240514075024\" rel=\"nofollow\">Demise of Nagle&#39;s algorithm (RFC 896 - Congestion Control) predicted via sysctl</a></p>\n\n<hr>\n\n<p><a href=\"https://delong.typepad.com/sdj/2013/07/how-jerry-pournelle-got-kicked-off-the-arpanet.html\" rel=\"nofollow\">How Jerry Pournelle Got Kicked Off the ARPANET</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Why FreeBSD Continues to Innovate and Thrive, Why BSD, A BSD person tries Alpine Linux, This message does not exist, Demise of Nagle's algorithm, How Jerry Pournelle Got Kicked Off the ARPANET, and more","date_published":"2024-05-30T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/499e2b62-bfa6-43ac-95b3-3b9962a113de.mp3","mime_type":"audio/mpeg","size_in_bytes":59200128,"duration_in_seconds":3700}]},{"id":"9822ee64-8eaf-48cf-8603-d583f258fc4f","title":"560: Why not BSD","url":"https://www.bsdnow.tv/560","content_text":"FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Status Report First Quarter 2024\n\n\n\nWhy not BSD + Sequel next week\n\n\n\nNews Roundup\n\nLibreSSL version 3.9.2 released\n\n\n\nRunning NetBSD on OmniOS using bhyve\n\n\n\nX.Org on NetBSD - the state of things\n\n\n\nUnix version control lore: what, ident\n\n\n\nHow I search in 2024\n\n\n\nsshd(8) split into multiple binaries\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.freebsd.org/status/report-2024-01-2024-03/\" rel=\"nofollow\">FreeBSD Status Report First Quarter 2024</a></p>\n\n<hr>\n\n<p><a href=\"https://michal.sapka.me/bsd/why-not-bsd/\" rel=\"nofollow\">Why not BSD</a> + Sequel next week</p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240512115958\" rel=\"nofollow\">LibreSSL version 3.9.2 released</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tumfatig.net/2024/running-netbsd-on-omnios-using-bhyve/\" rel=\"nofollow\">Running NetBSD on OmniOS using bhyve</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.netbsd.org/tnf/entry/x_org_on_netbsd_the\" rel=\"nofollow\">X.Org on NetBSD - the state of things</a></p>\n\n<hr>\n\n<p><a href=\"https://dotat.at/@/2024-05-13-what-ident.html\" rel=\"nofollow\">Unix version control lore: what, ident</a></p>\n\n<hr>\n\n<p><a href=\"https://vickiboykis.com/2024/04/25/how-i-search-in-2024/\" rel=\"nofollow\">How I search in 2024</a></p>\n\n<hr>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240517092416\" rel=\"nofollow\">sshd(8) split into multiple binaries</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"FreeBSD Status Report First Quarter 2024, Why not BSD, LibreSSL version 3.9.2 released, Running NetBSD on OmniOS using bhyve, X.Org on NetBSD, Unix version control lore: what, ident, How I search in 2024, sshd split into multiple binaries, and more","date_published":"2024-05-23T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9822ee64-8eaf-48cf-8603-d583f258fc4f.mp3","mime_type":"audio/mpeg","size_in_bytes":59353728,"duration_in_seconds":3709}]},{"id":"9e7884ae-e36e-4f7f-8c73-96cd70d35b45","title":"559: Rainy WiFi Days","url":"https://www.bsdnow.tv/559","content_text":"An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it's raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAn RNG that runs in your brain\n\n\n\nGoing Stateless\n\n\n\nNews Roundup\n\nSmolBSD\n\n\n\nThe Wi-Fi only works when it's raining\n\n\n\nWayland, where are we in 2024? Any good for being the default?\n\n\n\nOmnios pxe booting\n\n\n\nOpenBSD scripts to convert wg-quick VPN files\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it&#39;s raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.hillelwayne.com/post/randomness/\" rel=\"nofollow\">An RNG that runs in your brain</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-04-20-workstation-going-stateless.html\" rel=\"nofollow\">Going Stateless</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://smolbsd.org\" rel=\"nofollow\">SmolBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://predr.ag/blog/wifi-only-works-when-its-raining/\" rel=\"nofollow\">The Wi-Fi only works when it&#39;s raining</a></p>\n\n<hr>\n\n<p><a href=\"https://www.dedoimedo.com/computers/wayland-2024.html\" rel=\"nofollow\">Wayland, where are we in 2024? Any good for being the default?</a></p>\n\n<hr>\n\n<p><a href=\"https://neirac.srht.site/posts/ipxe_boot.html\" rel=\"nofollow\">Omnios pxe booting</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-04-27-openbsd-wg-quick-converter.html\" rel=\"nofollow\">OpenBSD scripts to convert wg-quick VPN files</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"An RNG that runs in your brain, Going Stateless, SmolBSD, The Wi-Fi only works when it's raining, Wayland, where are we in 2024?, Omnios pxe booting, OpenBSD scripts to convert wg-quick VPN files, and more","date_published":"2024-05-16T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e7884ae-e36e-4f7f-8c73-96cd70d35b45.mp3","mime_type":"audio/mpeg","size_in_bytes":54996864,"duration_in_seconds":3437}]},{"id":"813adc0b-a4ca-4810-9cac-ef64a1dafccd","title":"558: Worlds of telnet","url":"https://www.bsdnow.tv/558","content_text":"NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNetBSD 9.4\n\n\n\nFreeBSD Foundation Delivers V1 of FreeBSD SSDF Attestation to Support Cybersecurity Compliance\n\n\n\nNews Roundup\n\nThe Lost Worlds of Telnet\n\n\n\nHow to alter file ownership and permissions with a feedback information\n\n\n\nComing soon to a -current system near you: parallel raw IP input\n\n\n\nOpenBSD routers on AliExpress mini PCs\n\n\n\nFreeBSD for Devs\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nFeedback/Questions\n\n\nDaniel - jail issue\nRick - ZFS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.netbsd.org/releases/formal-9/NetBSD-9.4.html\" rel=\"nofollow\">NetBSD 9.4</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-delivers-v1-of-freebsd-ssdf-attestation-to-support-cybersecurity-compliance/\" rel=\"nofollow\">FreeBSD Foundation Delivers V1 of FreeBSD SSDF Attestation to Support Cybersecurity Compliance</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://thenewstack.io/the-lost-worlds-of-telnet/\" rel=\"nofollow\">The Lost Worlds of Telnet</a></p>\n\n<hr>\n\n<p><a href=\"https://sleeplessbeastie.eu/2024/04/18/how-to-alter-file-ownership-and-permissions-with-a-feedback-information/\" rel=\"nofollow\">How to alter file ownership and permissions with a feedback information</a></p>\n\n<hr>\n\n<p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20240418050520\" rel=\"nofollow\">Coming soon to a -current system near you: parallel raw IP input</a></p>\n\n<hr>\n\n<p><a href=\"https://www.srcbeat.com/2024/02/aliexpress-openbsd-router/\" rel=\"nofollow\">OpenBSD routers on AliExpress mini PCs</a></p>\n\n<hr>\n\n<p><a href=\"https://dev.to/scovl/freebsd-for-devs-3n0k\" rel=\"nofollow\">FreeBSD for Devs</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Daniel%20-%20jail%20issue.md\" rel=\"nofollow\">Daniel - jail issue</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/556/feedback/Rick%20-%20ZFS.md\" rel=\"nofollow\">Rick - ZFS</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"NetBSD 9.4, FreeBSD SSDF Attestation to Support Cybersecurity Compliance, The Lost Worlds of Telnet, alter file ownership and permissions with a feedback information, parallel raw IP input, OpenBSD routers on AliExpress mini PCs, FreeBSD for Devs.  Plus a special interview with the organizers of BSDCAN 2024.","date_published":"2024-05-09T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/813adc0b-a4ca-4810-9cac-ef64a1dafccd.mp3","mime_type":"audio/mpeg","size_in_bytes":87563520,"duration_in_seconds":5472}]},{"id":"e7b7b0ae-86ba-4f1e-849b-e46741b63ebd","title":"557: 17h per frame","url":"https://www.bsdnow.tv/557","content_text":"Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast', and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpen Source Software: The $9 Trillion Resource Companies Take for Granted\n\n\n\nTinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review\n\n\n\nNews Roundup\n\nOpenSMTPD 7.5.0p0 Released\n\n\n\nOpenBSD 7.5 locks down with improved disk encryption support and syscall limitations\n\n\n\nBook 8088\n\n\n\nCustom Prometheus dashboards using Console templates\n\n\n\nFreeBSD Foundation March 2024 Partnerships Update\n\n\n\nRay tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast'\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://hbswk.hbs.edu/item/open-source-software-the-nine-trillion-resource-companies-take-for-granted\" rel=\"nofollow\">Open Source Software: The $9 Trillion Resource Companies Take for Granted</a></p>\n\n<hr>\n\n<p><a href=\"https://www.autodidacts.io/pinebook-pro-linux-bsd-laptop-review-tutorial/\" rel=\"nofollow\">Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial &amp; review</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240410185045\" rel=\"nofollow\">OpenSMTPD 7.5.0p0 Released</a></p>\n\n<hr>\n\n<p><a href=\"https://www.theregister.com/2024/04/12/openbsd_75_disk_encryption/\" rel=\"nofollow\">OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations</a></p>\n\n<hr>\n\n<p><a href=\"https://liliputing.com/version-2-0-of-the-book-8088-retro-mini-laptop-adds-vga-graphics-card-and-serial-ports/\" rel=\"nofollow\">Book 8088</a></p>\n\n<hr>\n\n<p><a href=\"https://tumfatig.net/2024/custom-prometheus-dashboards-using-console-templates/\" rel=\"nofollow\">Custom Prometheus dashboards using Console templates</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/march-2024-partnerships-update/\" rel=\"nofollow\">FreeBSD Foundation March 2024 Partnerships Update</a></p>\n\n<hr>\n\n<p><a href=\"https://www.pcgamer.com/ray-tracing-made-possible-on-42-year-old-zx-spectrum-reasonably-fast-if-you-consider-17-hours-per-frame-to-be-reasonably-fast/\" rel=\"nofollow\">Ray tracing made possible on 42-year-old ZX Spectrum: &#39;reasonably fast, if you consider 17 hours per frame to be reasonably fast&#39;</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Open Source Software: The $9 Trillion Resource Companies Take for Granted, Tinkering with Manjaro and NetBSD on the Pinebook Pro: a crumbs-in-the-forest tutorial & review, OpenSMTPD 7.5.0p0 Released, OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations, Book 8088, Custom Prometheus dashboards using Console templates, FreeBSD Foundation March 2024 Partnerships Update, Ray tracing made possible on 42-year-old ZX Spectrum: 'reasonably fast, if you consider 17 hours per frame to be reasonably fast', and more","date_published":"2024-05-02T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7b7b0ae-86ba-4f1e-849b-e46741b63ebd.mp3","mime_type":"audio/mpeg","size_in_bytes":44994816,"duration_in_seconds":2812}]},{"id":"92703554-9e85-425e-ac8a-a5d5aa0cc9c4","title":"556: Cozy OpenBSD","url":"https://www.bsdnow.tv/556","content_text":"OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un*xy option for 32-bit PowerPC, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD is a Cozy Operating System\n\n\n\nLichee Console 4A - RISC-V mini laptop\n\n\n\nNews Roundup\n\nLessons learned with XZ vulnerability\n\n\n\nTechies vs spies: the xz backdoor debate\n\n\n\nNot Not Porting 9front to Power64\n\n\n\nOne less Un*xy option for 32-bit PowerPC\n\n\n\nBeastie Bits\n\n\n20 years since...\nJails PDFs\nNixOS BSD\nrigg - run indie games on OpenBSD\npkgsrc 2024Q1\nPackMule\nAcephalOS - A new FreeBSD image build tool\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un*xy option for 32-bit PowerPC, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://btxx.org/posts/OpenBSD_is_a_Cozy_Operating_System/\" rel=\"nofollow\">OpenBSD is a Cozy Operating System</a></p>\n\n<hr>\n\n<p><a href=\"https://3.14.by/en/read/RISC-V-Sipeed-Lichee-Console-4A-Alibaba-T-Head-TH1520-review\" rel=\"nofollow\">Lichee Console 4A - RISC-V mini laptop</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-03-30-lessons-learned-xz-vuln.html\" rel=\"nofollow\">Lessons learned with XZ vulnerability</a></p>\n\n<hr>\n\n<p><a href=\"https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor\" rel=\"nofollow\">Techies vs spies: the xz backdoor debate</a></p>\n\n<hr>\n\n<p><a href=\"https://posixcafe.org/blogs/2024/04/03/0/\" rel=\"nofollow\">Not Not Porting 9front to Power64</a></p>\n\n<hr>\n\n<p><a href=\"http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html\" rel=\"nofollow\">One less Un*xy option for 32-bit PowerPC</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20240409044953\" rel=\"nofollow\">20 years since...</a></li>\n<li><a href=\"https://cdn.gyptazy.ch/files/docs/freebsd/jails/\" rel=\"nofollow\">Jails PDFs</a></li>\n<li><a href=\"https://github.com/nixos-bsd/nixbsd\" rel=\"nofollow\">NixOS BSD</a></li>\n<li><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/1bb9wle/rigg_10_released_a_new_way_to_run_indie_games_on/\" rel=\"nofollow\">rigg - run indie games on OpenBSD</a></li>\n<li><a href=\"https://mail-index.netbsd.org/netbsd-announce/2024/04/04/msg000370.html\" rel=\"nofollow\">pkgsrc 2024Q1</a></li>\n<li><a href=\"https://badland.io/packmule.md\" rel=\"nofollow\">PackMule</a></li>\n<li><a href=\"https://codeberg.org/San_Bernadino_Operation/AcephalOS_image_build_system\" rel=\"nofollow\">AcephalOS - A new FreeBSD image build tool</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"OpenBSD is a Cozy Operating System, Lichee Console 4A - RISC-V mini laptop, Lessons learned with XZ vulnerability, Techies vs spies: the xz backdoor debate, Not Not Porting 9front to Power64, One less Un\\*xy option for 32-bit PowerPC, and more","date_published":"2024-04-25T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/92703554-9e85-425e-ac8a-a5d5aa0cc9c4.mp3","mime_type":"audio/mpeg","size_in_bytes":51666816,"duration_in_seconds":3229}]},{"id":"629f2e08-41a4-4551-b8e4-446706cd16a6","title":"555: Poudriereing Apple Silicon","url":"https://www.bsdnow.tv/555","content_text":"Kubernetes and back - Why I don't run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un*xy option for 32-bit PowerPC, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nKubernetes and back - Why I don't run distributed systems\n\n\n\nNetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts\n\n\n\nNews Roundup\n\nMake your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud\n\n\n\nPoudriere on Apple Silicon\n\n\n\nOne less Un*xy option for 32-bit PowerPC\n\n\n\nBeastie Bits\n\n\nPowering up the future: the new FreeBSD cluster in Chicago\nDragonflybsd 6.5 Snapshot Release on Acer Nitro AN515-51/58-XXX Series Laptops\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Kubernetes and back - Why I don&#39;t run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un*xy option for 32-bit PowerPC, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.davd.io/posts/2024-03-20-kubernetes-and-back-why-i-dont-run-distributed-systems/\" rel=\"nofollow\">Kubernetes and back - Why I don&#39;t run distributed systems</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/netapps-strategic-contributions-to-freebsd-a-deep-dive-into-upstreaming-efforts/\" rel=\"nofollow\">NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/03/21/make-your-own-email-server-freebsd-adding-nextcloud-part2/\" rel=\"nofollow\">Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud</a></p>\n\n<hr>\n\n<p><a href=\"https://oliver-epper.de/posts/poudriere-on-m1-mac/\" rel=\"nofollow\">Poudriere on Apple Silicon</a></p>\n\n<hr>\n\n<p><a href=\"http://tenfourfox.blogspot.com/2024/02/one-less-unxy-option-for-32-bit-powerpc.html\" rel=\"nofollow\">One less Un*xy option for 32-bit PowerPC</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://freebsdfoundation.org/blog/powering-up-the-future-the-new-freebsd-cluster-in-chicago/\" rel=\"nofollow\">Powering up the future: the new FreeBSD cluster in Chicago</a></li>\n<li><a href=\"https://github.com/catfacedck/Dragonflybsd-Acer-Nitro-Laptops-AN515-5158-XXX\" rel=\"nofollow\">Dragonflybsd 6.5 Snapshot Release on Acer Nitro AN515-51/58-XXX Series Laptops</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Kubernetes and back - Why I don't run distributed systems, NetApp’s strategic contributions to FreeBSD: a deep dive into upstreaming efforts, Make your own E-Mail server - Part 2 - Adding Webmail and More with Nextcloud, Poudriere on Apple Silicon, One less Un\\*xy option for 32-bit PowerPC, and more","date_published":"2024-04-18T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/629f2e08-41a4-4551-b8e4-446706cd16a6.mp3","mime_type":"audio/mpeg","size_in_bytes":55516800,"duration_in_seconds":3469}]},{"id":"8c49ca38-53e5-49cb-93f4-dcf4eae69f08","title":"554: NetBSD Double Digit","url":"https://www.bsdnow.tv/554","content_text":"The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nPeople have no doubt heard of this by now, but are not aware of the BSD side of\nthings since its mostly been Linux getting all the news. It'd be nice if we\ncould give a summary of the issue and then address how it does/doesn't affect\nthe BSDs.\nThe XZ Backdoor\n\n\n\nNetBSD's statement\nFreeBSD's statement\nOpenBSD?\n\n\n\n\nNetBSD 10.0\n\n\n\nNews Roundup\n\niX announces that they will put out a release of TrueNAS 13.3\n\n\nA community fork has been announced\n\n\n\n\nState of the Terminal\n\n\n\nLibreSSL 3.8.4 and 3.9.1 released\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nDerek via feedback has asked for some discussion around this NetBSD security advisory\n-- Advisory Link\nBen - Nextcloud Installation\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p>People have no doubt heard of this by now, but are not aware of the BSD side of<br>\nthings since its mostly been Linux getting all the news. It&#39;d be nice if we<br>\ncould give a summary of the issue and then address how it does/doesn&#39;t affect<br>\nthe BSDs.<br>\n<a href=\"https://boehs.org/node/everything-i-know-about-the-xz-backdoor\" rel=\"nofollow\">The XZ Backdoor<br>\n</a></p>\n\n<ul>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz\" rel=\"nofollow\">NetBSD&#39;s statement</a></li>\n<li><a href=\"https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html\" rel=\"nofollow\">FreeBSD&#39;s statement</a></li>\n<li>OpenBSD?</li>\n</ul>\n\n<hr>\n\n<p><a href=\"https://netbsd.org/releases/formal-10/NetBSD-10.0.html\" rel=\"nofollow\">NetBSD 10.0</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://www.truenas.com/blog/truenas-core-13-3-plans/\" rel=\"nofollow\">iX announces that they will put out a release of TrueNAS 13.3</a></p>\n\n<ul>\n<li><a href=\"https://www.zvault.io\" rel=\"nofollow\">A community fork has been announced</a></li>\n</ul>\n\n<hr>\n\n<p><a href=\"https://gpanders.com/blog/state-of-the-terminal/\" rel=\"nofollow\">State of the Terminal</a></p>\n\n<hr>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20240328181819\" rel=\"nofollow\">LibreSSL 3.8.4 and 3.9.1 released</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Derek%20-%20NetBSD%20Security%20Advisory.md\" rel=\"nofollow\">Derek via feedback has asked for some discussion around this NetBSD security advisory</a><br>\n-- <a href=\"https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-001.txt.asc\" rel=\"nofollow\">Advisory Link</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/554/feedback/Ben%20-%20nexcloud%20installation.md\" rel=\"nofollow\">Ben - Nextcloud Installation</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"The XZ Backdoor, NetBSD 10.0, iX announces that they will put out a release of TrueNAS 13.3, State of the Terminal, LibreSSL 3.8.4 and 3.9.1 released and more","date_published":"2024-04-11T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8c49ca38-53e5-49cb-93f4-dcf4eae69f08.mp3","mime_type":"audio/mpeg","size_in_bytes":60370176,"duration_in_seconds":3773}]},{"id":"fb2a50e1-0c95-4f05-844b-9c69c5aa90bf","title":"553: Terminal Latency","url":"https://www.bsdnow.tv/553","content_text":"Using Git offline, Make your own E-mail server, quiz: a tool for rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev, and more...\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nUsing Git offline\n\n\n\nMake your own E-Mail server - FreeBSD, OpenSMTPD, Rspamd and Dovecot included - Part 1\n\n\n\nNews Roundup\n\nquiz: a tool for rapid OpenZFS development\n\n\n\nConfiguring openzfs for nvme databases\n\n\n\nMirroring OmniOS: The Complete Guide; Part One\n\n\n\nInstalling OpenBSD 7.4 on a VisionFive 2 rev 1.2a\n\n\n\nTerminal Latency\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Using Git offline, Make your own E-mail server, quiz: a tool for rapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring OmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev, and more...</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.gibbard.me/using_git_offline/\" rel=\"nofollow\">Using Git offline</a></p>\n\n<hr>\n\n<p><a href=\"https://it-notes.dragas.net/2024/03/08/make-your-own-email-server-freebsd-opensmptd-rspamd-dovecot-part1/\" rel=\"nofollow\">Make your own E-Mail server - FreeBSD, OpenSMTPD, Rspamd and Dovecot included - Part 1</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://despairlabs.com/blog/posts/2024-03-04-quiz-rapid-openzfs-development/\" rel=\"nofollow\">quiz: a tool for rapid OpenZFS development</a></p>\n\n<hr>\n\n<p><a href=\"https://github.com/letsencrypt/openzfs-nvme-databases\" rel=\"nofollow\">Configuring openzfs for nvme databases</a></p>\n\n<hr>\n\n<p><a href=\"https://antranigv.am/posts/2024/02/omnios-mirror-one/\" rel=\"nofollow\">Mirroring OmniOS: The Complete Guide; Part One</a></p>\n\n<hr>\n\n<p><a href=\"https://quozul.dev/riscv/2023/12/22/installing-openbsd-on-visionfive-2.html\" rel=\"nofollow\">Installing OpenBSD 7.4 on a VisionFive 2 rev 1.2a</a></p>\n\n<hr>\n\n<p><a href=\"https://beuke.org/terminal-latency/\" rel=\"nofollow\">Terminal Latency</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Using Git offline, Make your own E-mail server, quiz: a tool for\r\nrapid OpenZFS development, Configuring openzfs for nvme databases, Mirroring\r\nOmniOS: The Complete Guide part 1, Installing OpenBSD 7.4 on a VisionFive 2 rev","date_published":"2024-04-04T09:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fb2a50e1-0c95-4f05-844b-9c69c5aa90bf.mp3","mime_type":"audio/mpeg","size_in_bytes":51366912,"duration_in_seconds":3210}]},{"id":"f27f7361-6588-4bf1-9e95-a65379200ab4","title":"552: The Laptop Sparc","url":"https://www.bsdnow.tv/552","content_text":"Setup diskless booting of Raspberry Pi, TrueNAS abandons FreeBSD, SPARCbook 3000ST: The coolest 90s laptop, Sparkbook Teardown, SSH over HTTPS, Keycloak Identity and Access Management on FreeBSD, Ford Aerospace and BSD Unix, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nHOWTO: Setup diskless booting of Raspberry Pi (running RPi OS) via TFTP &amp; NFSv4 from a FreeBSD ZFS server\n\n\n\nTrueNAS abandons FreeBSD\n\n\nNo one needs to panic, we're aware of plans that have already been in the works.  But more on that later.\n\n\n\n\nNews Roundup\n\nSPARCbook 3000ST: The coolest 90s laptop\nSparkbook Teardown\nAuthor Comment\n\n\n\nSSH over HTTPS\n\n\n\nKeycloak Identity and Access Management on FreeBSD\n\n\n\nFord Aerospace and BSD Unix.\n\n\n\nBeastie Bits\n\n\nOpenBGPD 8.4 released\nSolene games  Context: https://bsd.network/@solene/112115442072927484\nHow I backup\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Setup diskless booting of Raspberry Pi, TrueNAS abandons FreeBSD, SPARCbook 3000ST: The coolest 90s laptop, Sparkbook Teardown, SSH over HTTPS, Keycloak Identity and Access Management on FreeBSD, Ford Aerospace and BSD Unix, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://forums.freebsd.org/threads/howto-setup-diskless-booting-of-raspberry-pi-running-rpi-os-via-tftp-nfsv4-from-a-freebsd-zfs-server.92717/\" rel=\"nofollow\">HOWTO: Setup diskless booting of Raspberry Pi (running RPi OS) via TFTP &amp; NFSv4 from a FreeBSD ZFS server</a></p>\n\n<hr>\n\n<p><a href=\"https://www.theregister.com/2024/03/18/truenas_abandons_freebsd/\" rel=\"nofollow\">TrueNAS abandons FreeBSD</a></p>\n\n<ul>\n<li>No one needs to panic, we&#39;re aware of plans that have already been in the works.  But more on that later.</li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://jasoneckert.github.io/myblog/sparcbook3000st-the-coolest-90s-laptop/\" rel=\"nofollow\">SPARCbook 3000ST: The coolest 90s laptop</a><br>\n<a href=\"https://jasoneckert.github.io/myblog/sparcbook-teardown/\" rel=\"nofollow\">Sparkbook Teardown</a><br>\n<a href=\"https://news.ycombinator.com/item?id=39037510\" rel=\"nofollow\">Author Comment</a></p>\n\n<hr>\n\n<p><a href=\"https://trofi.github.io/posts/295-ssh-over-https.html\" rel=\"nofollow\">SSH over HTTPS</a></p>\n\n<hr>\n\n<p><a href=\"https://vermaden.wordpress.com/2024/03/10/keycloak-on-freebsd/\" rel=\"nofollow\">Keycloak Identity and Access Management on FreeBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://news.ycombinator.com/item?id=39636035\" rel=\"nofollow\">Ford Aerospace and BSD Unix.</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20240308064655\" rel=\"nofollow\">OpenBGPD 8.4 released</a></li>\n<li><a href=\"https://rsolene.itch.io/\" rel=\"nofollow\">Solene games</a>  Context: <a href=\"https://bsd.network/@solene/112115442072927484\" rel=\"nofollow\">https://bsd.network/@solene/112115442072927484</a></li>\n<li><a href=\"https://sive.rs/backup\" rel=\"nofollow\">How I backup</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Setup diskless booting of Raspberry Pi, TrueNAS abandons FreeBSD, SPARCbook 3000ST: The coolest 90s laptop, Sparkbook Teardown, SSH over HTTPS, Keycloak Identity and Access Management on FreeBSD, Ford Aerospace and BSD Unix, and more","date_published":"2024-03-28T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f27f7361-6588-4bf1-9e95-a65379200ab4.mp3","mime_type":"audio/mpeg","size_in_bytes":57181056,"duration_in_seconds":3573}]},{"id":"26a0d9ff-b867-40d3-8479-5cd7d63cbeb9","title":"551: SSH Port Story","url":"https://www.bsdnow.tv/551","content_text":"This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe story of getting SSH port 22\n\n\n\nCan GCC use Clang as its assembler?\n\n\n\nNews Roundup\n\nAUXrunner: a macOS QEMU-based app for running A/UX\n\n\n\nStabweek\n\n\n\nUsing the Kensington SlimBlade Pro TrackBall with OpenBSD\n\n\n\nRunning 9front on an emulated SGI Indy via MAME\n\n\n\nBeastie Bits\n\nHuffman Codes – How Do They Work?\nNetBSD 10.0_RC5\nNew code for SIGILL faults help identify misbranches\nNew Illumos telegram channel\nThe Jan Feb issues of the FreeBSD Journal is here\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.ssh.com/academy/ssh/port#the-story-of-getting-ssh-port-22\" rel=\"nofollow\">The story of getting SSH port 22</a></p>\n\n<hr>\n\n<p><a href=\"https://briancallahan.net/blog/20240122.html\" rel=\"nofollow\">Can GCC use Clang as its assembler?</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://mendelson.org/auxrunner.html\" rel=\"nofollow\">AUXrunner: a macOS QEMU-based app for running A/UX</a></p>\n\n<hr>\n\n<p><a href=\"https://lists.freebsd.org/archives/freebsd-current/2024-February/005657.html\" rel=\"nofollow\">Stabweek</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tumfatig.net/2024/using-the-kensington-slimblade-pro-trackball-with-openbsd/\" rel=\"nofollow\">Using the Kensington SlimBlade Pro TrackBall with OpenBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://posixcafe.org/blogs/2024/01/01/0/\" rel=\"nofollow\">Running 9front on an emulated SGI Indy via MAME</a></p>\n\n<hr>\n\n<h3>Beastie Bits</h3>\n\n<p><a href=\"https://two-wrongs.com/huffman-codes-how-do-they-work\" rel=\"nofollow\">Huffman Codes – How Do They Work?</a><br>\n<a href=\"https://mail-index.netbsd.org/source-changes/2024/02/27/msg150156.html\" rel=\"nofollow\">NetBSD 10.0_RC5</a><br>\n<a href=\"https://www.undeadly.org/cgi?action=article;sid=20240222183703\" rel=\"nofollow\">New code for SIGILL faults help identify misbranches</a><br>\n<a href=\"https://t.me/illumosDistroes\" rel=\"nofollow\">New Illumos telegram channel</a><br>\n<a href=\"https://freebsdfoundation.org/blog/the-january-february-2024-issue-of-the-freebsd-journal-is-here/\" rel=\"nofollow\">The Jan Feb issues of the FreeBSD Journal is here</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"This week on the show, The story of SSH getting port 22, GGC using Clang, AuxRunner, Stabweek, Using a Kensington SlimBladePro on OpenBSD, and more...","date_published":"2024-03-21T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/26a0d9ff-b867-40d3-8479-5cd7d63cbeb9.mp3","mime_type":"audio/mpeg","size_in_bytes":50259072,"duration_in_seconds":3141}]},{"id":"16bc5c0c-304f-4b45-bd6e-979f5ce042bc","title":"550: Netware and Netmap","url":"https://www.bsdnow.tv/550","content_text":"This week on the show, you're not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhen the Power Macintosh ran NetWare (featuring Wormhole and Cyberpunk)\n\n\n\nYou are not too late\n\n\n\nNews Roundup\n\nnetmap on cxgbe interfaces\n\n\n\nOpenZFS 2.2.3\n\n\n\nA recent abrupt change in Internet SSH brute force attacks against us\n\n\n\nSome OpenBSD features that aren't widely known\n\n\n\nRelease Notes for OmniOS v11 r151048\n\n\n\nThe Making of RP2040 Doom\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nBrendan - Log Files\nMischa - EuroBSDcon\nSebastiano - Sed\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>This week on the show, you&#39;re not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://oldvcr.blogspot.com/2023/12/when-power-macintosh-ran-netware.html\" rel=\"nofollow\">When the Power Macintosh ran NetWare (featuring Wormhole and Cyberpunk)</a></p>\n\n<hr>\n\n<p><a href=\"https://kk.org/thetechnium/you-are-not-late/\" rel=\"nofollow\">You are not too late</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://adventurist.me/posts/00318\" rel=\"nofollow\">netmap on cxgbe interfaces</a></p>\n\n<hr>\n\n<p><a href=\"https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3\" rel=\"nofollow\">OpenZFS 2.2.3</a></p>\n\n<hr>\n\n<p><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/SSHBruteForceAttacksAbruptlyDown\" rel=\"nofollow\">A recent abrupt change in Internet SSH brute force attacks against us</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-02-20-rarely-known-openbsd-features.html\" rel=\"nofollow\">Some OpenBSD features that aren&#39;t widely known</a></p>\n\n<hr>\n\n<p><a href=\"https://github.com/omniosorg/omnios-build/blob/44731424e67c8aaafe5c4e500fe7c4544a22f0f6/doc/ReleaseNotes.md#r151048o-2024-02-15\" rel=\"nofollow\">Release Notes for OmniOS v11 r151048</a></p>\n\n<hr>\n\n<p><a href=\"https://kilograham.github.io/rp2040-doom/\" rel=\"nofollow\">The Making of RP2040 Doom</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Brendan%20-%20Log%20Files.md\" rel=\"nofollow\">Brendan - Log Files</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Mischa%20-%20EuroBSDcon.md\" rel=\"nofollow\">Mischa - EuroBSDcon</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/550/feedback/Sebastiano%20-%20Sed.md\" rel=\"nofollow\">Sebastiano - Sed</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"This week on the show, you're not too late to develop the future, netmap on czgbe, OpenZFS 2.2.3, SSH Brute Forcing, some unknown OpenBSD Features, Release notes for the latest Omni OS, and more...","date_published":"2024-03-12T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/16bc5c0c-304f-4b45-bd6e-979f5ce042bc.mp3","mime_type":"audio/mpeg","size_in_bytes":51137664,"duration_in_seconds":3196}]},{"id":"09b0aba7-84c8-48f6-8901-4bd391e42348","title":"549: htop Tetris","url":"https://www.bsdnow.tv/549","content_text":"FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD \n Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Foundation Statement on the European Union Cyber Resiliency Act\n\n\n\nDragonFly BSD on a Thinkpad T480s\n\n\n\nNews Roundup\n\nAmpere in the Wild: How FreeBSD Employs Ampere Arm64 Servers in the Data Center\n\n\n\nFreeBSD Yubikey authentication\n\n\n\nThat time I almost added Tetris to htop\n\n\n\nBeastie Bits\n\nMail Software Projects for You\nAt long last: the MWL Title Index\nFreeBSD on a RPi\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD <br>\n Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-statement-on-the-european-union-cyber-resiliency-act/?utm_source=bsdweekly\" rel=\"nofollow\">FreeBSD Foundation Statement on the European Union Cyber Resiliency Act</a></p>\n\n<hr>\n\n<p><a href=\"https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md\" rel=\"nofollow\">DragonFly BSD on a Thinkpad T480s</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://amperecomputing.com/blogs/ampere-in-the-wild\" rel=\"nofollow\">Ampere in the Wild: How FreeBSD Employs Ampere Arm64 Servers in the Data Center</a></p>\n\n<hr>\n\n<p><a href=\"https://gist.github.com/daemonhorn/bdd77a7bc0ff5842e5a31d999b96e1f1\" rel=\"nofollow\">FreeBSD Yubikey authentication</a></p>\n\n<hr>\n\n<p><a href=\"https://hisham.hm/2024/02/12/that-time-i-almost-added-tetris-to-htop/\" rel=\"nofollow\">That time I almost added Tetris to htop</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://mwl.io/archives/23419\" rel=\"nofollow\">Mail Software Projects for You</a><br>\n<a href=\"https://mwl.io/archives/23401\" rel=\"nofollow\">At long last: the MWL Title Index</a><br>\n<a href=\"https://linux.slashdot.org/story/24/01/07/0327229/how-does-freebsd-compare-to-linux-on-a-raspberry-pi\" rel=\"nofollow\">FreeBSD on a RPi</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"FreeBSD Foundation Statement on the European Union Cyber Resiliency Act, DragonFly BSD on a Thinkpad T480s, How FreeBSD \r\n Employs Ampere Arm64 Servers in the Data Center, FreeBSD Yubikey authentication, that time I almost added Tetris to htop, and more","date_published":"2024-03-07T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/09b0aba7-84c8-48f6-8901-4bd391e42348.mp3","mime_type":"audio/mpeg","size_in_bytes":54510336,"duration_in_seconds":3406}]},{"id":"9fc45182-53da-4b7a-8fa2-a408b12d8a5b","title":"548: NTP - In Memoriam","url":"https://www.bsdnow.tv/548","content_text":"FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Status Report Fourth Quarter 2023\n\n\n\nIn Memoriam : Inventor of NTP protocol that keeps time on billions of devices dies at age 85\n\n\n\nNews Roundup\n\nMigrate a FreeBSD bhyve virtual machine to OmniOS\n\n\n\nThis blog is AI free\n\n\n\nHard disk LEDs and Noisy Machines\n\n\n\nSSH based comment system\n\n\n\nNetBSD 10 RC.4 is available\n\n\n\nBeastie Bits\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://www.freebsd.org/status/report-2023-10-2023-12/\" rel=\"nofollow\">FreeBSD Status Report Fourth Quarter 2023</a></p>\n\n<hr>\n\n<p><a href=\"https://arstechnica.com/gadgets/2024/01/inventor-of-ntp-protocol-that-keeps-time-on-billions-of-devices-dies-at-age-85/\" rel=\"nofollow\">In Memoriam : Inventor of NTP protocol that keeps time on billions of devices dies at age 85</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://www.tumfatig.net/2024/migrate-a-freebsd-bhyve-virtual-machine-to-omnios/?utm_source=bsdweekly\" rel=\"nofollow\">Migrate a FreeBSD bhyve virtual machine to OmniOS</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-01-18-no-ai.html\" rel=\"nofollow\">This blog is AI free</a></p>\n\n<hr>\n\n<p><a href=\"https://jmmv.dev/2023/12/hard-disk-leds-and-noisy-machines.html\" rel=\"nofollow\">Hard disk LEDs and Noisy Machines</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.haschek.at/2023/ssh-based-comment-system.html\" rel=\"nofollow\">SSH based comment system</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.netbsd.org/tnf/entry/netbsd_10_0_rc4_available\" rel=\"nofollow\">NetBSD 10 RC.4 is available</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"FreeBSD Status Report Q4 2023, In Memorium of the NTP inventor, Migrate a FreeBSD bhyve virtual machine to OmniOS, AI-free blog, Hard disk LEDs and Noisy Machines, SSH based comment system, NetBSD 10 RC.4 is available, and more","date_published":"2024-02-29T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9fc45182-53da-4b7a-8fa2-a408b12d8a5b.mp3","mime_type":"audio/mpeg","size_in_bytes":54708480,"duration_in_seconds":3419}]},{"id":"6800295d-3150-40ed-be3a-5c0aa3f787d3","title":"547: IT Impostor Syndrome","url":"https://www.bsdnow.tv/547","content_text":"Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don't prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOvercoming imposter syndrome in IT\n\n\n\nA Practical Guide to GNU sed With Examples\n\n\n\nNews Roundup\n\nEarly computer art by Barbara Nessim (1984)\n\n\n\nDon't prefill config files\n\n\n\nA Simpler Life: Trapping Spambots Based on Target Domain Only\n\n\n\nYou cannot cURL under pressure\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\nMarcus - Linux Compat Layer\n\nDaniel - FreeBSD Nostalgia\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don&#39;t prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-01-10-dealing-with-imposter-syndrome.html\" rel=\"nofollow\">Overcoming imposter syndrome in IT</a></p>\n\n<hr>\n\n<p><a href=\"https://thevaluable.dev/sed-cli-practical-guide-examples/\" rel=\"nofollow\">A Practical Guide to GNU sed With Examples</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://blog.gingerbeardman.com/2023/11/09/early-computer-art-by-barbara-nessim/\" rel=\"nofollow\">Early computer art by Barbara Nessim (1984)</a></p>\n\n<hr>\n\n<p><a href=\"https://www.makeworld.space/2024/02/no_prefill_config.html\" rel=\"nofollow\">Don&#39;t prefill config files</a></p>\n\n<hr>\n\n<p><a href=\"https://bsdly.blogspot.com/2024/01/a-simpler-life-trapping-spambots-based.html\" rel=\"nofollow\">A Simpler Life: Trapping Spambots Based on Target Domain Only</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.benjojo.co.uk/post/you-cant-curl-under-pressure\" rel=\"nofollow\">You cannot cURL under pressure</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Marcus%20-%20linux%20compat%20layer.md\" rel=\"nofollow\">Marcus - Linux Compat Layer</a></p>\n\n<h2><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/547/feedback/Daniel%20-%20FreeBSD%20Nostalgia.md\" rel=\"nofollow\">Daniel - FreeBSD Nostalgia</a></h2>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Overcoming imposter syndrome in IT, A Practical Guide to GNU sed With Examples, Early computer art by Barbara Nessim, Don't prefill config files, Trapping Spambots Based on Target Domain Only, You cannot cURL under pressure, and more","date_published":"2024-02-22T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6800295d-3150-40ed-be3a-5c0aa3f787d3.mp3","mime_type":"audio/mpeg","size_in_bytes":42274944,"duration_in_seconds":2642}]},{"id":"c7cb0c2d-cc60-4bf8-8323-088db1bd3e41","title":"546: Debunking FreeBSD Myths","url":"https://www.bsdnow.tv/546","content_text":"Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDebunking Common Myths About FreeBSD\n\n\n\nPlease, don’t force me to log in\n\n\n\nNews Roundup\n\nExploring FreeBSD service(8) basics\n\n\n\nFailed Product Designs: A Laptop with Seven Screens\nThe Expanscape Aurora 7\n\n\n\n“What’s a Permissive License – and Why Should I Care?”\n\n\n\nBeginning of the year Laugh\n\n\n\n\n\nBeastie Bits\n\nNetBSD 10: Thirty Years, Still Going Strong!\nDracula theme using bash shell\npinsyscalls(2) working in anger\nFirst bits of a Haiku compatibility layer for NetBSD\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/debunking-common-myths-about-freebsd/\" rel=\"nofollow\">Debunking Common Myths About FreeBSD</a></p>\n\n<hr>\n\n<p><a href=\"https://hamatti.org/posts/please-dont-force-me-to-log-in/\" rel=\"nofollow\">Please, don’t force me to log in</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://rubenerd.com/basics-of-freebsd-services/\" rel=\"nofollow\">Exploring FreeBSD service(8) basics</a></p>\n\n<hr>\n\n<p><a href=\"https://www.core77.com/posts/127288/Failed-Product-Designs-A-Laptop-with-Seven-Screens\" rel=\"nofollow\">Failed Product Designs: A Laptop with Seven Screens<br>\nThe Expanscape Aurora 7</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/whats-a-permissive-license-and-why-should-i-care/\" rel=\"nofollow\">“What’s a Permissive License – and Why Should I Care?”</a></p>\n\n<hr>\n\n<p><a href=\"https://saagarjha.com/blog/2020/05/10/why-we-at-famous-company-switched-to-hyped-technology/\" rel=\"nofollow\">Beginning of the year Laugh</a></p>\n\n<hr>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://bentsukun.ch/talks/fosdem2024/\" rel=\"nofollow\">NetBSD 10: Thirty Years, Still Going Strong!</a><br>\n<a href=\"https://forums.freebsd.org/threads/dracula-theme-using-bash-shell.92052/\" rel=\"nofollow\">Dracula theme using bash shell</a><br>\n<a href=\"https://www.undeadly.org/cgi?action=article;sid=20240118080752\" rel=\"nofollow\">pinsyscalls(2) working in anger</a><br>\n<a href=\"https://www.osnews.com/story/137961/first-bits-of-a-haiku-compatibility-layer-for-netbsd/\" rel=\"nofollow\">First bits of a Haiku compatibility layer for NetBSD</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Debunking Common Myths About FreeBSD, Please, don’t force me to log in, Exploring FreeBSD service(8) basics, Failed Product Designs: A Laptop with Seven Screens, What’s a Permissive License – and Why Should I Care?, Beginning of the year Laugh","date_published":"2024-02-15T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c7cb0c2d-cc60-4bf8-8323-088db1bd3e41.mp3","mime_type":"audio/mpeg","size_in_bytes":51679488,"duration_in_seconds":3229}]},{"id":"efbf773e-fa58-4991-87a2-c1dd17e44ddd","title":"545: BSD Audio Enhancements","url":"https://www.bsdnow.tv/545","content_text":"ZFS High Availability with Asynchronous Replication and zrep, Stop\nBlogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41\nlaptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches\ninto GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on\nthe Nintendo Wii, NetBSD/amd64 current performance patch\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nZFS High Availability with\nAsynchronous Replication and zrep\n\n\n\nStop Blogging and start documenting\n\n\n\nNews Roundup\n\n2023 in Review: Infrastructure\n\n\n\nNovaCustom NV41 laptop review\n\n\n\nOpenBSD Video Audio Screen Recording\n\n\n\nHDMI Audio sound patches into GhostBSD source code /usr/ghost14/ghostbsd-src SOLVED Jan20 2024\n\n\n\nBeastie Bits\n\nDSA removal from OpenSSH\n\nNetBSD/evbppc 10.99.10 on the Nintendo Wii\n\nNetBSD/amd64 current performance patch\n\nNovember/December 2023 FreeBSD Journal Issue\n\nFeedback\n\n\nRick - Questions\n\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>ZFS High Availability with Asynchronous Replication and zrep, Stop<br>\nBlogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41<br>\nlaptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches<br>\ninto GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on<br>\nthe Nintendo Wii, NetBSD/amd64 current performance patch</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/zfs-high-availability-with-asynchronous-replication-and-zrep/\" rel=\"nofollow\">ZFS High Availability with<br>\nAsynchronous Replication and zrep</a></p>\n\n<hr>\n\n<p><a href=\"https://callfortesting.org/stopblogging/\" rel=\"nofollow\">Stop Blogging and start documenting</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://freebsdfoundation.org/blog/2023-in-review-infrastructure/\" rel=\"nofollow\">2023 in Review: Infrastructure</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-01-03-laptop-review-novacustom-nv41.html\" rel=\"nofollow\">NovaCustom NV41 laptop review</a></p>\n\n<hr>\n\n<p><a href=\"https://rsadowski.de/posts/2024-01-14-openbsd-video-audio-screen-recording/\" rel=\"nofollow\">OpenBSD Video Audio Screen Recording</a></p>\n\n<hr>\n\n<p><a href=\"https://ghostbsd-arm64.blogspot.com/2024/01/hdmi-audio-sound-patches-into-ghostbsd.html\" rel=\"nofollow\">HDMI Audio sound patches into GhostBSD source code /usr/ghost14/ghostbsd-src SOLVED Jan20 2024</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20240111105900\" rel=\"nofollow\">DSA removal from OpenSSH</a></p>\n\n<p><a href=\"https://youtu.be/n-MShCcFm_w?si=-bl2725c1WwT8PBg\" rel=\"nofollow\">NetBSD/evbppc 10.99.10 on the Nintendo Wii</a></p>\n\n<p><a href=\"https://mail-index.netbsd.org/tech-kern/2024/01/23/msg029450.html\" rel=\"nofollow\">NetBSD/amd64 current performance patch</a></p>\n\n<p><a href=\"https://freebsdfoundation.org/past-issues/freebsd-14-0/\" rel=\"nofollow\">November/December 2023 FreeBSD Journal Issue</a></p>\n\n<h2>Feedback</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/545/feedback/rick%20-%20questions.md\" rel=\"nofollow\">Rick - Questions</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"ZFS High Availability with Asynchronous Replication and zrep, Stop\r\nBlogging and start documenting, 2023 in Review: Infrastructure, NovaCustom NV41\r\nlaptop review, OpenBSD Video Audio Screen Recording, HDMI Audio sound patches\r\ninto GhostBSD source code, DSA removal from OpenSSH, NetBSD/evbppc 10.99.10 on\r\nthe Nintendo Wii, NetBSD/amd64 current performance patch","date_published":"2024-02-08T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/efbf773e-fa58-4991-87a2-c1dd17e44ddd.mp3","mime_type":"audio/mpeg","size_in_bytes":60848256,"duration_in_seconds":3803}]},{"id":"2f3344c6-0c9e-459a-9035-970e84c6d131","title":"544: Geeky weather check","url":"https://www.bsdnow.tv/544","content_text":"GPL 3: The Controversial Licensing Model and Potential Solutions,\nThe Geeks way of checking what the outside weather is like, Alpine on a\nFreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage\ndevices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and\nZFS\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nGPL 3: The Controversial Licensing Model and Potential Solutions\n\n\n\nThe Geeks way of checking what the outside wheather is like\n\n\n\nNews Roundup\n\nAlpine on a FreeBSD Jail\n\n\n\nDragonFly BSD on a Thinkpad T480s\n\n\n\nDealing with USB Storage devices on OmniOS\n\n\n\nCreating a Time Capsule instance using Samba, FreeBSD, and ZFS\n\n\n\nConferences\n\nFOSDEM\n\nAsiaBSDCon\n\nBSDCan\n\nEuroBSDcon\n\nSoutheast Linuxfest\n\n\nDont let the name fool you, SELF is BSD friendly and they'd love to have BSD/Unix Talks if you're in the area. JT is staff at SELF, so he can put in a good word for you. ;)\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>GPL 3: The Controversial Licensing Model and Potential Solutions,<br>\nThe Geeks way of checking what the outside weather is like, Alpine on a<br>\nFreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage<br>\ndevices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and<br>\nZFS</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/gpl-3-the-controversial-licensing-model-and-potential-solutions/\" rel=\"nofollow\">GPL 3: The Controversial Licensing Model and Potential Solutions</a></p>\n\n<hr>\n\n<p><a href=\"https://blog.netbsd.org/tnf/entry/the_geeks_way_of_checking\" rel=\"nofollow\">The Geeks way of checking what the outside wheather is like</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://it-notes.dragas.net/2024/01/18/installing-alpine-linux-on-a-freebsd-jail/\" rel=\"nofollow\">Alpine on a FreeBSD Jail</a></p>\n\n<hr>\n\n<p><a href=\"https://git.sr.ht/%7Etomh/dragonflybsd-on-a-laptop/tree/master/item/README.md\" rel=\"nofollow\">DragonFly BSD on a Thinkpad T480s</a></p>\n\n<hr>\n\n<p><a href=\"https://www.tumfatig.net/2024/dealing-with-usb-storage-devices-on-omnios/\" rel=\"nofollow\">Dealing with USB Storage devices on OmniOS</a></p>\n\n<hr>\n\n<p><a href=\"https://dan.langille.org/2024/01/06/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs-2/\" rel=\"nofollow\">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></p>\n\n<hr>\n\n<h2>Conferences</h2>\n\n<p><a href=\"https://fosdem.org/2024/\" rel=\"nofollow\">FOSDEM</a></p>\n\n<p><a href=\"https://2024.asiabsdcon.org/program.html\" rel=\"nofollow\">AsiaBSDCon</a></p>\n\n<p><a href=\"https://www.bsdcan.org/2024/papers.php\" rel=\"nofollow\">BSDCan</a></p>\n\n<p><a href=\"https://2024.eurobsdcon.org/\" rel=\"nofollow\">EuroBSDcon</a></p>\n\n<p><a href=\"https://southeastlinuxfest.org/2024/01/self-2024-call-for-participation/\" rel=\"nofollow\">Southeast Linuxfest</a></p>\n\n<ul>\n<li>Dont let the name fool you, SELF is BSD friendly and they&#39;d love to have BSD/Unix Talks if you&#39;re in the area. JT is staff at SELF, so he can put in a good word for you. ;)</li>\n</ul>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"GPL 3: The Controversial Licensing Model and Potential Solutions,\r\nThe Geeks way of checking what the outside weather is like, Alpine on a\r\nFreeBSD Jail, DragonFly BSD on a Thinkpad T480s, Dealing with USB Storage\r\ndevices on OmniOS, Creating a Time Capsule instance using Samba, FreeBSD, and\r\nZFS","date_published":"2024-02-01T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2f3344c6-0c9e-459a-9035-970e84c6d131.mp3","mime_type":"audio/mpeg","size_in_bytes":64449792,"duration_in_seconds":4028}]},{"id":"caf89436-cf84-432e-a1cd-a88fc3385198","title":"543: OpenBSD Workstation Hardening","url":"https://www.bsdnow.tv/543","content_text":"OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs\n\n\n\n2023 in Review: Continuous Integration and Workflow Improvement\n\n\n\nNews Roundup\n\nRunning OpenBSD on OmniOS using bhyve\n\n\n\nFreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?\n\n\n\nOpenBSD workstation hardening\n\n\n\nKDE Plasma now linked to packages build on -current\n\n\n\nMidnightBSD 3.1.3 release\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\nFeedback/Questions\n\n\nKieran - Feedback\nAlbin - links inquires questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-3-databases-and-vms/\" rel=\"nofollow\">OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs</a></p>\n\n<hr>\n\n<p><a href=\"https://freebsdfoundation.org/blog/continuous-integration-and-workflow-improvement/\" rel=\"nofollow\">2023 in Review: Continuous Integration and Workflow Improvement</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://www.tumfatig.net/2024/running-openbsd-on-omnios-using-bhyve/\" rel=\"nofollow\">Running OpenBSD on OmniOS using bhyve</a></p>\n\n<hr>\n\n<p><a href=\"https://dan.langille.org/2023/12/25/freebsd-jailed-zfs-datasets-how-do-i-find-the-zfs-snapshot-directory/\" rel=\"nofollow\">FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?</a></p>\n\n<hr>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2023-12-31-hardened-openbsd-workstation.html\" rel=\"nofollow\">OpenBSD workstation hardening</a></p>\n\n<hr>\n\n<p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20231227120851&utm_source=bsdweekly\" rel=\"nofollow\">KDE Plasma now linked to packages build on -current</a></p>\n\n<hr>\n\n<p><a href=\"https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-3-release\" rel=\"nofollow\">MidnightBSD 3.1.3 release</a></p>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Kieran%20-%20Feedback.md\" rel=\"nofollow\">Kieran - Feedback</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/543/feedback/Albin%20-%20links%20inquires%20questions.md\" rel=\"nofollow\">Albin - links inquires questions</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"OpenZFS Storage Best Practices and Use Cases Part 3: Databases and VMs, 2023 in Review: Continuous Integration and Workflow Improvement, Running OpenBSD on OmniOS using bhyve, FreeBSD jailed ZFS datasets – how do I find the .zfs/snapshot directory?, OpenBSD workstation hardening, KDE Plasma now linked to packages build on -current, MidnightBSD 3.1.3 release","date_published":"2024-01-25T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/caf89436-cf84-432e-a1cd-a88fc3385198.mp3","mime_type":"audio/mpeg","size_in_bytes":56984832,"duration_in_seconds":3561}]},{"id":"3bd8cfd6-d858-4eb9-951b-64cfe52da80f","title":"542: Retro and Futuro","url":"https://www.bsdnow.tv/542","content_text":"8 Open Source Trends to Keep an Eye Out for in 2024, System Design\nfor Advanced Beginners, 2024 plans and 2023 retrospective, Upgrading from NetBSD 5.1 to 10*RC1, FreeBSD has a new C compiler: Oracle Developer Studio 12.6, Ctrl+Alt Museum\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n8 Open Source Trends to Keep an Eye Out for in 2024\n\n\n\nSystem Design for Advanced Beginners\n\n\n\nNews Roundup\n\n2024 plans and 2023 retrospective\n\n\n\nUpgrading from NetBSD 5.1 to 10_RC1\n\n\n\nFreeBSD has a new C compiler: Oracle Developer Studio 12.6\n\n\n\nCtrl+Alt Museum\n\n\n\nBeastie Bits\n\n\nTaylor's Hackerstation\nAn Empirical Study of the Reliability of UNIX Utilities\nBSD on Windows: Things I wish I knew existed\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>8 Open Source Trends to Keep an Eye Out for in 2024, System Design<br>\nfor Advanced Beginners, 2024 plans and 2023 retrospective, Upgrading from NetBSD 5.1 to 10*RC1, FreeBSD has a new C compiler: Oracle Developer Studio 12.6, Ctrl+Alt Museum</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<p><a href=\"https://klarasystems.com/articles/8-open-source-trends-to-keep-an-eye-out-for-in-2024/\" rel=\"nofollow\">8 Open Source Trends to Keep an Eye Out for in 2024</a></p>\n\n<hr>\n\n<p><a href=\"https://robertheaton.com/2020/04/06/systems-design-for-advanced-beginners/\" rel=\"nofollow\">System Design for Advanced Beginners</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2024-01-09-plans-for-2024.html\" rel=\"nofollow\">2024 plans and 2023 retrospective</a></p>\n\n<hr>\n\n<p><a href=\"https://www.idatum.net/upgrading-from-netbsd-51-to-10_rc1.html\" rel=\"nofollow\">Upgrading from NetBSD 5.1 to 10_RC1</a></p>\n\n<hr>\n\n<p><a href=\"https://briancallahan.net/blog/20240101.html\" rel=\"nofollow\">FreeBSD has a new C compiler: Oracle Developer Studio 12.6</a></p>\n\n<hr>\n\n<p><a href=\"https://photos.google.com/share/AF1QipMTsm7-LbZ-EiFh4xctppvVbBg_IhOPLTu4ej3fc7gWNgg6nHAUlBEK67-AD_tTsA?pli=1&key=N3dLRWlWVUpUY0RfNU1nb2VxYWUzRDdNek5DU2hn\" rel=\"nofollow\">Ctrl+Alt Museum</a></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://hackerstations.com/setups/taylor_town/\" rel=\"nofollow\">Taylor&#39;s Hackerstation</a></li>\n<li><a href=\"https://sigwait.org/%7Ealex/blog/2022/09/11/fuzz.pdf\" rel=\"nofollow\">An Empirical Study of the Reliability of UNIX Utilities</a></li>\n<li><a href=\"https://virtuallyfun.com/2023/12/08/bsd-on-windows-things-i-wish-i-knew-existed/\" rel=\"nofollow\">BSD on Windows: Things I wish I knew existed</a></li>\n</ul>\n\n<hr>\n\n<h2>Tarsnap</h2>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"8 Open Source Trends to Keep an Eye Out for in 2024","date_published":"2024-01-18T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3bd8cfd6-d858-4eb9-951b-64cfe52da80f.mp3","mime_type":"audio/mpeg","size_in_bytes":51057024,"duration_in_seconds":3191}]},{"id":"f5a7d325-6881-48ae-8f15-27943f5b09af","title":"541: Learning and Teaching","url":"https://www.bsdnow.tv/541","content_text":"Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries 'name caches', Always learning, Always Teaching\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nSecurity, Performance, and Interoperability; Introducing FreeBSD 14\n\n\n\nHardenedBSD November 2023 Status Report\n\n\n\n\n\nNews Roundup\n\nHow to create a FreeBSD Jail hosting a remote desktop\n\n\n\nA sneak Peak\n\n\n\nProgramming FreeBSD Reading Process Information\n\n\n\nWhy Unix kernels have grown caches for directory entries 'name caches'\n\n\n\nAlways learning, Always Teaching\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries &#39;name caches&#39;, Always learning, Always Teaching</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/security-performance-and-interoperability-introducing-freebsd-14/\" rel=\"nofollow\">Security, Performance, and Interoperability; Introducing FreeBSD 14</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2023-12-01/hardenedbsd-november-2023-status-report\" rel=\"nofollow\">HardenedBSD November 2023 Status Report</a></h3>\n\n<hr>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://it-notes.dragas.net/2023/12/13/how-to-create-a-freebsd-jail-hosting-xrdp-and-xfce-remote-access-desktop/\" rel=\"nofollow\">How to create a FreeBSD Jail hosting a remote desktop</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/a-sneak-peek-simd-enhanced-string-functions-for-amd64/\" rel=\"nofollow\">A sneak Peak</a></h3>\n\n<hr>\n\n<h3><a href=\"https://patmaddox.com/doc/trunk/www/programming-freebsd-reading-process-information/\" rel=\"nofollow\">Programming FreeBSD Reading Process Information</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/KernelNameCachesWhy\" rel=\"nofollow\">Why Unix kernels have grown caches for directory entries &#39;name caches&#39;</a></h3>\n\n<hr>\n\n<h3><a href=\"https://stephango.com/always-learning-always-teaching\" rel=\"nofollow\">Always learning, Always Teaching</a></h3>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Security, Performance, and Interoperability; Introducing FreeBSD 14, HardenedBSD November 2023 Status Report, How to create a FreeBSD Jail hosting a remote desktop, A sneak Peak, Programming FreeBSD Reading Process Information, Why Unix kernels have grown caches for directory entries 'name caches', Always learning, Always Teaching","date_published":"2024-01-11T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f5a7d325-6881-48ae-8f15-27943f5b09af.mp3","mime_type":"audio/mpeg","size_in_bytes":53020800,"duration_in_seconds":3313}]},{"id":"4f2e9d92-a578-459d-a42d-5d8e1d83db1c","title":"540: Terrapin Attacks SSH","url":"https://www.bsdnow.tv/540","content_text":"Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nTerrapin Attack\n\n\nOpenSSH 9.6 is out\nOpenBSD Patches\nFreeBSD Patches\nIf anyone is aware of NetBSD Patches, please send them into the show so I can update the show notes\n\n\n\n\nSSH Hardening with ssh-audit\n\n\n\n\n\nNews Roundup\n\nMidnightBSD 3.1.2\n\n\n\nsyscall(2) removed from -current\n\n\n\n2024 FreeBSD Community Survey is Here\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n(Markus - how to verify FreeBSD deliverables](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md)\n(neb - tui](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md)\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://terrapin-attack.com\" rel=\"nofollow\">Terrapin Attack</a></h3>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20231219122431\" rel=\"nofollow\">OpenSSH 9.6 is out</a></li>\n<li><a href=\"https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/011_ssh.patch.sig\" rel=\"nofollow\">OpenBSD Patches</a></li>\n<li><a href=\"https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc\" rel=\"nofollow\">FreeBSD Patches</a></li>\n<li><em>If anyone is aware of NetBSD Patches, please send them into the show so I can update the show notes</em></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://thoughts.greyh.at/posts/ssh-audit/\" rel=\"nofollow\">SSH Hardening with ssh-audit</a></h3>\n\n<hr>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://bsdsec.net/articles/midnightbsd-security-midnightbsd-3-1-2\" rel=\"nofollow\">MidnightBSD 3.1.2</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20231213062827\" rel=\"nofollow\">syscall(2) removed from -current</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/2024-freebsd-community-survey-is-here/\" rel=\"nofollow\">2024 FreeBSD Community Survey is Here</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>(Markus - how to verify FreeBSD deliverables](<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/Markus%20-%20how%20to%20verify%20FreeBSD%20deliverables.md</a>)</li>\n<li>(neb - tui](<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/539/feedback/neb%20-%20tui.md</a>)</li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p></li>\n</ul>\n\n<hr>","summary":"Terrapin Attack, SSH Hardening with ssh-audit, MidnightBSD 3.1.2, syscall(2) removed from -current, 2024 FreeBSD Community Survey is Here","date_published":"2024-01-04T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4f2e9d92-a578-459d-a42d-5d8e1d83db1c.mp3","mime_type":"audio/mpeg","size_in_bytes":51090432,"duration_in_seconds":3193}]},{"id":"c8786993-f9f3-4b3d-814f-b7396ee2b050","title":"539: Query all hosts","url":"https://www.bsdnow.tv/539","content_text":"In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"In this special holiday episode, we, the BSDNow hosts, get together to answer questions that listeners have sent us over time. We give you updates on our gear, books we read, favorite places, and a whole lot more. Enjoy!","date_published":"2023-12-28T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8786993-f9f3-4b3d-814f-b7396ee2b050.mp3","mime_type":"audio/mpeg","size_in_bytes":57280128,"duration_in_seconds":3580}]},{"id":"52d8cc20-79da-4a6e-969c-84b4cc973a56","title":"538: Gadget Catalog Age","url":"https://www.bsdnow.tv/538","content_text":"DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDAK and the Golden Age of Gadget Catalogs\n\n\n\nFreeBSD 13.2 upgrade to 14.0 – properly detailed and (hopefully) correct way\n\n\n\nNews Roundup\n\nRunning OpenBSD on Raspberry Pi Zero 2 W\n\n\n\nNetgate Releases pfSense CE Software Version 2.7.1\n\n\n\nSSH agent forwarding and tmux done right\n\n\n\nSome explanations about OpenBSD memory usage\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://cabel.com/2023/11/06/dak-and-the-golden-age-of-gadget-catalogs/\" rel=\"nofollow\">DAK and the Golden Age of Gadget Catalogs</a></h3>\n\n<hr>\n\n<h3><a href=\"https://ozgurkazancci.com/freebsd-13-2-upgrade-to-14-0-proper-and-correct-way/\" rel=\"nofollow\">FreeBSD 13.2 upgrade to 14.0 – properly detailed and (hopefully) correct way</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.tumfatig.net/2023/running-openbsd-on-raspberry-pi-zero-2-w/\" rel=\"nofollow\">Running OpenBSD on Raspberry Pi Zero 2 W</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.netgate.com/blog/netgate-releases-pfsense-ce-software-version-2.7.1\" rel=\"nofollow\">Netgate Releases pfSense CE Software Version 2.7.1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jmmv.dev/2023/11/ssh-agent-forwarding-and-tmux-done.html\" rel=\"nofollow\">SSH agent forwarding and tmux done right</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-08-11-openbsd-understand-memory-usage.html\" rel=\"nofollow\">Some explanations about OpenBSD memory usage</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"DAK and the Golden Age of Gadget Catalogs, FreeBSD 13.2 upgrade to 14.0, Running OpenBSD on Raspberry Pi Zero 2 W, Netgate Releases pfSense CE Software Version 2.7.1, SSH agent forwarding and tmux done right, Some explanations about OpenBSD memory usage, and more","date_published":"2023-12-21T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/52d8cc20-79da-4a6e-969c-84b4cc973a56.mp3","mime_type":"audio/mpeg","size_in_bytes":39395712,"duration_in_seconds":2462}]},{"id":"e7c69b69-7499-4f5f-bc76-c7c76b266218","title":"537: Authentic SSH Host","url":"https://www.bsdnow.tv/537","content_text":"OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS Storage Best Practices and Use Cases – Part 2: File Serving and SANs\n\n\n\nMy MNT Reform – almost a year on\n\n\n\nNews Roundup\n\nWhy do I know shell, and how can you?\n\n\n\nAuthenticate the SSH servers you are connecting to\n\n\n\ndsynth in DragonFly\n\n\n\nNavigating around in shell\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - jail manager questions\nJail manager comparison: https://appjail.readthedocs.io/en/latest/compare/\nnixbytes - sharing a link.md\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-2-file-serving-and-sans/\" rel=\"nofollow\">OpenZFS Storage Best Practices and Use Cases – Part 2: File Serving and SANs</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.geeklan.co.uk/?p=3215\" rel=\"nofollow\">My MNT Reform – almost a year on</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jmmv.dev/2023/11/why-do-i-know-shell-and-how-can-you.html\" rel=\"nofollow\">Why do I know shell, and how can you?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-08-05-sshfp-dns-entries.html\" rel=\"nofollow\">Authenticate the SSH servers you are connecting to</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2023/11/30/dsynth-in-dragonfly/\" rel=\"nofollow\">dsynth in DragonFly</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.meain.io/2023/navigating-around-in-shell/\" rel=\"nofollow\">Navigating around in shell</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/Brad%20-%20jail%20manager%20questions.md\" rel=\"nofollow\">Brad - jail manager questions</a>\nJail manager comparison: <a href=\"https://appjail.readthedocs.io/en/latest/compare/\" rel=\"nofollow\">https://appjail.readthedocs.io/en/latest/compare/</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/537/feedback/nixbytes%20-%20sharing%20a%20link.md\" rel=\"nofollow\">nixbytes - sharing a link.md</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"OpenZFS Storage Best Practices and Use Cases pt 2,  MNT Reform – almost a year on, Why do I know shell, and how can you, Authenticate the SSH servers you are connecting to, dsynth in DragonFly, Navigating around in shell, and more","date_published":"2023-12-14T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7c69b69-7499-4f5f-bc76-c7c76b266218.mp3","mime_type":"audio/mpeg","size_in_bytes":51144960,"duration_in_seconds":3196}]},{"id":"73f0f425-12a1-4b7c-91c4-fa43cb3c7f12","title":"536: Pot-flavored Jails","url":"https://www.bsdnow.tv/536","content_text":"OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS Storage Best Practices and Use Cases - Part 1: Snapshots and Backups\n\n\n\nEuroBSDCon 2023 report (1/2) – arrival &amp; tutorial days\n\nEuroBSDCon 2023 report (2/2) – Main conference, social event &amp; conclusion\n\n\n\nNews Roundup\n\nDisks from the Perspective of a File System\n\n\n\nOpenIKED 7.3 released\n\n\n\nOpenSMTPD 7.4.0p1 Released\n\n\n\nFreeBSD – Creating Jails using flavours in pot\n\n\n\nFreeBSD can now boot in 25 milliseconds\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-storage-best-practices-and-use-cases-part-1-snapshots-and-backups/\" rel=\"nofollow\">OpenZFS Storage Best Practices and Use Cases - Part 1: Snapshots and Backups</a></h3>\n\n<hr>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2023/09/20/eurobsdcon-2023-report-1-2-arrival-tutorial-days/\" rel=\"nofollow\">EuroBSDCon 2023 report (1/2) – arrival &amp; tutorial days</a></h3>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2023/10/15/eurobsdcon-2023-report-2-2-main-conference-social-event-conclusion/\" rel=\"nofollow\">EuroBSDCon 2023 report (2/2) – Main conference, social event &amp; conclusion</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dl.acm.org/doi/10.1145/2367376.2367378\" rel=\"nofollow\">Disks from the Perspective of a File System</a></h3>\n\n<hr>\n\n<h3><a href=\"https://marc.info/?l=openbsd-announce&m=170042964022226&w=2\" rel=\"nofollow\">OpenIKED 7.3 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://marc.info/?l=openbsd-announce&m=170012963318854&w=2\" rel=\"nofollow\">OpenSMTPD 7.4.0p1 Released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://byte-sized.de/linux-unix/freebsd-jails-mithilfe-von-flavours-in-pot-erstellen/#english\" rel=\"nofollow\">FreeBSD – Creating Jails using flavours in pot</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.theregister.com/2023/08/29/freebsd_boots_in_25ms/\" rel=\"nofollow\">FreeBSD can now boot in 25 milliseconds</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"OpenZFS Storage Best Practices and Use Cases, EuroBSDcon trip report, Disks from the Perspective of a File System, Creating Jails using flavours in pot, OpenIKED 7.3 released, OpenSMTPD 7.4.0p1 Released, FreeBSD can now boot in 25 milliseconds, and more","date_published":"2023-12-07T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/73f0f425-12a1-4b7c-91c4-fa43cb3c7f12.mp3","mime_type":"audio/mpeg","size_in_bytes":49751808,"duration_in_seconds":3109}]},{"id":"610bc47e-40b5-420b-bfd1-343fadf60a04","title":"535: Untitled Episode","url":"https://www.bsdnow.tv/535","content_text":"FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD 14\n\n• [Quick update](https://www.daemonology.net/blog/2023-11-21-late-breaking-FreeBSD-14-breakage.html)\n• [Vermaden’s FreeBSD 14 valuable news] (https://vermaden.wordpress.com/2023/11/17/valuable-freebsd-14-0-release-updates)\n\n\n\n\nNews Roundup\n\nReading your RSS feed on FreeBSD\n\n\n\nManipulate PDF files easily with pdftk\n\n\n\nclang(1)/llvm updated to version 16\n\n\n\nNetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8)\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - zpool disk allocation questions\nKevin - shell question\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/14.0R/relnotes/\" rel=\"nofollow\">FreeBSD 14</a></h3>\n\n<pre><code>• [Quick update](https://www.daemonology.net/blog/2023-11-21-late-breaking-FreeBSD-14-breakage.html)\n• [Vermaden’s FreeBSD 14 valuable news] (https://vermaden.wordpress.com/2023/11/17/valuable-freebsd-14-0-release-updates)\n</code></pre>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.ncartron.org/reading-your-rss-feed-on-freebsd.html\" rel=\"nofollow\">Reading your RSS feed on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-08-19-pdftk-guide.html\" rel=\"nofollow\">Manipulate PDF files easily with pdftk</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.undeadly.org/cgi?action=article;sid=20231113160314&utm_source=bsdweekly\" rel=\"nofollow\">clang(1)/llvm updated to version 16</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdsec.net/articles/netbsd-security-advisory-2023-007-multiple-vulnerabilities-in-ftpd-8\" rel=\"nofollow\">NetBSD Security Advisory 2023-007: multiple vulnerabilities in ftpd(8)</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Brad%20-%20zpool%20disk%20allocation%20questions.md\" rel=\"nofollow\">Brad - zpool disk allocation questions</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/535/feedback/Kevin%20-%20shell%20question.md\" rel=\"nofollow\">Kevin - shell question</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"FreeBSD 14 has been released, Reading your RSS feed on FreeBSD, Manipulate PDF files easily with pdftk, clang(1)/llvm updated to version 16 in OpenBSD, NetBSD Security Advisory: multiple vulnerabilities in ftpd(8), and more","date_published":"2023-11-30T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/610bc47e-40b5-420b-bfd1-343fadf60a04.mp3","mime_type":"audio/mpeg","size_in_bytes":54371712,"duration_in_seconds":3398}]},{"id":"fe2b5c7a-0dfd-4dfa-8cfd-3bbac48369f0","title":"534: Narrow Waisted Internet","url":"https://www.bsdnow.tv/534","content_text":"Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nMigrating from an Old Linux Server to a New FreeBSD Machine\n\n\n\nThe Internet Was Designed With a Narrow Waist\n\n\n\nThe Worst New Guys In History\n\n\n\nNews Roundup\n\nFreeBSD Jails vs. Docker: A Comparison\n\n\n\nInstalling Oracle Developer Studio 12.6 on Illumos\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - Detective work on zpool history\nExtrowerk - End of the world type stuff\nMike - principle of least astonishment\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://it-notes.dragas.net/2023/10/25/migrating-from-an-old-linux-server-to-a-new-freebsd-machine/\" rel=\"nofollow\">Migrating from an Old Linux Server to a New FreeBSD Machine</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.oilshell.org/blog/2022/02/diagrams.html\" rel=\"nofollow\">The Internet Was Designed With a Narrow Waist</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.vito.nyc/posts/on-programming/\" rel=\"nofollow\">The Worst New Guys In History</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://justanerds.site/freebsd-jails-vs-docker/\" rel=\"nofollow\">FreeBSD Jails vs. Docker: A Comparison</a></h3>\n\n<hr>\n\n<h3><a href=\"https://briancallahan.net/blog/20230703.html\" rel=\"nofollow\">Installing Oracle Developer Studio 12.6 on Illumos</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Brad%20-%20Detective%20work%20on%20zpool%20history.md\" rel=\"nofollow\">Brad - Detective work on zpool history</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Extrowerk%20-%20End%20of%20the%20world%20type%20stuff.md\" rel=\"nofollow\">Extrowerk - End of the world type stuff</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/534/feedback/Mike%20-%20principle%20of%20least%20astonishment.md\" rel=\"nofollow\">Mike - principle of least astonishment</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Migrating from an Old Linux Server to a New FreeBSD Machine, The Internet Was Designed With a Narrow Waist, The Worst New Guys In History, FreeBSD Jails vs. Docker: A Comparison, Oracle Developer Studio 12.6 on Illumos","date_published":"2023-11-23T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fe2b5c7a-0dfd-4dfa-8cfd-3bbac48369f0.mp3","mime_type":"audio/mpeg","size_in_bytes":60482304,"duration_in_seconds":3780}]},{"id":"932df15a-6bff-4f3d-b9d8-6c477d8da3a7","title":"533: Package the Base","url":"https://www.bsdnow.tv/533","content_text":"FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nLooking Towards the Future: FreeBSD on the RISC-V Architecture\n\n\n\nA bit of XENIX history\n\n\n\nNews Roundup\n\nOfficial packages\n\n\n\nrecover lost text by coredumping firefox\n\n\n\nFuguIta 7.4 has been released\n\n\n\nLibreSSL 3.8.2 Released\n\n\n\nOpenSMTPD 7.4.0p0 Released\n\n\n\nConference News\n\nAsiaBSDCon 2024\n\n\n\nBSDCan 2024\n\n\n\nEuroBSDCon 2024\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/\" rel=\"nofollow\">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>\n\n<hr>\n\n<h3><a href=\"http://seefigure1.com/2014/04/15/xenixtime.html\" rel=\"nofollow\">A bit of XENIX history</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://lists.freebsd.org/archives/freebsd-pkgbase/2023-October/000221.html\" rel=\"nofollow\">Official packages</a></h3>\n\n<hr>\n\n<h3><a href=\"https://j3s.sh/thought/recover-lost-text-by-coredumping-firefox.html\" rel=\"nofollow\">recover lost text by coredumping firefox</a></h3>\n\n<hr>\n\n<h3><a href=\"https://fuguita.org/?FuguIta/7.4&utm_source=bsdweekly\" rel=\"nofollow\">FuguIta 7.4 has been released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20231103065952\" rel=\"nofollow\">LibreSSL 3.8.2 Released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20231026121132\" rel=\"nofollow\">OpenSMTPD 7.4.0p0 Released</a></h3>\n\n<hr>\n\n<h2>Conference News</h2>\n\n<h3><a href=\"https://2024.asiabsdcon.org\" rel=\"nofollow\">AsiaBSDCon 2024</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.bsdcan.org\" rel=\"nofollow\">BSDCan 2024</a></h3>\n\n<hr>\n\n<h3><a href=\"https://2024.eurobsdcon.org\" rel=\"nofollow\">EuroBSDCon 2024</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"FreeBSD on the RISC-V Architecture, A bit of XENIX history, pkgbase: Official packages, recover lost text by coredumping firefox, FuguIta 7.4 has been released, LibreSSL 3.8.2 Released, OpenSMTPD 7.4.0p0 Released","date_published":"2023-11-16T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/932df15a-6bff-4f3d-b9d8-6c477d8da3a7.mp3","mime_type":"audio/mpeg","size_in_bytes":42418944,"duration_in_seconds":2651}]},{"id":"fb3e426c-683d-4307-9059-e6770baccf3a","title":"532:  2^18 dollars sponsorship","url":"https://www.bsdnow.tv/532","content_text":"218 dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n218 dollars to open source\n\n\nSpecial Thanks to Colin for supporting BSD Now for over 10 years!\n***\n### EuroBSDCon 2023 Trip Report – Bojan Novković\n***\n### FreeBSD vs Linux (Debian)\n***\n\n\nNews Roundup\n\nIntroduction to sysclean8\n\n\n\nRun your own Syncthing discovery server on OpenBSD\n\n\n\nMy FreeBSD years: 2000-2005\n\n\n\nUsing OpenBSD relayd(8) as an Application Layer Gateway\n\n\n\nBeastie Bits\n\n\nHow to send syslog messages using command-line utilities\nA Practical Guide of GNU grep With Examples\nFreeBSD Container VM for Podman\nUser Certbot to create SSL certificates on FreeBSD\nOpenBSD's built-in memory leak detection\nOpenBSD Webzine Issue #15\nFreeBSD OpenSSL 3.0 ported\nHarden FreeBSD Script\nSomething odd happened...\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>2<sup>18</sup> dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.daemonology.net/blog/2023-10-25-2%5E18-dollars-to-open-source.html\" rel=\"nofollow\">2<sup>18</sup> dollars to open source</a></h3>\n\n<ul>\n<li>Special Thanks to Colin for supporting BSD Now for over 10 years!\n***\n### <a href=\"https://freebsdfoundation.org/blog/eurobsdcon-2023-trip-report-bojan-novkovic/\" rel=\"nofollow\">EuroBSDCon 2023 Trip Report – Bojan Novković</a>\n***\n### <a href=\"https://markmcb.com/freebsd/vs_linux/\" rel=\"nofollow\">FreeBSD vs Linux (Debian)</a>\n***</li>\n</ul>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.osnews.com/story/137266/introduction-to-sysclean8-on-openbsd/\" rel=\"nofollow\">Introduction to sysclean8</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-10-18-syncthing-discovery-server.html\" rel=\"nofollow\">Run your own Syncthing discovery server on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/my-freebsd-years-2000-2005/\" rel=\"nofollow\">My FreeBSD years: 2000-2005</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2023/using-openbsd-relayd8-as-an-application-layer-gateway/\" rel=\"nofollow\">Using OpenBSD relayd(8) as an Application Layer Gateway</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/\" rel=\"nofollow\">How to send syslog messages using command-line utilities</a></li>\n<li><a href=\"https://thevaluable.dev/grep-cli-guide-examples/\" rel=\"nofollow\">A Practical Guide of GNU grep With Examples</a></li>\n<li><a href=\"https://github.com/davidchisnall/container-vm-scripts\" rel=\"nofollow\">FreeBSD Container VM for Podman</a></li>\n<li><a href=\"https://www.sharpwriting.net/project/use-certbot-to-create-ssl-certificates-on-freebsd/\" rel=\"nofollow\">User Certbot to create SSL certificates on FreeBSD</a></li>\n<li><a href=\"https://www.undeadly.org/cgi?action=article;sid=20231024064619\" rel=\"nofollow\">OpenBSD&#39;s built-in memory leak detection</a></li>\n<li><a href=\"https://webzine.puffy.cafe/issue-15.html\" rel=\"nofollow\">OpenBSD Webzine Issue #15</a></li>\n<li><a href=\"https://github.com/FreeBSD/freebsd-ports/commit/d5ec2e12f399b7813994564b77a0915821a0ac42\" rel=\"nofollow\">FreeBSD OpenSSL 3.0 ported</a></li>\n<li><a href=\"https://github.com/wravoc/harden-freebsd\" rel=\"nofollow\">Harden FreeBSD Script</a></li>\n<li><a href=\"https://mastodon.bsd.cafe/@stefano/111257154132788711\" rel=\"nofollow\">Something odd happened...</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"2^18 dollars to open source, EuroBSDCon 2023 Trip Report, FreeBSD vs Linux (Debian), Introduction to sysclean8, Run your own Syncthing discovery server on OpenBSD, FreeBSD years: 2000-2005, Using OpenBSD relayd(8) as an Application Layer Gateway, and more","date_published":"2023-11-09T10:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fb3e426c-683d-4307-9059-e6770baccf3a.mp3","mime_type":"audio/mpeg","size_in_bytes":52249728,"duration_in_seconds":3265}]},{"id":"99479afb-bb6c-4471-9eaf-a76999dd513c","title":"531: Everlasting Software","url":"https://www.bsdnow.tv/531","content_text":"OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD 7.4\n\n\n\nMaking Software Last Forever\n\n\n\nNews Roundup\n\nDragonFlyBSD Per-process capability-based restrictions\n\n\n\nHardenedBSD September 2023 Status Report\n\n\n\nNetBSD as a Kubernetes Pod\n\n\n\nFirefox hardening with Arkenfox\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nA Random Listener - Other Podcasts\nDante - Thanks\nLars - WEI DRM\nYKLA - transcripts\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openbsd.org/74.html\" rel=\"nofollow\">OpenBSD 7.4</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.danstroot.com/posts/2023-05-25-making_software_last_forever\" rel=\"nofollow\">Making Software Last Forever</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://lists.dragonflybsd.org/pipermail/commits/2023-October/922780.html\" rel=\"nofollow\">DragonFlyBSD Per-process capability-based restrictions</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2023-10-10/hardenedbsd-september-2023-status-report\" rel=\"nofollow\">HardenedBSD September 2023 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://imil.net/blog/posts/2023/netbsd-as-a-k8s-pod/\" rel=\"nofollow\">NetBSD as a Kubernetes Pod</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-09-24-harden-firefox-with-arkenfox.html\" rel=\"nofollow\">Firefox hardening with Arkenfox</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/A%20Random%20Listener%20-%20Other%20Podcasts.md\" rel=\"nofollow\">A Random Listener - Other Podcasts</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Dante%20-%20Thanks.md\" rel=\"nofollow\">Dante - Thanks</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/Lars%20-%20WEI%20DRM.md\" rel=\"nofollow\">Lars - WEI DRM</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/531/feedback/YKLA%20-%20transcripts.md\" rel=\"nofollow\">YKLA - transcripts</a>\n***</li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"OpenBSD 7.4, Making Software Last Forever, DragonFlyBSD Per-process capability-based restrictions, HardenedBSD September 2023 Status Report, NetBSD as a Kubernetes Pod, Firefox hardening with Arkenfox, and more","date_published":"2023-11-02T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/99479afb-bb6c-4471-9eaf-a76999dd513c.mp3","mime_type":"audio/mpeg","size_in_bytes":60355584,"duration_in_seconds":3772}]},{"id":"f52a06e2-8680-4641-9d49-6157118d4556","title":"530: Old Computer Rescue","url":"https://www.bsdnow.tv/530","content_text":"Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nImplementing a system call for OpenBSD\n\n\n\nSelf-Hosted Email services on OpenBSD\n\n\n\nThe First 5 Minutes on a New FreeBSD Server\n\n\n\nNews Roundup\n\nOLD COMPUTER RESCUE - X201\n\n\n\n[CFT] sec(4) for Route Based IPSec VPNs\n\n\n\nHow to send syslog messages using command-line utilities\n\n\n\nKeeping my email sorted (the hard way)\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAlbin - Links\nDouglas - Best practices\nPatrick - Ideas Feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://poolp.org/posts/2023-07-05/implementing-a-system-call-for-openbsd/\" rel=\"nofollow\">Implementing a system call for OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2023/self-hosted-email-services-on-openbsd/\" rel=\"nofollow\">Self-Hosted Email services on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://herrbischoff.com/2022/12/the-first-5-minutes-on-a-new-freebsd-server/\" rel=\"nofollow\">The First 5 Minutes on a New FreeBSD Server</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://triapul.cz/automa/old-computer-rescue-x201/\" rel=\"nofollow\">OLD COMPUTER RESCUE - X201</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230704094238\" rel=\"nofollow\">[CFT] sec(4) for Route Based IPSec VPNs</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sleeplessbeastie.eu/2023/09/11/how-to-send-syslog-messages-using-command-line-utilities/\" rel=\"nofollow\">How to send syslog messages using command-line utilities</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sebastiano.tronto.net/blog/2022-10-19-email-setup/\" rel=\"nofollow\">Keeping my email sorted (the hard way)</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Albin%20-%20Links.md\" rel=\"nofollow\">Albin - Links</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Douglas%20-%20Best%20practices.md\" rel=\"nofollow\">Douglas - Best practices</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/530/feedback/Patrick%20-%20Ideas%20Feedback.md\" rel=\"nofollow\">Patrick - Ideas Feedback</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Implementing a system call for OpenBSD, Self-Hosted Email services on OpenBSD, First 5 Minutes on a New FreeBSD Server, OLD COMPUTER RESCUE - X201, sec(4) for Route Based IPSec VPNs, send syslog messages using command-line utilities, Keeping email sorted (the hard way), and more","date_published":"2023-10-26T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f52a06e2-8680-4641-9d49-6157118d4556.mp3","mime_type":"audio/mpeg","size_in_bytes":52091136,"duration_in_seconds":3255}]},{"id":"cf9c4493-9570-487d-bd01-4c21bef585cd","title":"529: Adapt, adopt, diffuse","url":"https://www.bsdnow.tv/529","content_text":"Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAdopting FreeBSD as Your Open Source Operating System: Benefits &amp; Considerations\n\n\n\nHow Hard is it to Adapt a Memory Allocator to CHERI\n\n\n\nNews Roundup\n\n[Running Stable Diffusion on FreeBSD)[https://github.com/verm/freebsd-stable-diffusion)\n\n\n\nSelf-hosting Pixelfed on OpenBSD\n\n\n\nCreating a Time Capsule instance using Samba, FreeBSD, and ZFS\n\n\n\nBeastie Bits\n\n• [OpenZFS on Twitter](https://x.com/openzfs/status/1704212154558324827?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)\n• [EuroBSDcon 2023, Portugal](https://m.youtube.com/playlist?list=PLskKNopggjc7s6nAMxKF0tAO77ZIowZdx&amp;cbrd=1)\n• [The lost history if Emoticons](https://x.com/rainmaker1973/status/1704006098909352016?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)\n• [Solving the same problem](https://blog.fredrb.com/2023/09/08/same-problem-multiple-times/)\n• [http://vihart.com/fifty-fizzbuzzes/](50 Fizz buzzes)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nEric - German Question\nJohn Baldwin - Ep 520 question\nPat - 3d Printing\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.javacodegeeks.com/2023/09/adopting-freebsd-as-your-open-source-operating-system-benefits-considerations.html\" rel=\"nofollow\">Adopting FreeBSD as Your Open Source Operating System: Benefits &amp; Considerations</a></h3>\n\n<hr>\n\n<h3><a href=\"https://tratt.net/laurie/blog/2023/how_hard_is_it_to_adapt_a_memory_allocator_to_cheri.html\" rel=\"nofollow\">How Hard is it to Adapt a Memory Allocator to CHERI</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3>[Running Stable Diffusion on FreeBSD)[<a href=\"https://github.com/verm/freebsd-stable-diffusion\" rel=\"nofollow\">https://github.com/verm/freebsd-stable-diffusion</a>)</h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2023/self-hosting-pixelfed-on-openbsd/\" rel=\"nofollow\">Self-hosting Pixelfed on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2023/09/28/creating-a-time-capsule-instance-using-samba-freebsd-and-zfs/\" rel=\"nofollow\">Creating a Time Capsule instance using Samba, FreeBSD, and ZFS</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [OpenZFS on Twitter](https://x.com/openzfs/status/1704212154558324827?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)\n• [EuroBSDcon 2023, Portugal](https://m.youtube.com/playlist?list=PLskKNopggjc7s6nAMxKF0tAO77ZIowZdx&amp;cbrd=1)\n• [The lost history if Emoticons](https://x.com/rainmaker1973/status/1704006098909352016?s=12&amp;t=-_bfM_adaiX8Ri_3lN9OYw)\n• [Solving the same problem](https://blog.fredrb.com/2023/09/08/same-problem-multiple-times/)\n• [http://vihart.com/fifty-fizzbuzzes/](50 Fizz buzzes)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Eric%20-%20German%20Question.md\" rel=\"nofollow\">Eric - German Question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/John%20Baldwin%20-%20Ep%20520%20question.md\" rel=\"nofollow\">John Baldwin - Ep 520 question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/529/feedback/Pat%20-%203d%20Printing.md\" rel=\"nofollow\">Pat - 3d Printing</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Adopting FreeBSD as Your Open Source Operating System, How Hard is it to Adapt a Memory Allocator to CHERI, Running Stable Diffusion on FreeBSD, Self-hosting Pixelfed on OpenBSD, Time Capsule instance using Samba, FreeBSD, and ZFS, and more","date_published":"2023-10-19T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cf9c4493-9570-487d-bd01-4c21bef585cd.mp3","mime_type":"audio/mpeg","size_in_bytes":59623680,"duration_in_seconds":3726}]},{"id":"adf32193-69d6-48d0-bb39-452d36512660","title":"528: Pledge the Program","url":"https://www.bsdnow.tv/528","content_text":"If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nIf you can use Open Source you can build hardware\n\n\n\nGood performance is not just big O\n\n\n\nNews Roundup\n\nHow to add pledge to a program in OpenBSD\n\n\n\nProof You Should Not Run My Code\n\n\n\n3D printing on OpenBSD? Yes, that’s a thing!\n\n\n\nGetting the right type of certificate\n\n\n\nJenny’s Daily Drivers\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://redeem-tomorrow.com/if-you-can-use-open-source-you-can-build-hardware\" rel=\"nofollow\">If you can use Open Source you can build hardware</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jmmv.dev/2023/09/performance-is-not-big-o.html\" rel=\"nofollow\">Good performance is not just big O</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-09-08-openbsd-how-to-pledge-a-program.html\" rel=\"nofollow\">How to add pledge to a program in OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/23082\" rel=\"nofollow\">Proof You Should Not Run My Code</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20230914075444\" rel=\"nofollow\">3D printing on OpenBSD? Yes, that’s a thing!</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2023/09/09/getting-the-right-type-of-certificate/\" rel=\"nofollow\">Getting the right type of certificate</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/\" rel=\"nofollow\">Jenny’s Daily Drivers</a></h3>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"If you can use Open Source you can build hardware, Good performance is not just big O, Proof You Should Not Run MWL Code, How to add pledge to a program in OpenBSD, 3D printing on OpenBSD, Getting the right type of certificate, Jenny’s Daily Drivers, and more","date_published":"2023-10-12T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/adf32193-69d6-48d0-bb39-452d36512660.mp3","mime_type":"audio/mpeg","size_in_bytes":51518976,"duration_in_seconds":3219}]},{"id":"0a272a48-0c9a-4f75-a363-5263d9f7a342","title":"527: Reports are in","url":"https://www.bsdnow.tv/527","content_text":"Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nUnlocking Infrastructure Sovereignty: Harnessing the Power of Open Source Solutions for Business Flexibility and Cost-Effectiveness\n\n\n\nRecap of first meeting of the FreeBSD Enterprise Working Group\n\n\n\nNews Roundup\n\nHardenedBSD August 2023 Status Report\n\n• [HardenedBSD 14-STABLE Now Available](https://hardenedbsd.org/article/shawn-webb/2023-09-11/hardenedbsd-14-stable-now-available)\n\n\n\n\nAugust 2023 donation report\n\n• [Late on the announcement but... GhostBSD 23.06.01 ISO is now available](http://ghostbsd.org/23.06.01_iso_is_now_available)\n\n\n\n\nMidnightBSD 3.1 Released\n\n\n\nOpenBSD Webzine ISSUE #14 is out\n\n\n\nBeastie Bits\n\n• [ZFS for Dummies](https://ikrima.dev/dev-notes/homelab/zfs-for-dummies/)\n• [The Switch runs FreeBSD](https://www.reddit.com/r/NintendoSwitch/comments/5xbe5a/the_switch_runs_freebsd_making_it_nintendos_first/)\n• [KDE on OpenBSD](https://marc.info/?l=openbsd-ports&amp;m=169391479324962)\n• [(Kubernetes v1.28.0) for illumos, FreeBSD and OpenBSD](https://medium.com/@norlin.t/by-the-way-planternetes-kubernetes-v1-28-0-for-illumos-freebsd-and-openbsd-5d57026d6a25)\n• [Video: C Programming on System 6 - VCF Midwest, Wi-Fi DA](https://jcs.org/2023/09/20/vcfmw)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/unlocking-infrastructure-sovereignty-harnessing-the-power-of-open-source-solutions/\" rel=\"nofollow\">Unlocking Infrastructure Sovereignty: Harnessing the Power of Open Source Solutions for Business Flexibility and Cost-Effectiveness</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/recap-of-first-meeting-of-the-freebsd-enterprise-working-group/\" rel=\"nofollow\">Recap of first meeting of the FreeBSD Enterprise Working Group</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2023-09-01/hardenedbsd-august-2023-status-report\" rel=\"nofollow\">HardenedBSD August 2023 Status Report</a></h3>\n\n<pre><code>• [HardenedBSD 14-STABLE Now Available](https://hardenedbsd.org/article/shawn-webb/2023-09-11/hardenedbsd-14-stable-now-available)\n</code></pre>\n\n<hr>\n\n<h3><a href=\"http://ghostbsd.org/news/August_2023_donation_report\" rel=\"nofollow\">August 2023 donation report</a></h3>\n\n<pre><code>• [Late on the announcement but... GhostBSD 23.06.01 ISO is now available](http://ghostbsd.org/23.06.01_iso_is_now_available)\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/news/MidnightBSD-3.1\" rel=\"nofollow\">MidnightBSD 3.1 Released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://webzine.puffy.cafe/issue-14.html\" rel=\"nofollow\">OpenBSD Webzine ISSUE #14 is out</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [ZFS for Dummies](https://ikrima.dev/dev-notes/homelab/zfs-for-dummies/)\n• [The Switch runs FreeBSD](https://www.reddit.com/r/NintendoSwitch/comments/5xbe5a/the_switch_runs_freebsd_making_it_nintendos_first/)\n• [KDE on OpenBSD](https://marc.info/?l=openbsd-ports&amp;m=169391479324962)\n• [(Kubernetes v1.28.0) for illumos, FreeBSD and OpenBSD](https://medium.com/@norlin.t/by-the-way-planternetes-kubernetes-v1-28-0-for-illumos-freebsd-and-openbsd-5d57026d6a25)\n• [Video: C Programming on System 6 - VCF Midwest, Wi-Fi DA](https://jcs.org/2023/09/20/vcfmw)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Unlocking Infrastructure Sovereignty, first meeting of the FreeBSD Enterprise Working Group, HardenedBSD August 2023 Status Report, GhostBSD August 2023 donation report, MidnightBSD 3.1 Released, OpenBSD Webzine ISSUE #14, and more","date_published":"2023-10-05T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0a272a48-0c9a-4f75-a363-5263d9f7a342.mp3","mime_type":"audio/mpeg","size_in_bytes":58297728,"duration_in_seconds":3643}]},{"id":"d499d953-6d8f-4990-b7af-a8fca573f5c3","title":"526: ZFS Replication Tools","url":"https://www.bsdnow.tv/526","content_text":"Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhy DNS is still hard to learn\n\n\n\nUnix support 50 years ago: “your only source of information is a 2-man operation an ocean away”\n\n\n\nNews Roundup\n\nZFS Replication tools\n\n\n\nBetween ISA and PCI, PCs had EISA and VLB\n\n\n\nOld Computer Challenge v3: postmortem\n\n\n\nBeastie Bits\n\n• [Installing and Using Research Unix Version 7 on the OpenSIMH PDP-11 Emulator](https://decuser.github.io/unix/research-unix/v7/videos/2023/07/14/installing-and-using-research-unix-v7-in-open-simh-video.html)\n• [Cheat Sheets](https://github.com/cheat/cheatsheets/tree/master)\n• [Introducing BSD Cafe](https://www.reddit.com/r/BSD/comments/15rt7em/introducing_the_bsdcafe/)\n• [Keystroke timing obfuscation added to ssh(1)](http://undeadly.org/cgi?action=article;sid=20230829051257)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDaniel - Fav episode\nSam - Fav episode\nQuestion from JT - to Tom and Benedict, what has your fav episode been?\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://jvns.ca/blog/2023/07/28/why-is-dns-still-hard-to-learn/\" rel=\"nofollow\">Why DNS is still hard to learn</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cs.auckland.ac.nz/%7Ebrian/LetterFromRitchie.pdf\" rel=\"nofollow\">Unix support 50 years ago: “your only source of information is a 2-man operation an ocean away”</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://evilham.com/en/blog/2023-ZFS-replication-tools/\" rel=\"nofollow\">ZFS Replication tools</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/between-isa-and-pci-we-had-vlb/\" rel=\"nofollow\">Between ISA and PCI, PCs had EISA and VLB</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-07-17-old-computer-challenge-v3-part2.html\" rel=\"nofollow\">Old Computer Challenge v3: postmortem</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [Installing and Using Research Unix Version 7 on the OpenSIMH PDP-11 Emulator](https://decuser.github.io/unix/research-unix/v7/videos/2023/07/14/installing-and-using-research-unix-v7-in-open-simh-video.html)\n• [Cheat Sheets](https://github.com/cheat/cheatsheets/tree/master)\n• [Introducing BSD Cafe](https://www.reddit.com/r/BSD/comments/15rt7em/introducing_the_bsdcafe/)\n• [Keystroke timing obfuscation added to ssh(1)](http://undeadly.org/cgi?action=article;sid=20230829051257)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Daniel%20-%20Fav%20episode.md\" rel=\"nofollow\">Daniel - Fav episode</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/526/feedback/Sam%20-%20Fav%20episode.md\" rel=\"nofollow\">Sam - Fav episode</a></li>\n<li>Question from JT - to Tom and Benedict, what has your fav episode been?\n***</li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Why DNS is still hard to learn, Unix support 50 years ago, ZFS Replication tools, Between ISA and PCI, PCs had EISA and VLB, Old Computer Challenge v3, and more","date_published":"2023-09-28T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d499d953-6d8f-4990-b7af-a8fca573f5c3.mp3","mime_type":"audio/mpeg","size_in_bytes":44952960,"duration_in_seconds":2809}]},{"id":"77bb2c15-7149-4511-a582-7ce5ce3096cd","title":"525: Old NetBSD Server","url":"https://www.bsdnow.tv/525","content_text":"Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDo one thing and do it well\n\n\n\nTurning a 15 years old laptop into a children proof retrogaming station\n\nand a rereview of\n\n\n\nNews Roundup\n\nOld Computer Challenge v3: day 1\n\n\n\nIt Takes 6 Days to Change 1 Line of Code\n\n\n\nRejected GitHub Profile Achievements\n\n\n\nThat old netbsd server\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nFelix - questions\nFrancis - Episode 511\nIan - CDN\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n\n\n","content_html":"<p>Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://medium.com/source-and-buggy/do-one-thing-and-do-it-well-886b11a5d21\" rel=\"nofollow\">Do one thing and do it well</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-07-24-childproof-retrogaming-station.html\" rel=\"nofollow\">Turning a 15 years old laptop into a children proof retrogaming station</a></h3>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2023-06-04-old-computer-challenge-v3.html\" rel=\"nofollow\">and a rereview of</a></p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-07-10-old-computer-challenge-v3-part1.html\" rel=\"nofollow\">Old Computer Challenge v3: day 1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://edw519.posthaven.com/it-takes-6-days-to-change-1-line-of-code\" rel=\"nofollow\">It Takes 6 Days to Change 1 Line of Code</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/Flet/rejected-github-profile-achievements\" rel=\"nofollow\">Rejected GitHub Profile Achievements</a></h3>\n\n<hr>\n\n<h3><a href=\"https://it-notes.dragas.net/2023/08/27/that-old-netbsd-server-running-since-2010/\" rel=\"nofollow\">That old netbsd server</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Felix%20-%20questions.md\" rel=\"nofollow\">Felix - questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Francis%20-%20Episode%20511.md\" rel=\"nofollow\">Francis - Episode 511</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/525/feedback/Ian%20-%20CDN.md\" rel=\"nofollow\">Ian - CDN</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n<li><p>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a></p>\n\n<hr></li>\n</ul>","summary":"Do one thing and do it well, Turning a 15 years old laptop into a children proof retrogaming station, Old Computer Challenge v3: day 1, It Takes 6 Days to Change 1 Line of Code, Rejected GitHub Profile Achievements, that old netbsd server, and more","date_published":"2023-09-21T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/77bb2c15-7149-4511-a582-7ce5ce3096cd.mp3","mime_type":"audio/mpeg","size_in_bytes":42549120,"duration_in_seconds":2659}]},{"id":"ce877f80-4e1c-4029-adbe-4b5893efef2d","title":"524: Legendary Unix Recovery","url":"https://www.bsdnow.tv/524","content_text":"On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOn the Loss and Preservation of Knowledge\n\n\n\nUnix Recovery Legend\n\n\n\nNews Roundup\n\nUseful Unix commands for data science\n\n\n\nWhy we like Tarsnap = Transparency : Tarsnap outage post-mortem\n\n\n\nOpenBSD 7.3 on a twenty year old IBM ThinkPad R31\n\n\n\nBeastie Bits\n\n\nQuick and dirty IMAP(-UW) server\nJENNY’S DAILY DRIVERS: FREEBSD 13.2\nElvish\nxroach\nDid hell freeze over?\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nNelson - Bell Labs Memoranda\npatrick - audio switching\ntim - appjail\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://samoburja.com/on-the-loss-and-preservation-of-knowledge/\" rel=\"nofollow\">On the Loss and Preservation of Knowledge</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.ecb.torontomu.ca/%7Eelf/hack/recovery.html\" rel=\"nofollow\">Unix Recovery Legend</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://gregreda.com/2013/07/15/unix-commands-for-data-science/\" rel=\"nofollow\">Useful Unix commands for data science</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mail.tarsnap.com/tarsnap-announce/msg00050.html\" rel=\"nofollow\">Why we like Tarsnap = Transparency : Tarsnap outage post-mortem</a></h3>\n\n<hr>\n\n<h3><a href=\"https://box.matto.nl/openbsd-73-on-a-twenty-year-old-ibm-thinkpad-r31.html\" rel=\"nofollow\">OpenBSD 7.3 on a twenty year old IBM ThinkPad R31</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://forums.freebsd.org/threads/quick-and-dirty-imap-uw-server.89877/\" rel=\"nofollow\">Quick and dirty IMAP(-UW) server</a></li>\n<li><a href=\"https://hackaday.com/2023/08/01/jennys-daily-drivers-freebsd-13-2/\" rel=\"nofollow\">JENNY’S DAILY DRIVERS: FREEBSD 13.2</a></li>\n<li><a href=\"https://elv.sh/\" rel=\"nofollow\">Elvish</a></li>\n<li><a href=\"https://infosec.exchange/@paco/110772422266480371\" rel=\"nofollow\">xroach</a></li>\n<li><a href=\"https://soc.feditime.com/notice/AXo6xXlSrfdfjNPdRI\" rel=\"nofollow\">Did hell freeze over?</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/Nelson%20-%20Bell%20Labs%20Memoranda.md\" rel=\"nofollow\">Nelson - Bell Labs Memoranda</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/patrick%20-%20audio%20switching.md\" rel=\"nofollow\">patrick - audio switching</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/523/feedback/tim%20-%20appjail.md\" rel=\"nofollow\">tim - appjail</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"On the Loss and Preservation of Knowledge, Unix Recovery Legend, Useful Unix commands for data science, Tarsnap outage post-mortem, OpenBSD 7.3 on a twenty year old IBM ThinkPad R31, and more","date_published":"2023-09-14T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ce877f80-4e1c-4029-adbe-4b5893efef2d.mp3","mime_type":"audio/mpeg","size_in_bytes":55404288,"duration_in_seconds":3462}]},{"id":"e03effe5-46f6-4cc7-8c19-4f549f78415c","title":"523: Literally Unix","url":"https://www.bsdnow.tv/523","content_text":"The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe Elements Of Style: UNIX As Literature\n\n\n\nThe shell and its crappy handling of whitespace\n\n\n\nNews Roundup\n\nTheo de Raadt on Zenbleed\n\n\n\nOPNsense 23.7 “Restless Roadrunner” Released\n\n\n\n[ILLUMOS GETS A NEW C COMPILER](https://briancallahan.net/blog/20230705.html\n\n)\n\n\n\nFIXING THINKPAD X1 WIFI ON FREEBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\n","content_html":"<p>The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://theody.net/elements.html\" rel=\"nofollow\">The Elements Of Style: UNIX As Literature</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.plover.com/Unix/whitespace.html\" rel=\"nofollow\">The shell and its crappy handling of whitespace</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.undeadly.org/cgi?action=article;sid=20230724224011\" rel=\"nofollow\">Theo de Raadt on Zenbleed</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-23-7-released/\" rel=\"nofollow\">OPNsense 23.7 “Restless Roadrunner” Released</a></h3>\n\n<hr>\n\n<h3>[ILLUMOS GETS A NEW C COMPILER](<a href=\"https://briancallahan.net/blog/20230705.html\" rel=\"nofollow\">https://briancallahan.net/blog/20230705.html</a></h3>\n\n<p>)</p>\n\n<hr>\n\n<h3><a href=\"https://michal.sapka.me/2023/fixing-thinkpad-x1-wifi-on-freebsd/\" rel=\"nofollow\">FIXING THINKPAD X1 WIFI ON FREEBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr></li>\n<li><ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul></li>\n</ul>","summary":"The Elements Of Style: UNIX As Literature, The shell and its crappy handling of whitespace, Theo de Raadt on Zenbleed, OPNsense 23.7 released, illumos gets a new C compiler, fixing Thinkpad X1 WIFI on FreeBSD, and more","date_published":"2023-09-07T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e03effe5-46f6-4cc7-8c19-4f549f78415c.mp3","mime_type":"audio/mpeg","size_in_bytes":38576256,"duration_in_seconds":2411}]},{"id":"eb9e39c2-564c-4286-b1dd-e1d57a331f87","title":"522: Zenbleed Foot Shooting","url":"https://www.bsdnow.tv/522","content_text":"Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nTop Ten Reasons to Upgrade to FreeBSD 13.2\n\n\n\nHistory never repeats but sometimes it rhymes\n\n\n\nNews Roundup\n\nWayland on OpenBSD\n\n\n\nOpenBGPD 8.1 released\n\n\n\nShoot yourself in the foot\n\n\n\nZenbleed: aka : The new fun for a while\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nIan - about dozing off when listening\nNixbytes  - news on netbsd\nPhillip - Questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\nJoin us and other BSD Fans in our BSD Now Telegram channel\n***\n","content_html":"<p>Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/top-ten-reasons-to-upgrade-to-freebsd-13-2/\" rel=\"nofollow\">Top Ten Reasons to Upgrade to FreeBSD 13.2</a></h3>\n\n<hr>\n\n<h3><a href=\"https://ciq.com/blog/history-never-repeats-but-sometimes-it-rhymes/\" rel=\"nofollow\">History never repeats but sometimes it rhymes</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://xenocara.org/Wayland_on_OpenBSD.html\" rel=\"nofollow\">Wayland on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230713110230\" rel=\"nofollow\">OpenBGPD 8.1 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://g-w1.github.io/blog/observation/2023/07/08/shoot-yourself-in-the-foot.html\" rel=\"nofollow\">Shoot yourself in the foot</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20230724224011\" rel=\"nofollow\">Zenbleed: aka : The new fun for a while</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Ian%20-%20about%20dozing%20off%20when%20listening.md\" rel=\"nofollow\">Ian - about dozing off when listening</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Nixbytes%20%20-%20news%20on%20netbsd.md\" rel=\"nofollow\">Nixbytes  - news on netbsd</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/522/feedback/Phillip%20-%20Questions.md\" rel=\"nofollow\">Phillip - Questions</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n<li>Join us and other BSD Fans in our <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">BSD Now Telegram channel</a>\n***</li>\n</ul>","summary":"Top Ten Reasons to Upgrade to FreeBSD 13.2, History never repeats but sometimes it rhymes, Wayland on OpenBSD, OpenBGPD 8.1 released, Shoot yourself in the foot, Zenbleed: aka: The new fun for a while, and more","date_published":"2023-08-31T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/eb9e39c2-564c-4286-b1dd-e1d57a331f87.mp3","mime_type":"audio/mpeg","size_in_bytes":46507008,"duration_in_seconds":2906}]},{"id":"533fcb2a-376e-4f26-9d0d-4fa57da1ced4","title":"521: BSD Summer Reading","url":"https://www.bsdnow.tv/521","content_text":"FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on 'su -', hints for splitting commits, Live from OpenBSD in Amsterdam, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Status Report Second Quarter 2023\n\n\n\nOur 2023 Recommended Summer Reads 2023\n\n\n\nNews Roundup\n\nHow to install Kanboard on OpenBSD\n\n\n\nA bit of Unix history on 'su -'\n\n\n\nSome hints for splitting commits\n\n\n\nLive from OpenBSD in Amsterdam\n\n\n\nIn memoriam\n\nIn Memoriam: Hans Petter William Sirevåg Selasky\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAgbo - Using BSD for a business\nChris - Desktop BSD systems\nDane - Use another OS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on &#39;su -&#39;, hints for splitting commits, Live from OpenBSD in Amsterdam, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2023-04-2023-06/\" rel=\"nofollow\">FreeBSD Status Report Second Quarter 2023</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/our-2023-recommended-summer-reads-freebsd-and-linux/\" rel=\"nofollow\">Our 2023 Recommended Summer Reads 2023</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-07-07-kanboard-on-openbsd.html\" rel=\"nofollow\">How to install Kanboard on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SuDashHistory\" rel=\"nofollow\">A bit of Unix history on &#39;su -&#39;</a></h3>\n\n<hr>\n\n<h3><a href=\"http://bsdimp.blogspot.com/2023/07/some-hints-for-splitting-commits.html\" rel=\"nofollow\">Some hints for splitting commits</a></h3>\n\n<hr>\n\n<h3><a href=\"https://michal.sapka.me/2023/moved-to-openbsd/\" rel=\"nofollow\">Live from OpenBSD in Amsterdam</a></h3>\n\n<hr>\n\n<h2>In memoriam</h2>\n\n<p><a href=\"https://forums.freebsd.org/threads/in-memoriam-hans-petter-william-sirevag-selasky.89697/#post-616627\" rel=\"nofollow\">In Memoriam: Hans Petter William Sirevåg Selasky</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Agbo%20-%20Using%20BSD%20for%20a%20business.md\" rel=\"nofollow\">Agbo - Using BSD for a business</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Chris%20-%20Desktop%20BSD%20systems.md\" rel=\"nofollow\">Chris - Desktop BSD systems</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/521/feedback/Dane%20-%20Use%20another%20OS.md\" rel=\"nofollow\">Dane - Use another OS</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Status Report Q2 2023, Klara Systems Recommended Summer Reads 2023, install Kanboard on OpenBSD howto, A bit of Unix history on 'su -', hints for splitting commits, Live from OpenBSD in Amsterdam, and more","date_published":"2023-08-24T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/533fcb2a-376e-4f26-9d0d-4fa57da1ced4.mp3","mime_type":"audio/mpeg","size_in_bytes":54731520,"duration_in_seconds":3420}]},{"id":"c4abf3ee-9d63-4f0a-bc8d-ea10b203a9e0","title":"520: 4 months BSD","url":"https://www.bsdnow.tv/520","content_text":"4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n4 Months of BSD\n\n\n\nSelf Hosted Calendar and address Book\n\n\n\nNews Roundup\n\nBan scanners IPs from OpenSMTP logs\n\n\n\nSelf-hosted git page with stagit (featuring ed, the standard editor)\n\n\n\nBastille template example\n\n\n\nNginx: How to Restrict Access by Geographical Location on FreeBSD\n\n\n\nBeastie Bits\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChris - ARM\nMatthew - Groups\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://danterobinson.dev/BSD/4MonthsofBSD\" rel=\"nofollow\">4 Months of BSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2023/self-hosted-calendar-and-addressbook-services-on-openbsd/\" rel=\"nofollow\">Self Hosted Calendar and address Book</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-06-22-opensmtpd-block-attempts.html\" rel=\"nofollow\">Ban scanners IPs from OpenSMTP logs</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sebastiano.tronto.net/blog/2022-11-23-git-host/\" rel=\"nofollow\">Self-hosted git page with stagit (featuring ed, the standard editor)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/\" rel=\"nofollow\">Bastille template example</a></h3>\n\n<hr>\n\n<h3><a href=\"https://herrbischoff.com/2021/05/nginx-how-to-restrict-access-by-geographical-location-on-freebsd/\" rel=\"nofollow\">Nginx: How to Restrict Access by Geographical Location on FreeBSD</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/Chris%20-%20arm.md\" rel=\"nofollow\">Chris - ARM</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/520/feedback/matthew%20-%20groups.md\" rel=\"nofollow\">Matthew - Groups</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"4 Months of BSD, Self Hosted Calendar and address Book, Ban scanners IPs from OpenSMTP logs, Self-hosted git page, Bastille template example, Restrict nginx Access by Geographical Location on FreeBSD, and more.","date_published":"2023-08-17T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c4abf3ee-9d63-4f0a-bc8d-ea10b203a9e0.mp3","mime_type":"audio/mpeg","size_in_bytes":41702784,"duration_in_seconds":2606}]},{"id":"5d5025dc-47c7-48f4-9da6-d5fee456b1de","title":"519: Telegram from BSDNow","url":"https://www.bsdnow.tv/519","content_text":"3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n3 Advantages to Running FreeBSD as Your Server Operating System\n\n\n\nFreeBSD 14 Release Schedule\n\n\n\nNews Roundup\n\nStream your OpenBSD desktop audio to other devices\n\n\n\nDOD KSOS Secure UNIX Operating System Manual and Final Report\n\n\n\nHow to limit bandwidth usage with SCP transfers\n\n\n\nBeastie Bits\n\n\nOpenSolaris 11.4 running in a VM\nCelebrating 30 Years of FreeBSD – FreeBSD Journal Special Edition\nSome ways you can contribute to open source software without writing code\n\n\nScreenCapture if you don't have a twitter account\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nNew BSD Now Telegram Channel\n\n\nWe now have a new BSD Now Telegram channel that anyone can join.  Conversations don’t have to just be about the show, anything BSD, Unix, or *nix in general is fair game. https://t.me/bsdnow\n\n\nFeedback/Questions\n\n\nJohnny - 512\nMatthew - 512\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-3-advantages-to-running-freebsd-as-your-server-operating-system/\" rel=\"nofollow\">3 Advantages to Running FreeBSD as Your Server Operating System</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.freebsd.org/releases/14.0R/\" rel=\"nofollow\">FreeBSD 14 Release Schedule</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html\" rel=\"nofollow\">Stream your OpenBSD desktop audio to other devices</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tuhs.org/pipermail/tuhs/2023-June/028441.html\" rel=\"nofollow\">DOD KSOS Secure UNIX Operating System Manual and Final Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://herrbischoff.com/2023/03/how-to-limit-bandwidth-usage-for-scp-transfers/\" rel=\"nofollow\">How to limit bandwidth usage with SCP transfers</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.reddit.com/r/unix/comments/14m90v2/oracle_solaris_114_running_in_a_virtual_machine/\" rel=\"nofollow\">OpenSolaris 11.4 running in a VM</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/celebrating-30-years-of-freebsd-freebsd-journal-special-edition/\" rel=\"nofollow\">Celebrating 30 Years of FreeBSD – FreeBSD Journal Special Edition</a></li>\n<li><a href=\"https://twitter.com/cperciva/status/1673215499365384194?s=52&t=-_bfM_adaiX8Ri_3lN9OYw\" rel=\"nofollow\">Some ways you can contribute to open source software without writing code</a>\n\n<ul>\n<li><a href=\"https://i.imgur.com/5AlqBlO.png\" rel=\"nofollow\">ScreenCapture if you don&#39;t have a twitter account</a></li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h3>New BSD Now Telegram Channel</h3>\n\n<ul>\n<li>We now have a new BSD Now Telegram channel that anyone can join.  Conversations don’t have to just be about the show, anything BSD, Unix, or *nix in general is fair game. <a href=\"https://t.me/bsdnow\" rel=\"nofollow\">https://t.me/bsdnow</a></li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Johnny%20-%20512.md\" rel=\"nofollow\">Johnny - 512</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/519/feedback/Matthew%20-%20512.md\" rel=\"nofollow\">Matthew - 512</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"3 Advantages to Running FreeBSD as Your Server OS, FreeBSD 14 Release Schedule, Stream your OpenBSD desktop audio, DOD KSOS Secure UNIX Operating System Manual, How to limit bandwidth usage with SCP transfers, and more.","date_published":"2023-08-10T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5d5025dc-47c7-48f4-9da6-d5fee456b1de.mp3","mime_type":"audio/mpeg","size_in_bytes":35925120,"duration_in_seconds":2245}]},{"id":"a8dc2e06-ce32-4c8c-a282-35950bee26fc","title":"518: Unix Edition Zero","url":"https://www.bsdnow.tv/518","content_text":"A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nA Guide to Problem-Solving for Software Developers with Examples\n\n\n\nMaking 20% time work\n\n\n\nNews Roundup\n\nLong live netbooks!\n\n\n\nOpenBSD Router on Sg105w\n\n\n\nFreeBSD: How to Set Up a Simple and Actually Working Wireguard Server\n\n\n\nHow to be a -10x Engineer\n\n\n\nUnix Edition Zero\n\n\n\nBeastie Bits\n\n\nGame of Trees 0.90 released\nZFSp\n\n\n\nTarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://thevaluable.dev/problem_solving_guide_software_developer\" rel=\"nofollow\">A Guide to Problem-Solving for Software Developers with Examples</a></h3>\n\n<hr>\n\n<h3><a href=\"https://begriffs.com/posts/2016-01-29-making-twenty-percent-time-work.html\" rel=\"nofollow\">Making 20% time work</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://sebastiano.tronto.net/blog/2022-09-10-netbooks/\" rel=\"nofollow\">Long live netbooks!</a></h3>\n\n<hr>\n\n<h3><a href=\"https://evolving-architecture.eu/openbsd-router-sg105w/\" rel=\"nofollow\">OpenBSD Router on Sg105w</a></h3>\n\n<hr>\n\n<h3><a href=\"https://herrbischoff.com/2023/04/freebsd-how-to-set-up-a-simple-and-actually-working-wireguard-server/\" rel=\"nofollow\">FreeBSD: How to Set Up a Simple and Actually Working Wireguard Server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://taylor.town/-10x\" rel=\"nofollow\">How to be a -10x Engineer</a></h3>\n\n<hr>\n\n<h3><a href=\"http://doc.cat-v.org/unix/v0/\" rel=\"nofollow\">Unix Edition Zero</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><p><a href=\"https://undeadly.org/cgi?action=article;sid=20230624054334\" rel=\"nofollow\">Game of Trees 0.90 released</a></p></li>\n<li><p><a href=\"https://github.com/alcarithemad/zfsp\" rel=\"nofollow\">ZFSp</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3></li>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"A Guide to Problem-Solving for Software Developers with Examples, making 20% time work, Long Live Netbooks, OpenBSD Router on Sg105w, Set Up a Simple and Actually Working Wireguard Server, Unix Edition Zero, how to be a -10x engineer, and more","date_published":"2023-08-03T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a8dc2e06-ce32-4c8c-a282-35950bee26fc.mp3","mime_type":"audio/mpeg","size_in_bytes":54445440,"duration_in_seconds":3402}]},{"id":"d8d9cac6-5c23-4f07-b6ad-253890b79d72","title":"517: Huge pfsync rewrite","url":"https://www.bsdnow.tv/517","content_text":"Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nLinux and FreeBSD Firewalls – The Ultimate Guide - Part 2\n\n\n\n27 Years with the Perfect OS\n\n\n\n\n\nNews Roundup\n\nTop 20 OpenSSH Server Best Security Practices\n\n\n\nHuge pfsync rewrite\n\n\n\nOpenSMTPD 7.3.0p1 released\n\n\n\nRunning OpenBSD 7.3 on your laptop is really hard (not)\n\n\n\nQuicSSH\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls-part-2/\" rel=\"nofollow\">Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2</a></h3>\n\n<hr>\n\n<h3><a href=\"https://peter.czanik.hu/posts/freebsd-the-perfect-os/\" rel=\"nofollow\">27 Years with the Perfect OS</a></h3>\n\n<hr>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html\" rel=\"nofollow\">Top 20 OpenSSH Server Best Security Practices</a></h3>\n\n<hr>\n\n<h3><a href=\"https://marc.info/?l=openbsd-tech&m=168732121711177&w=2\" rel=\"nofollow\">Huge pfsync rewrite</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.mail-archive.com/misc@opensmtpd.org/msg05909.html\" rel=\"nofollow\">OpenSMTPD 7.3.0p1 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sohcahtoa.org.uk/openbsd.html\" rel=\"nofollow\">Running OpenBSD 7.3 on your laptop is really hard (not)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/moul/quicssh\" rel=\"nofollow\">QuicSSH</a></h3>\n\n<hr>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more","date_published":"2023-07-27T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d8d9cac6-5c23-4f07-b6ad-253890b79d72.mp3","mime_type":"audio/mpeg","size_in_bytes":44959104,"duration_in_seconds":2809}]},{"id":"c8e97371-fb6b-48dc-97fe-8de45cd0e49c","title":"516: Computer Time Origins","url":"https://www.bsdnow.tv/516","content_text":"Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nLinux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1\n\n\n\nWhy Netflix Chose NGINX as the Heart of Its CDN\n\n\n\nNews Roundup\n\nFreeBSD: Protect your web servers against PHP shells and malwares\n\n\n\nHowTo: Installing and running Gitlab\n\n\n\nBeastie Bits\n\n• [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/)\n• [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html)\n• [Organized Freebies](https://mwl.io/archives/22832)\n• [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340)\n• [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255)\n• [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\n\n\nFeedback/Questions\n\n\nsam - fav episodes\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls/\" rel=\"nofollow\">Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.nginx.com/blog/why-netflix-chose-nginx-as-the-heart-of-its-cdn/\" rel=\"nofollow\">Why Netflix Chose NGINX as the Heart of Its CDN</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://ozgurkazancci.com/freebsd-protect-your-web-server-against-php-shells-and-malwares/\" rel=\"nofollow\">FreeBSD: Protect your web servers against PHP shells and malwares</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/howto-installing-and-running-gitlab.89436/\" rel=\"nofollow\">HowTo: Installing and running Gitlab</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/)\n• [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html)\n• [Organized Freebies](https://mwl.io/archives/22832)\n• [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340)\n• [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255)\n• [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/sam%20-%20fav%20episodes.md\" rel=\"nofollow\">sam - fav episodes</a></li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more","date_published":"2023-07-20T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8e97371-fb6b-48dc-97fe-8de45cd0e49c.mp3","mime_type":"audio/mpeg","size_in_bytes":44272128,"duration_in_seconds":2767}]},{"id":"cfdb4845-82f8-4698-8b0a-0eddc33e66a8","title":"515: ChatGPT writing pf.conf","url":"https://www.bsdnow.tv/515","content_text":"FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nLinux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars\n\n\n\nThe Computer Scientist Who Can’t Stop Telling Stories\n\n\n\nI asked ChatGPT to write a pf.conf to spec, 2023-06-07 version\n\n\n\nNews Roundup\n\nGhostBSD 23.06.1 is now available\n\n\n\nOPNsense 23.1.9 released\n\n\n\nRunning VSCode in Chromium on OpenBSD\n\n\n\nCOFF: Bell Labs vs \"East Coast\" Management style of AT&amp;T\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMatt - Wireguard\nOscar - ISC.md\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/choosing-between-freebsd-and-linux-a-choice-without-os-wars/\" rel=\"nofollow\">Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.quantamagazine.org/computer-scientist-donald-knuth-cant-stop-telling-stories-20200416/\" rel=\"nofollow\">The Computer Scientist Who Can’t Stop Telling Stories</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdly.blogspot.com/2023/06/i-asked-chatgpt-to-write-pfconf-to-spec.html\" rel=\"nofollow\">I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://ghostbsd.org/23.06.01_iso_is_now_available\" rel=\"nofollow\">GhostBSD 23.06.1 is now available</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forum.opnsense.org/index.php?topic=34282.0\" rel=\"nofollow\">OPNsense 23.1.9 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bt.ht/vscode/\" rel=\"nofollow\">Running VSCode in Chromium on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tuhs.org/pipermail/coff/2023-May/001556.html\" rel=\"nofollow\">COFF: Bell Labs vs &quot;East Coast&quot; Management style of AT&amp;T</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Matt%20-%20Wiregaurd.md\" rel=\"nofollow\">Matt - Wireguard</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Oscar%20-%20ISC.md\" rel=\"nofollow\">Oscar - ISC.md</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more","date_published":"2023-07-13T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cfdb4845-82f8-4698-8b0a-0eddc33e66a8.mp3","mime_type":"audio/mpeg","size_in_bytes":38652288,"duration_in_seconds":2415}]},{"id":"1ad867e2-c191-48e0-88e0-8c42831d40c7","title":"514: Infecting Public Keys","url":"https://www.bsdnow.tv/514","content_text":"OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer \"how to become a systems engineer\", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS, Your Data and the Challenge of Ransomware\n\n\n\nI Didn’t Learn Unix By Reading All The Manpages\n\n\n\nNews Roundup\n\nFeedback: I try to answer \"how to become a systems engineer\"\n\n\n\nWriting shell scripts in Nushell\n\n\n\nSudo and signal propagation\n\n\n\nInfecting SSH Public Keys with backdoors\n\n\n\nOpenBSD Thinkpad\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer &quot;how to become a systems engineer&quot;, Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-openzfs-your-data-and-the-challenge-of-ransomware/\" rel=\"nofollow\">OpenZFS, Your Data and the Challenge of Ransomware</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.owlfolio.org/research/i-didnt-learn-unix-by-reading-all-the-manpages/\" rel=\"nofollow\">I Didn’t Learn Unix By Reading All The Manpages</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rachelbythebay.com/w/2023/05/30/eng/\" rel=\"nofollow\">Feedback: I try to answer &quot;how to become a systems engineer&quot;</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jpospisil.com/2023/05/25/writing-shell-scripts-in-nushell\" rel=\"nofollow\">Writing shell scripts in Nushell</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dxuuu.xyz/sudo.html\" rel=\"nofollow\">Sudo and signal propagation</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.thc.org/infecting-ssh-public-keys-with-backdoors\" rel=\"nofollow\">Infecting SSH Public Keys with backdoors</a></h3>\n\n<hr>\n\n<h3><a href=\"https://douglasrumbaugh.com/post/openbsd-thinkpad-good/\" rel=\"nofollow\">OpenBSD Thinkpad</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer \"how to become a systems engineer\", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more","date_published":"2023-07-06T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1ad867e2-c191-48e0-88e0-8c42831d40c7.mp3","mime_type":"audio/mpeg","size_in_bytes":46575744,"duration_in_seconds":2910}]},{"id":"46ee8a53-e46a-4e48-a99e-bb347c35e8e0","title":"513: New Host Interview","url":"https://www.bsdnow.tv/513","content_text":"We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHost Introductions - Jason Tubnor - https://www.tubsta.com / @tubsta / @Tubsta@soc.feditime.com\n\n\n\nHeadlines\n\nUnderstanding ZFS vdev Types\n\n\n\nDon't abuse su for dropping user privileges\n\n\n\nNews Roundup\n\nDynamic Tracing on OpenBSD 7.3\n\n\n\nnew Libressl\n\n\n\nManual Jails on FreeBSD 12\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChris - questions\nDan - zfs questions\nPablo - Jail question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>We have a new show host, Understanding ZFS vdev Types, Don&#39;t abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Host Introductions - Jason Tubnor - <a href=\"https://www.tubsta.com\" rel=\"nofollow\">https://www.tubsta.com</a> / <a href=\"https://twitter.com/tubsta\" rel=\"nofollow\">@tubsta</a> / <a href=\"https://soc.feditime.com\" rel=\"nofollow\">@Tubsta@soc.feditime.com</a></h2>\n\n<hr>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-understanding-zfs-vdev-types/\" rel=\"nofollow\">Understanding ZFS vdev Types</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jdebp.uk/FGA/dont-abuse-su-for-dropping-privileges.html\" rel=\"nofollow\">Don&#39;t abuse su for dropping user privileges</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.lambda.cx/posts/openbsd-dynamic-tracing/\" rel=\"nofollow\">Dynamic Tracing on OpenBSD 7.3</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20230528115900\" rel=\"nofollow\">new Libressl</a></h3>\n\n<hr>\n\n<h3><a href=\"https://ogris.de/howtos/freebsd-jails.html\" rel=\"nofollow\">Manual Jails on FreeBSD 12</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Chris%20-%20questions.md\" rel=\"nofollow\">Chris - questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Dan%20-%20zfs%20questions.md\" rel=\"nofollow\">Dan - zfs questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Pablo%20-%20Jail%20question.md\" rel=\"nofollow\">Pablo - Jail question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more","date_published":"2023-06-29T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/46ee8a53-e46a-4e48-a99e-bb347c35e8e0.mp3","mime_type":"audio/mpeg","size_in_bytes":51267072,"duration_in_seconds":3204}]},{"id":"0c162628-7d5f-4c53-9637-be1b27ddafe2","title":"512: BSDNow Live! 9 bits of BSDNow - Just speak into the goat","url":"https://www.bsdnow.tv/512","content_text":"Recorded at BSDCan 2023\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nBSDNow - The early years\n\n\n\nBSDNow - Production Process\n\n\n\nNews Roundup\n\nFreeBSD Devsummit\n\n\n\nBSDCan\n\n\n\nBeastie Bits\n\n\n How you can help the show!\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nCorey asks - what is the status of netbsd 10?\nHow have things changed in the bsds over the history of the show?\n\n\nAnnouncement\n\nAs a final thing Allan would like to make an announcement:\n\n\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n","content_html":"<p>Recorded at BSDCan 2023</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3>BSDNow - The early years</h3>\n\n<hr>\n\n<h2>BSDNow - Production Process</h2>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3>FreeBSD Devsummit</h3>\n\n<hr>\n\n<h3>BSDCan</h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li> How you can help the show!</li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Corey asks - what is the status of netbsd 10?</li>\n<li>How have things changed in the bsds over the history of the show?</li>\n</ul>\n\n<h2>Announcement</h2>\n\n<p>As a final thing Allan would like to make an announcement:</p>\n\n<hr>\n\n<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></h2>\n\n<hr>","summary":"Recorded at BSDCan 2023","date_published":"2023-06-22T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0c162628-7d5f-4c53-9637-be1b27ddafe2.mp3","mime_type":"audio/mpeg","size_in_bytes":38973696,"duration_in_seconds":2435}]},{"id":"6b99d11c-2ee7-450e-8446-d0ceed9be7b1","title":"511: Against Innovation","url":"https://www.bsdnow.tv/511","content_text":"Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOf Sun Ray laptops, MIPS and getting root on them\n\n\n\nOpenZFS for HPC Clusters\n\n\n\nNews Roundup\n\nSelf-Hosted Bookmarks using DAV and httpd on OpenBSD\n\n\n\nTerraform + Proxmox + OpenBSD = &lt;3\n\n\n\nWOL Plex Server\n\n\n\nAgainst Innovation\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://oldvcr.blogspot.com/2023/04/of-sun-ray-laptops-mips-and-getting.html\" rel=\"nofollow\">Of Sun Ray laptops, MIPS and getting root on them</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-openzfs-for-hpc-clusters/\" rel=\"nofollow\">OpenZFS for HPC Clusters</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.tumfatig.net/2023/self-hosted-bookmarks-using-dav-and-httpd-on-openbsd/\" rel=\"nofollow\">Self-Hosted Bookmarks using DAV and httpd on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://x61.sh/log/2023/05/19052023172439-terraform_proxmox_openbsd.html\" rel=\"nofollow\">Terraform + Proxmox + OpenBSD = &lt;3</a></h3>\n\n<hr>\n\n<h3><a href=\"https://maximiliangolla.com/blog/2022-10-wol-plex-server/\" rel=\"nofollow\">WOL Plex Server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dadadrummer.substack.com/p/against-innovation\" rel=\"nofollow\">Against Innovation</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = <3, WOL Plex Server, Against innovation, and more","date_published":"2023-06-15T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6b99d11c-2ee7-450e-8446-d0ceed9be7b1.mp3","mime_type":"audio/mpeg","size_in_bytes":48869760,"duration_in_seconds":3054}]},{"id":"41751de6-aa32-4cde-8fde-ea62d98b6a4d","title":"510: The BSD Slabtop","url":"https://www.bsdnow.tv/510","content_text":"AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its \"Secret Place\", ttyload, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAsiaBSDCon 2023 Trip Report\n\n\n\nConverting My X201 ThinkPad into a Slabtop\n\n\n\nNews Roundup\n\nStream your OpenBSD desktop audio to other devices\n\n\n\nThe Gnome and Its \"Secret Place\"\n\n\n\nttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal\n\n\n\nBeastie Bits\n\n• [OpenIndiana with a Sun Microsystems 22\" LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/)\n• [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly)\n• [BSDCan 2024 Reorganization](https://mwl.io/archives/22799)\n• [Depenguin me](https://depenguin.me/)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its &quot;Secret Place&quot;, ttyload, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/asiabsdcon-2023-trip-report/\" rel=\"nofollow\">AsiaBSDCon 2023 Trip Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bt.ht/slabtop/\" rel=\"nofollow\">Converting My X201 ThinkPad into a Slabtop</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html\" rel=\"nofollow\">Stream your OpenBSD desktop audio to other devices</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tuhs.org/pipermail/tuhs/2023-May/028363.html\" rel=\"nofollow\">The Gnome and Its &quot;Secret Place&quot;</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/open-source/command-line-hacks/ttyload-color-coded-graphical-tracking-tool-for-unixlinux-load-average-in-a-terminal/\" rel=\"nofollow\">ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [OpenIndiana with a Sun Microsystems 22&quot; LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/)\n• [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly)\n• [BSDCan 2024 Reorganization](https://mwl.io/archives/22799)\n• [Depenguin me](https://depenguin.me/)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its \"Secret Place\", ttyload, and more","date_published":"2023-06-08T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/41751de6-aa32-4cde-8fde-ea62d98b6a4d.mp3","mime_type":"audio/mpeg","size_in_bytes":44800896,"duration_in_seconds":2800}]},{"id":"6676cfbb-7251-455d-846c-94eb3e6e5c32","title":"509: Dot File Naming","url":"https://www.bsdnow.tv/509","content_text":"Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance\n\n\n\nInstall OpenBSD as a VM\n\n\n\nNews Roundup\n\nSet up your own CalDAV and CardDAV servers on OpenBSD\n\n\n\nHow to display basic computer information using DMI table decoder\n\n\n\nGpart CheatSheet - wiping drives, partitioning, &amp; formating\n\n\n\nRob Pike on the Origin of Unix Dot File Names\n\n\n\nBeastie Bits\n\n\nHackerstations\n\n\nMike McQuaid's clean, ergonomic setup in Edinburgh, Scotland\nDaniel Stenberg and the home of curl in Stockholm, Sweden\n\nviogpu(4), a VirtIO GPU driver, added to -current\nOpenBGPD 8.0 released\ncron(8) now supports random ranges with steps\nmalloc leak detection available in -current\nvmd(8) moves to a multi-process model\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-leveraging-openzfs-to-build-your-own-storage-appliance/\" rel=\"nofollow\">OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance</a></h3>\n\n<hr>\n\n<h3><a href=\"https://byte-sized.de/linux-unix/openbsd-als-vm-installieren/#english\" rel=\"nofollow\">Install OpenBSD as a VM</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2023-04-23-calendar-and-contacts-with-radicale.html\" rel=\"nofollow\">Set up your own CalDAV and CardDAV servers on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sleeplessbeastie.eu/2023/03/31/how-to-display-basic-computer-information-using-dmi-table-decoder/\" rel=\"nofollow\">How to display basic computer information using DMI table decoder</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/gpart-cheatsheet-wiping-drives-partitioning-formating.45411\" rel=\"nofollow\">Gpart CheatSheet - wiping drives, partitioning, &amp; formating</a></h3>\n\n<hr>\n\n<h3><a href=\"http://xahlee.info/UnixResource_dir/writ/unix_origin_of_dot_filename.html\" rel=\"nofollow\">Rob Pike on the Origin of Unix Dot File Names</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li>Hackerstations\n\n<ul>\n<li><a href=\"https://hackerstations.com/setups/mike_mcquaid/\" rel=\"nofollow\">Mike McQuaid&#39;s clean, ergonomic setup in Edinburgh, Scotland</a></li>\n<li><a href=\"https://hackerstations.com/setups/daniel_stenberg/\" rel=\"nofollow\">Daniel Stenberg and the home of curl in Stockholm, Sweden</a></li>\n</ul></li>\n<li><p><a href=\"http://undeadly.org/cgi?action=article;sid=20230421124221\" rel=\"nofollow\">viogpu(4), a VirtIO GPU driver, added to -current</a></p></li>\n<li><p><a href=\"http://undeadly.org/cgi?action=article;sid=20230505054214\" rel=\"nofollow\">OpenBGPD 8.0 released</a></p></li>\n<li><p><a href=\"http://undeadly.org/cgi?action=article;sid=20230507122935\" rel=\"nofollow\">cron(8) now supports random ranges with steps</a></p></li>\n<li><p><a href=\"http://undeadly.org/cgi?action=article;sid=20230417074903\" rel=\"nofollow\">malloc leak detection available in -current</a></p></li>\n<li><p><a href=\"https://www.undeadly.org/cgi?action=article;sid=20230430051250\" rel=\"nofollow\">vmd(8) moves to a multi-process model</a></p></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more","date_published":"2023-06-01T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6676cfbb-7251-455d-846c-94eb3e6e5c32.mp3","mime_type":"audio/mpeg","size_in_bytes":39585792,"duration_in_seconds":2474}]},{"id":"def7d8d8-31e8-4874-bbe5-dd25729dd001","title":"508: Foundational Proceedings","url":"https://www.bsdnow.tv/508","content_text":"FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more\n\nNOTES**\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Foundation Welcomes New Team Members\n\n\n\nWhat Makes OpenZFS the Ideal Storage Solution for University Environments\n\n\n\nNews Roundup\n\nSCaLE20X Conference Report\n\n\n\n916 days of Emacs\n\n\n\nXTerm: It's Better Than You Thought\n\n\n\nNetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAdrian - Tilde\nDan - Root Shell\nFlorian - Salt Extension\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It&#39;s Better Than You Thought, NetBSD Annual General Meeting 2023, and more</p>\n\n<p><em>NOTES</em>**<br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-team-members/\" rel=\"nofollow\">FreeBSD Foundation Welcomes New Team Members</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-what-makes-openzfs-the-ideal-storage-solution-for-university-environments//\" rel=\"nofollow\">What Makes OpenZFS the Ideal Storage Solution for University Environments</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/scale20x-conference-report/\" rel=\"nofollow\">SCaLE20X Conference Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sqrtminusone.xyz/posts/2023-04-13-emacs/\" rel=\"nofollow\">916 days of Emacs</a></h3>\n\n<hr>\n\n<h3><a href=\"https://aduros.com/blog/xterm-its-better-than-you-thought/\" rel=\"nofollow\">XTerm: It&#39;s Better Than You Thought</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mail-index.netbsd.org/netbsd-announce/2023/05/05/msg000348.html\" rel=\"nofollow\">NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Adrian%20-%20Tilde.md\" rel=\"nofollow\">Adrian - Tilde</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Dan%20-%20Root%20Shell.md\" rel=\"nofollow\">Dan - Root Shell</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Florian%20-%20Salt%20Extension.md\" rel=\"nofollow\">Florian - Salt Extension</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more","date_published":"2023-05-25T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/def7d8d8-31e8-4874-bbe5-dd25729dd001.mp3","mime_type":"audio/mpeg","size_in_bytes":39443712,"duration_in_seconds":2465}]},{"id":"188e3b3f-dc07-43ba-aa49-de8223858ead","title":"507: Michael W. Lucas Interview","url":"https://www.bsdnow.tv/507","content_text":"Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterview - Michael W. Lucas - mwl@mwl.io\n\nOpenBSD Mastery Filesystems\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\nSpecial Guest: Michael W Lucas.","content_html":"<p>Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interview - Michael W. Lucas - <a href=\"mailto:mwl@mwl.io\" rel=\"nofollow\">mwl@mwl.io</a></h2>\n\n<p>OpenBSD Mastery Filesystems</p>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n</ul>\n\n<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></h2>\n\n<hr><p>Special Guest: Michael W Lucas.</p>","summary":"Author Michael W. Lucas joins us in this interview to talk about his latest book projects. Find out what he’s up to regarding mail servers, conferences, his views on ChatGPT, and more.","date_published":"2023-05-18T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/188e3b3f-dc07-43ba-aa49-de8223858ead.mp3","mime_type":"audio/mpeg","size_in_bytes":56347776,"duration_in_seconds":3521}]},{"id":"a130428b-d80d-45a3-a07b-e7b6ce4b3565","title":"506: A greener BSD","url":"https://www.bsdnow.tv/506","content_text":"Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nComparing Modern Open-Source Storage Solutions OpenZFS vs. The Rest\n\n\n\nFreeBSD Q1 Status Report\n\n\n\nNews Roundup\n\nHello Systems 0.8.1 Release\n\n\n\nOpenBSD: Managing an inverter/converter with NUT\n\n\n\nCelebrating Earth Day: Tips for Running a Greener FreeBSD\n\n\n\nBSDCAN Registration\n\n\n\nBeastie Bits\n\n• [SimCity 2000 running on OpenBSD 7.3 via DOSBox 0.74-3](https://www.reddit.com/r/openbsd_gaming/comments/12k9zt2/simcity_2000_running_on_openbsd_73_via_dosbox_0743/)\n• [OpenBSD Webzine #13](https://webzine.puffy.cafe/issue-13.html)\n• [AWS Gazo bot](https://github.com/csaltos/aws-gazo-bot)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-comparing-modern-open-source-storage-solutions/\" rel=\"nofollow\">Comparing Modern Open-Source Storage Solutions OpenZFS vs. The Rest</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2023-01-2023-03/\" rel=\"nofollow\">FreeBSD Q1 Status Report</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/helloSystem/ISO/releases/tag/r0.8.1\" rel=\"nofollow\">Hello Systems 0.8.1 Release</a></h3>\n\n<hr>\n\n<h3><a href=\"https://doc.huc.fr.eu.org/en/sys/openbsd/nut/\" rel=\"nofollow\">OpenBSD: Managing an inverter/converter with NUT</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/celebrating-earth-day-tips-for-running-a-greener-freebsd/\" rel=\"nofollow\">Celebrating Earth Day: Tips for Running a Greener FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.bsdcan.org/2023/registration.php\" rel=\"nofollow\">BSDCAN Registration</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [SimCity 2000 running on OpenBSD 7.3 via DOSBox 0.74-3](https://www.reddit.com/r/openbsd_gaming/comments/12k9zt2/simcity_2000_running_on_openbsd_73_via_dosbox_0743/)\n• [OpenBSD Webzine #13](https://webzine.puffy.cafe/issue-13.html)\n• [AWS Gazo bot](https://github.com/csaltos/aws-gazo-bot)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Comparing Modern Open-Source Storage Solutions, FreeBSD Q1 Status Report, Hello Systems 0.8.1 Release, OpenBSD: Managing an inverter/converter with NUT, Tips for Running a Greener FreeBSD, BSDCAN Registration open","date_published":"2023-05-11T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a130428b-d80d-45a3-a07b-e7b6ce4b3565.mp3","mime_type":"audio/mpeg","size_in_bytes":20222232,"duration_in_seconds":1924}]},{"id":"8f610dd8-0956-4f99-a9a6-e8c04036ad85","title":"505:  BSD Desktop Setup","url":"https://www.bsdnow.tv/505","content_text":"OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD 7.3 released\n\n\n\nBSDCan 2023 Schedule posted\n\n\n\nAccelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS\n\n\n\nNews Roundup\n\nFreeBSD – How to install Cinnamon as a Desktop environment\n\n\n\nxmonad FreeBSD set up from scratch\n\n\n\nBurgr books in your terminal\n\n\n\nPros and Cons of FreeBSD for virtual Servers\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nReese - Dans Interview\njj - looking for help\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230410140049\" rel=\"nofollow\">OpenBSD 7.3 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.bsdcan.org/events/bsdcan_2023/schedule/\" rel=\"nofollow\">BSDCan 2023 Schedule posted</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/accelerating-datacenter-energy-efficiency-by-leveraging-freebsd-as-your-server-os/\" rel=\"nofollow\">Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://byte-sized.de/linux-unix/freebsd-cinnamon-als-gui-installieren/#english\" rel=\"nofollow\">FreeBSD – How to install Cinnamon as a Desktop environment</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/xmonad-freebsd-set-up-from-scratch.75911/\" rel=\"nofollow\">xmonad FreeBSD set up from scratch</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blubsblog.bearblog.dev/burgr-books-in-your-terminal/\" rel=\"nofollow\">Burgr books in your terminal</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.hostzealot.com/blog/about-vps/pros-and-cons-of-freebsd-for-virtual-servers\" rel=\"nofollow\">Pros and Cons of FreeBSD for virtual Servers</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/Reese%20-%20Dans%20Interview.md\" rel=\"nofollow\">Reese - Dans Interview</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/505/feedback/jj%20-%20looking%20for%20help.md\" rel=\"nofollow\">jj - looking for help</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD 7.3 released, Accelerating Datacenter Energy Efficiency by Leveraging FreeBSD as Your Server OS, install Cinnamon as a Desktop environment, xmonad FreeBSD set up from scratch, Burgr books in your terminal, and more","date_published":"2023-05-04T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f610dd8-0956-4f99-a9a6-e8c04036ad85.mp3","mime_type":"audio/mpeg","size_in_bytes":28271616,"duration_in_seconds":1766}]},{"id":"2d02bfb1-4e33-4be1-8424-a707ddbeac55","title":"504: Release the BSD","url":"https://www.bsdnow.tv/504","content_text":"FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD 13.2 Release Announcement\n\n\n\nUsing DTrace to find block sizes of ZFS, NFS, and iSCSI\n\n\n\nNews Roundup\n\nMidnight BSD 3.0.1\n\n\n\nClosing a stale SSH connection\n\n\n\nHow to automatically add identity to the SSH authentication agent\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDan - ZFS question\nMatt - Thanks\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/13.2R/announce/\" rel=\"nofollow\">FreeBSD 13.2 Release Announcement</a></h3>\n\n<hr>\n\n<h3><a href=\"https://axcient.com/blog/using-dtrace-to-find-block-sizes-of-zfs-nfs-and-iscsi/\" rel=\"nofollow\">Using DTrace to find block sizes of ZFS, NFS, and iSCSI</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.phoronix.com/news/MidnightBSD-3.0.1\" rel=\"nofollow\">Midnight BSD 3.0.1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://davidisaksson.dev/posts/closing-stale-ssh-connections/\" rel=\"nofollow\">Closing a stale SSH connection</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sleeplessbeastie.eu/2023/04/10/how-to-automatically-add-identity-to-the-ssh-authentication-agent/\" rel=\"nofollow\">How to automatically add identity to the SSH authentication agent</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Dan%20-%20ZFS%20question.md\" rel=\"nofollow\">Dan - ZFS question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/504/feedback/Matt%20-%20Thanks.md\" rel=\"nofollow\">Matt - Thanks</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD 13.2 Release, Using DTrace to find block sizes of ZFS, NFS, and iSCSI, Midnight BSD 3.0.1, Closing a stale SSH connection, How to automatically add identity to the SSH authentication agent, Pros and Cons of FreeBSD for virtual Servers, and more","date_published":"2023-04-27T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2d02bfb1-4e33-4be1-8424-a707ddbeac55.mp3","mime_type":"audio/mpeg","size_in_bytes":34665600,"duration_in_seconds":2166}]},{"id":"4e4d0c93-21ee-44e3-9255-c64e7772ac5e","title":"503: Fast Unix Commands","url":"https://www.bsdnow.tv/503","content_text":"ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man's Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nZFS Optimization Success Stories\n\n\n\nLinux Namespaces Are a Poor Man's Plan 9 Namespaces\n\n\n\nNews Roundup\n\nWe need better support for SSH host certificates\n\n\n\nFast Unix Commands\n\n\n\nFascination with AWK\n\n\n\nBeastie Bits\n\n\n[Development environment updated and working])https://twitter.com/sweordbora/status/1618603990463438851?s=52&amp;t=GHrPlL6qZhIWo6u2Y5ie3g)\n[WIP] feat: add basic FreeBSD support on Kubelet](https://github.com/kubernetes/kubernetes/pull/115870)\nJar of Fortunes\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n","content_html":"<p>ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/zfs-optimization-success-stories/\" rel=\"nofollow\">ZFS Optimization Success Stories</a></h3>\n\n<hr>\n\n<h3><a href=\"https://yotam.net/posts/linux-namespaces-are-a-poor-mans-plan9-namespaces/\" rel=\"nofollow\">Linux Namespaces Are a Poor Man&#39;s Plan 9 Namespaces</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mjg59.dreamwidth.org/65874.html\" rel=\"nofollow\">We need better support for SSH host certificates</a></h3>\n\n<hr>\n\n<h3><a href=\"https://alexsaveau.dev/blog/projects/performance/files/fuc/fast-unix-commands\" rel=\"nofollow\">Fast Unix Commands</a></h3>\n\n<hr>\n\n<h3><a href=\"https://maximullaris.com/awk.html\" rel=\"nofollow\">Fascination with AWK</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li>[Development environment updated and working])<a href=\"https://twitter.com/sweordbora/status/1618603990463438851?s=52&t=GHrPlL6qZhIWo6u2Y5ie3g\" rel=\"nofollow\">https://twitter.com/sweordbora/status/1618603990463438851?s=52&amp;t=GHrPlL6qZhIWo6u2Y5ie3g</a>)</li>\n<li>[WIP] feat: add basic FreeBSD support on Kubelet](<a href=\"https://github.com/kubernetes/kubernetes/pull/115870\" rel=\"nofollow\">https://github.com/kubernetes/kubernetes/pull/115870</a>)</li>\n<li><a href=\"http://fortunes.cat-v.org/\" rel=\"nofollow\">Jar of Fortunes</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></h2>\n\n<hr>","summary":"ZFS Optimization Success Stories, Linux Namespaces Are a Poor Man's Plan 9 Namespaces, better support for SSH host certificates, Fast Unix Commands, Fascination with AWK, and more","date_published":"2023-04-20T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e4d0c93-21ee-44e3-9255-c64e7772ac5e.mp3","mime_type":"audio/mpeg","size_in_bytes":35430144,"duration_in_seconds":2214}]},{"id":"f36dbdc3-d907-4d0e-8ee2-4b83780799cb","title":"502: Ping from Hell","url":"https://www.bsdnow.tv/502","content_text":"5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n5 Key reasons why you need a OpenZFS Performance Audit\n\n\n\nMusings on Mobility : The Ping from Hell\n\n\n\nNews Roundup\n\nOpenBGPD 7.9 released\n\n\n\nSetting the clock ahead to see what breaks\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nEsteban - pot\nTim - BSD Talk at SCALE\nFred - Networking\n\n\n\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n","content_html":"<p>5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/5-key-reasons-why-you-need-an-openzfs-performance-audit/\" rel=\"nofollow\">5 Key reasons why you need a OpenZFS Performance Audit</a></h3>\n\n<hr>\n\n<h3><a href=\"http://bastian.rieck.me/blog/posts/2023/mobility/\" rel=\"nofollow\">Musings on Mobility : The Ping from Hell</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230323152353\" rel=\"nofollow\">OpenBGPD 7.9 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rachelbythebay.com/w/2023/01/19/time/\" rel=\"nofollow\">Setting the clock ahead to see what breaks</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Esteban%20-%20pot.md\" rel=\"nofollow\">Esteban - pot</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Tim%20-%20BSD%20Talk%20at%20SCALE.md\" rel=\"nofollow\">Tim - BSD Talk at SCALE</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/502/feedback/Fred%20-%20Networking.md\" rel=\"nofollow\">Fred - Networking</a></p></li>\n</ul>\n\n<hr>\n\n<h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></h2>\n\n<hr>","summary":"5 Key reasons for a OpenZFS Performance Audit, The Ping from Hell, OpenBGPD 7.9 released, Setting the clock ahead to see what breaks, and more","date_published":"2023-04-13T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f36dbdc3-d907-4d0e-8ee2-4b83780799cb.mp3","mime_type":"audio/mpeg","size_in_bytes":34267776,"duration_in_seconds":2141}]},{"id":"d498dc0c-a1f0-4c32-b783-7a39bbafa43a","title":"501: Boot that Snapshot","url":"https://www.bsdnow.tv/501","content_text":"Nextcloud + OpenBSD = &lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNextcloud + OpenBSD = &lt;3\n\n\n\nFreeBSD History Series - Understanding the Origins of DTrace\n\n\n\nNews Roundup\n\nBastille Templates for FreeBSD Jails\n\n\n\nInitial support for guided disk encryption in the installer\n\n\n\nDynamic host configuration, please\n\n\n\nBSDCan 2023 Tutorial: OpenBSD Storage Management\n\n\n\nJan/Feb 2023 Column Out in the FreeBSD Journal\n\n\n\nloader: Add support for booting from a ZFS snapshot\n\n\n\nTarsnap\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n","content_html":"<p>Nextcloud + OpenBSD = &lt;3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://x61.sh/log/2023/02/20230217T112354-nextcloud_openbsd.html\" rel=\"nofollow\">Nextcloud + OpenBSD = &lt;3</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-history-understanding-the-origins-of-dtrace/\" rel=\"nofollow\">FreeBSD History Series - Understanding the Origins of DTrace</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://byte--sized-de.translate.goog/linux-unix/bastille-templates-fuer-freebsd-jails/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp\" rel=\"nofollow\">Bastille Templates for FreeBSD Jails</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230308063109\" rel=\"nofollow\">Initial support for guided disk encryption in the installer</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230308060219\" rel=\"nofollow\">Dynamic host configuration, please</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/22621\" rel=\"nofollow\">BSDCan 2023 Tutorial: OpenBSD Storage Management</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/22619\" rel=\"nofollow\">Jan/Feb 2023 Column Out in the FreeBSD Journal</a></h3>\n\n<hr>\n\n<h3><a href=\"https://cgit.freebsd.org/src/commit/?id=a849842f510af48717e35ff709623e0dd1b80b20\" rel=\"nofollow\">loader: Add support for booting from a ZFS snapshot</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr>\n\n<p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr>","summary":"Nextcloud + OpenBSD = <3, Understanding the Origins of DTrace, Bastille Templates for FreeBSD Jails, Initial support for guided disk encryption in the OpenBSD installer, Dynamic host configuration please, OpenBSD Storage Management tutorial at BSDCan 2023, Jan/Feb 2023 Column Out in the FreeBSD Journal, and more","date_published":"2023-04-06T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d498dc0c-a1f0-4c32-b783-7a39bbafa43a.mp3","mime_type":"audio/mpeg","size_in_bytes":36514176,"duration_in_seconds":2282}]},{"id":"f813165b-a60b-4d4c-80fa-910b048b3dba","title":"500: Guarding the Wire","url":"https://www.bsdnow.tv/500","content_text":"Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nHow To Set Up a Wireguard VPN Server with Unbound on OpenBSD\n\n\n\nAuditing for OpenZFS Storage Performance\n\n\n\nNews Roundup\n\nSome notes on OpenBSD 7.2 on a Thinkpad X201\n\n\n\nfzf\n\n\nA Practical Guide to fzf: Building a File Explorer\nA Practical Guide to fzf: Shell Integration\n\n***\n\n\nReplacing postfix with dma\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDennis - Thanks\nLuna - Trillian\nLyubomir - ipfw question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://marcocetica.com/posts/wireguard_openbsd/\" rel=\"nofollow\">How To Set Up a Wireguard VPN Server with Unbound on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/\" rel=\"nofollow\">Auditing for OpenZFS Storage Performance</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://box.matto.nl/some-notes-on-openbsd-72-on-a-thinkpad-x201.html\" rel=\"nofollow\">Some notes on OpenBSD 7.2 on a Thinkpad X201</a></h3>\n\n<hr>\n\n<h3>fzf</h3>\n\n<ul>\n<li><a href=\"https://thevaluable.dev/practical-guide-fzf-example/\" rel=\"nofollow\">A Practical Guide to fzf: Building a File Explorer</a></li>\n<li><a href=\"https://thevaluable.dev/fzf-shell-integration/\" rel=\"nofollow\">A Practical Guide to fzf: Shell Integration</a></li>\n<li>\n***</li>\n</ul>\n\n<h3><a href=\"https://dan.langille.org/2023/02/28/replacing-postfix-with-dma/\" rel=\"nofollow\">Replacing postfix with dma</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Dennis%20-%20Thanks.md\" rel=\"nofollow\">Dennis - Thanks</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Luna%20-%20trillian.md\" rel=\"nofollow\">Luna - Trillian</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/500/feedback/Lyubomir%20-%20ipfw%20question.md\" rel=\"nofollow\">Lyubomir - ipfw question</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Wireguard VPN Server with Unbound on OpenBSD, Auditing for OpenZFS Storage Performance, OpenBSD 7.2 on a Thinkpad X201, Practical Guides to fzf, Replacing postfix with dma, and more","date_published":"2023-03-30T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f813165b-a60b-4d4c-80fa-910b048b3dba.mp3","mime_type":"audio/mpeg","size_in_bytes":34851456,"duration_in_seconds":2178}]},{"id":"b57b3e71-4395-4296-98ea-9eea94bffd1a","title":"499: Dan Langille Interview","url":"https://www.bsdnow.tv/499","content_text":"We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterview - Dan Langille - dan@langille.org / @twitter\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSpecial Guest: Dan Langille.","content_html":"<p>We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interview - Dan Langille - <a href=\"mailto:dan@langille.org\" rel=\"nofollow\">dan@langille.org</a> / <a href=\"https://twitter.com/dlangille\" rel=\"nofollow\">@twitter</a></h2>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul><p>Special Guest: Dan Langille.</p>","summary":"We’re interviewing Dan Langille about his new server project. He’ll talk to us about the things he’s building, some of which are a bit out of the ordinary. We’re also talking about BSDCan 2023 and what to expect after returning to an in-presence conference format. Enjoy!","date_published":"2023-03-23T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b57b3e71-4395-4296-98ea-9eea94bffd1a.mp3","mime_type":"audio/mpeg","size_in_bytes":38735616,"duration_in_seconds":2420}]},{"id":"34def0f7-bb67-4f62-a94c-6ff7ac8576f9","title":"498: Dropping Privileges","url":"https://www.bsdnow.tv/498","content_text":"OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenZFS auditing for storage Performance\n\n\n\nPrivilege drop, privilege separation, and restricted-service operating mode in OpenBSD\n\n\n\nNews Roundup\n\nOPNsense 23.1.1 released\n\n\n\nCloning a System with Ansible\n\n\n\nFOSDEM 2023\n\n\n\nBSDCan 2023 Travel Grant Application Now Open\n\n\n\nThe Undeadly Bits\n\nGame of Trees milestone\nGame of Trees Daemon - video and slides (May make the older game of trees obsolete)\namd64 execute-only committed to -current\nUsing /bin/eject with USB flash drives\nTunneling vxlan(4) over WireGuard wg(4)\nConsole screendumps\nExecute-only status report\nOpenBSD in Canada\nPrivilege drop, privilege separation, and restricted-service operating mode in OpenBSD\nTheo de Raadt on pinsyscall(2)\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKevin - PLUG\nLuna - FOSDEM\n***\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\n","content_html":"<p>OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-auditing-for-storage-performance/\" rel=\"nofollow\">OpenZFS auditing for storage Performance</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sha256.net/privsep.html\" rel=\"nofollow\">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://forum.opnsense.org/index.php?topic=32484.0\" rel=\"nofollow\">OPNsense 23.1.1 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://kernelpanic.life/software/cloning-a-system-with-ansible.html\" rel=\"nofollow\">Cloning a System with Ansible</a></h3>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/fosdem_2023\" rel=\"nofollow\">FOSDEM 2023</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/bsdcan-2023-travel-grant-application-now-open/\" rel=\"nofollow\">BSDCan 2023 Travel Grant Application Now Open</a></h3>\n\n<hr>\n\n<h2>The Undeadly Bits</h2>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20230120073530\" rel=\"nofollow\">Game of Trees milestone</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230210065830\" rel=\"nofollow\">Game of Trees Daemon - video and slides (May make the older game of trees obsolete)</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230121125423\" rel=\"nofollow\">amd64 execute-only committed to -current</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230214061952\" rel=\"nofollow\">Using /bin/eject with USB flash drives</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230214061330\" rel=\"nofollow\">Tunneling vxlan(4) over WireGuard wg(4)</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230128183032\" rel=\"nofollow\">Console screendumps</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230130061324\" rel=\"nofollow\">Execute-only status report</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230226065006\" rel=\"nofollow\">OpenBSD in Canada</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230219234206\" rel=\"nofollow\">Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20230222064027\" rel=\"nofollow\">Theo de Raadt on pinsyscall(2)</a></p>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Kevin%20-%20PLUG.md\" rel=\"nofollow\">Kevin - PLUG</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/498/feedback/Luna%20-%20FOSDEM.md\" rel=\"nofollow\">Luna - FOSDEM</a>\n***\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul></li>\n</ul>","summary":"OpenZFS auditing for storage Performance, Privilege drop; privilege separation; and restricted-service operating mode in OpenBSD, OPNsense 23.1.1 release, Cloning a System with Ansible, FOSDEM 2023, BSDCan 2023 Travel Grants","date_published":"2023-03-16T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34def0f7-bb67-4f62-a94c-6ff7ac8576f9.mp3","mime_type":"audio/mpeg","size_in_bytes":41248128,"duration_in_seconds":2578}]},{"id":"ce12be7b-8931-4d43-be2e-6260b5a41aff","title":"497: Random Relinking SSHD","url":"https://www.bsdnow.tv/497","content_text":"How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nSysadmin Series - How to Catch a Bitcoin Miner\n\n\n\nA Call For More Collaboration &amp; Harmony Among BSD Hardware Drivers\n\n• [Slides](https://fosdem.org/2023/schedule/event/bsd_driver_harmony/attachments/slides/5976/export/events/attachments/bsd_driver_harmony/slides/5976/BSD_Driver_Harmony_FOSDEM.pdf)\n• Video is embedded on the schedule event page\n\n\n\n\nPrinting on FreeBSD\n\n\n\nNews Roundup\n\nzstd updates\n\n\n\nI hate hackathons\n\n\n\nHow to monitor multiple log files at once\n\n\n\nNotes to self: KeePassXC\n\n\n\nsshd random relinking at boot\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nNelson - aix.md\nAdrian - vbsdcon\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/sysadmin-series-how-to-catch-a-bitcoin-miner/\" rel=\"nofollow\">Sysadmin Series - How to Catch a Bitcoin Miner</a></h3>\n\n<hr>\n\n<h3><a href=\"https://fosdem.org/2023/schedule/event/bsd_driver_harmony/\" rel=\"nofollow\">A Call For More Collaboration &amp; Harmony Among BSD Hardware Drivers</a></h3>\n\n<pre><code>• [Slides](https://fosdem.org/2023/schedule/event/bsd_driver_harmony/attachments/slides/5976/export/events/attachments/bsd_driver_harmony/slides/5976/BSD_Driver_Harmony_FOSDEM.pdf)\n• Video is embedded on the schedule event page\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://vermaden.wordpress.com/2023/02/07/print-on-freebsd/\" rel=\"nofollow\">Printing on FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/facebook/zstd/releases/tag/v1.5.4\" rel=\"nofollow\">zstd updates</a></h3>\n\n<hr>\n\n<h3><a href=\"https://pgpt.substack.com/p/i-hate-hackathons\" rel=\"nofollow\">I hate hackathons</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sleeplessbeastie.eu/2023/02/01/how-to-monitor-multiple-log-files-at-once/\" rel=\"nofollow\">How to monitor multiple log files at once</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jpmens.net/2023/01/22/notes-to-self-keepassxc/\" rel=\"nofollow\">Notes to self: KeePassXC</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20230119075627\" rel=\"nofollow\">sshd random relinking at boot</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Nelson%20-%20aix.md\" rel=\"nofollow\">Nelson - aix.md</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/497/feedback/Adrian%20-%20vbsdcon.md\" rel=\"nofollow\">Adrian - vbsdcon</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"How to Catch a Bitcoin Miner, A Call For More Collaboration, zstd updates, hating hackathons, How to monitor multiple log files at once, KeePassXC, sshd random relinking at boot, and more","date_published":"2023-03-09T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ce12be7b-8931-4d43-be2e-6260b5a41aff.mp3","mime_type":"audio/mpeg","size_in_bytes":40798848,"duration_in_seconds":2549}]},{"id":"2c0b464e-375e-42af-b44a-62ca75b4b31a","title":"496: Hacking the CLI","url":"https://www.bsdnow.tv/496","content_text":"Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAutomation and Hacking Your FreeBSD CLI\n\n\n\nRun your own instant messaging service on FreeBSD\n\n\n\nNews Roundup\n\nWatch Netflix on FreeBSD\n\n\n\nHardenedBSD January 2023 Status Report\n\n\n\nHow To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)\n\n\n\nOpenSSH fixes double-free memory bug that’s pokable over the network\n\n\n\nA late announcement, but better late than never\n\n\n\nNext NYC*BUG: March? April? Certainly May!\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDaniel - Plan 9 lives\nJason - nvd driver\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/automation-and-hacking-your-freebsd-cli/\" rel=\"nofollow\">Automation and Hacking Your FreeBSD CLI</a></h3>\n\n<hr>\n\n<h3><a href=\"https://xn--gckvb8fzb.com/run-your-own-instant-messaging-service-on-freebsd/\" rel=\"nofollow\">Run your own instant messaging service on FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://byte--sized-de.translate.goog/linux-unix/netflix-auf-freebsd-schauen/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp\" rel=\"nofollow\">Watch Netflix on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2023-01-31/hardenedbsd-january-2023-status-report\" rel=\"nofollow\">HardenedBSD January 2023 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/security/how-to-set-up-ssh-keys-with-yubikey-as-two-factor-authentication-u2f-fido2/\" rel=\"nofollow\">How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nakedsecurity.sophos.com/2023/02/03/openssh-fixes-double-free-memory-bug-thats-pokable-over-the-network/\" rel=\"nofollow\">OpenSSH fixes double-free memory bug that’s pokable over the network</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/chettrick/discobsd/releases/tag/DISCOBSD_2_0\" rel=\"nofollow\">A late announcement, but better late than never</a></h3>\n\n<hr>\n\n<h3><a href=\"https://lists.nycbug.org:8443/pipermail/talk/2023-February/018550.html\" rel=\"nofollow\">Next NYC*BUG: March? April? Certainly May!</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Daniel%20-%20Plan%209%20lives.md\" rel=\"nofollow\">Daniel - Plan 9 lives</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/496/feedback/Jason%20-%20nvd%20driver.md\" rel=\"nofollow\">Jason - nvd driver</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Automation and Hacking Your FreeBSD CLI, Run your own instant messaging service on FreeBSD, Watch Netflix on FreeBSD, HardenedBSD January 2023 Status Report, How To Set Up SSH Keys With YubiKey as two-factor authentication, OpenSSH fixes double-free memory bug that’s pokable over the network, A late announcement, but better late than never, Next NYC*BUG and more","date_published":"2023-03-02T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2c0b464e-375e-42af-b44a-62ca75b4b31a.mp3","mime_type":"audio/mpeg","size_in_bytes":43280256,"duration_in_seconds":2705}]},{"id":"3a14bc16-5c33-4eb2-970e-fba476718e64","title":"495: Limited Jail Time","url":"https://www.bsdnow.tv/495","content_text":"FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Status Report Fourth Quarter 2022\n\n\n\nHow to limit a jail\n\n\n\nNews Roundup\n\nThe parallel port\n\n\n\nHello System 0.8 is out\n\n\n\nSolbournes in space\n\n\n\nBeastie Bits\n\n\nCollecting notes for future “historians” was: Earliest UNIX Workstations?\nNew Open Position: FreeBSD Userland Software Developer\nThe One Lone Audiobook now exclusive on my store\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2022-10-2022-12/\" rel=\"nofollow\">FreeBSD Status Report Fourth Quarter 2022</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2023/01/16/how-to-limit-a-jail/\" rel=\"nofollow\">How to limit a jail</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://computer.rip/2023-01-29-the-parallel-port.html\" rel=\"nofollow\">The parallel port</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/helloSystem/ISO/releases/tag/r0.8.0\" rel=\"nofollow\">Hello System 0.8 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://oldvcr.blogspot.com/2023/01/solbournes-in-space.html\" rel=\"nofollow\">Solbournes in space</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://minnie.tuhs.org/pipermail/tuhs/2023-January/027495.html\" rel=\"nofollow\">Collecting notes for future “historians” was: Earliest UNIX Workstations?</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/new-open-position-freebsd-userland-software-developer/\" rel=\"nofollow\">New Open Position: FreeBSD Userland Software Developer</a></li>\n<li><a href=\"https://mwl.io/archives/22539\" rel=\"nofollow\">The One Lone Audiobook now exclusive on my store</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"FreeBSD Status Report Fourth Quarter 2022, How to limit a jail, the parallel port, Hello System 0.8, Solbournes in space, and more","date_published":"2023-02-23T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3a14bc16-5c33-4eb2-970e-fba476718e64.mp3","mime_type":"audio/mpeg","size_in_bytes":29095680,"duration_in_seconds":1818}]},{"id":"b6bd08a9-8d1d-4bc9-8024-a8153fe7b304","title":"494: Unix workstation extinction","url":"https://www.bsdnow.tv/494","content_text":"Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe mass extinction of UNIX workstations\n\n\n\nwhoarethey: Determine Who Can Log In to an SSH Server\n\n\n\nNews Roundup\n\nFreeBSD vs. Linux 5 Factors When Considering FreeBSD vs. Linux: Packages\n\n\n\nA Visual Guide to SSH Tunnels: Local and Remote Port Forwarding\n\n\n\nHarvesting the Noise While it’s Fresh, Revisited\n\n\n\nBastille - The Jail Manager on FreeBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.osnews.com/story/135605/the-mass-extinction-of-unix-workstations/\" rel=\"nofollow\">The mass extinction of UNIX workstations</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.agwa.name/blog/post/whoarethey\" rel=\"nofollow\">whoarethey: Determine Who Can Log In to an SSH Server</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-vs-linux-5-factors-when-considering-freebsd-vs-linux-package-management/\" rel=\"nofollow\">FreeBSD vs. Linux 5 Factors When Considering FreeBSD vs. Linux: Packages</a></h3>\n\n<hr>\n\n<h3><a href=\"https://iximiuz.com/en/posts/ssh-tunnels/\" rel=\"nofollow\">A Visual Guide to SSH Tunnels: Local and Remote Port Forwarding</a></h3>\n\n<hr>\n\n<h3><a href=\"https://medium.com/@peter.hansteen/harvesting-the-noise-while-its-fresh-revisited-3da1894cc8a7\" rel=\"nofollow\">Harvesting the Noise While it’s Fresh, Revisited</a></h3>\n\n<hr>\n\n<h3><a href=\"https://byte--sized-de.translate.goog/linux-unix/bastille-der-jail-manager-unter-freebsd/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp\" rel=\"nofollow\">Bastille - The Jail Manager on FreeBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Mass extinction of UNIX workstations, Determine Who Can Log In to an SSH Server, Factors When Considering FreeBSD vs. Linux Packages, A Visual Guide to SSH Tunnels, Harvesting the Noise While it’s Fresh, Bastille - The Jail Manager on FreeBSD, and more","date_published":"2023-02-16T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6bd08a9-8d1d-4bc9-8024-a8153fe7b304.mp3","mime_type":"audio/mpeg","size_in_bytes":44895744,"duration_in_seconds":2805}]},{"id":"ef98d63f-3086-456f-9297-d17503684aec","title":"493: Dotfile Management","url":"https://www.bsdnow.tv/493","content_text":"Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWrite Admin tools from Day One\n\n\n\nDifferentiating between Data Security and Data Integrity\n\n\n\nNews Roundup\n\nThis 45 year-old Unix tool is finally getting an upgrade\n\n\n\nInstalling OpenBSD 7.2 on an ODROID-HC4\n\n\n\nDotfiles Management\n\n\n\nBeastie Bits\n\nFreeBSD Journal - November/December 2022 - Observability and Metrics\nHAMMER2 file system for NetBSD\nRunning OpenBSD 7.2 on your laptop is really hard (not)\nMinIO on OpenBSD 7.2: Install\nWireGuard VPN on OpenBSD\nA tool for glamorous shell scripts\nVisualize your git commits with a heat map in the terminal\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://milwaukeemaven.blogspot.com/2022/08/write-admin-tools-from-day-one.html\" rel=\"nofollow\">Write Admin tools from Day One</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-data-security-vs-integrity/\" rel=\"nofollow\">Differentiating between Data Security and Data Integrity</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.techradar.com/news/45-year-old-unix-tool-finally-gets-an-upgrade\" rel=\"nofollow\">This 45 year-old Unix tool is finally getting an upgrade</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2022/install-openbsd-odroid-hc4/\" rel=\"nofollow\">Installing OpenBSD 7.2 on an ODROID-HC4</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mitxela.com/projects/dotfiles_management\" rel=\"nofollow\">Dotfiles Management</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://freebsdfoundation.org/past-issues/observability-and-metrics/\" rel=\"nofollow\">FreeBSD Journal - November/December 2022 - Observability and Metrics</a><br>\n<a href=\"https://github.com/kusumi/netbsd_hammer2\" rel=\"nofollow\">HAMMER2 file system for NetBSD</a><br>\n<a href=\"https://sohcahtoa.org.uk/openbsd.html\" rel=\"nofollow\">Running OpenBSD 7.2 on your laptop is really hard (not)</a><br>\n<a href=\"https://dev.to/nabbisen/minio-on-openbsd-72-install-3b3h\" rel=\"nofollow\">MinIO on OpenBSD 7.2: Install</a><br>\n<a href=\"https://www.adrianobarbosa.xyz/blog/openbsd-wireguard.html\" rel=\"nofollow\">WireGuard VPN on OpenBSD</a><br>\n<a href=\"https://github.com/charmbracelet/gum\" rel=\"nofollow\">A tool for glamorous shell scripts</a><br>\n<a href=\"https://github.com/james-stoup/heatwave\" rel=\"nofollow\">Visualize your git commits with a heat map in the terminal</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Write Admin tools from Day One, Differentiating between Data Security and Data Integrity, 45 year-old Unix tool is finally getting an upgrade, OpenBSD 7.2 on an ODROID-HC4, Dotfiles Management, and more","date_published":"2023-02-09T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef98d63f-3086-456f-9297-d17503684aec.mp3","mime_type":"audio/mpeg","size_in_bytes":40797696,"duration_in_seconds":2549}]},{"id":"2bb426c2-2403-431d-8816-4a3cd7ce8662","title":"492: Feeling for NetBSD","url":"https://www.bsdnow.tv/492","content_text":"Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nPart 1: Writing your own operating system\n\n\n\n2022 in Review: Continuous Integration and Quality Assurance Update\n\n\n\nNews Roundup\n\nI feel for the NetBSD community\n\n\n\nTesting wanted: execute-only on amd64\n\n\n\nGCC now includes Modula-2 and Rust. Do they work on OpenBSD?\n\n\n\nUnix is dead. Long live Unix!\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• [Kevin - Advent of Computing podcast covers BSD](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/Kevin%20-%20Advent%20of%20Computing%20podcast%20covers%20BSD.md)\n• [ilo - thanks](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/ilo%20-%20thanks.md)\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://o-oconnell.github.io/2023/01/12/p1os.html\" rel=\"nofollow\">Part 1: Writing your own operating system</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/2022-in-review-continuous-integration-and-quality-assurance-update/\" rel=\"nofollow\">2022 in Review: Continuous Integration and Quality Assurance Update</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rubenerd.com/i-feel-for-the-netbsd-community/\" rel=\"nofollow\">I feel for the NetBSD community</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.undeadly.org/cgi?action=article;sid=20230115095258\" rel=\"nofollow\">Testing wanted: execute-only on amd64</a></h3>\n\n<hr>\n\n<h3><a href=\"https://briancallahan.net/blog/\" rel=\"nofollow\">GCC now includes Modula-2 and Rust. Do they work on OpenBSD?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.theregister.com/2023/01/17/unix_is_dead/\" rel=\"nofollow\">Unix is dead. Long live Unix!</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• [Kevin - Advent of Computing podcast covers BSD](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/Kevin%20-%20Advent%20of%20Computing%20podcast%20covers%20BSD.md)\n• [ilo - thanks](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/492/feedback/ilo%20-%20thanks.md)\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Writing your own operating system, Continuous Integration and Quality Assurance Update, feeling for the NetBSD community, Testing wanted: execute-only on amd64, GCC uses Modula-2 and Rust, do they work on OpenBSD, Unix is dead; long live Unix, and more","date_published":"2023-02-02T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2bb426c2-2403-431d-8816-4a3cd7ce8662.mp3","mime_type":"audio/mpeg","size_in_bytes":37183104,"duration_in_seconds":2323}]},{"id":"26dff077-f214-46c7-9ba3-a577e3c443df","title":"491: Catch the Spammers","url":"https://www.bsdnow.tv/491","content_text":"Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDragonfly BSD 6.4 is out\n\n\n\nRunning OpenZFS – Choosing Between FreeBSD and Linux\n\n\n\nNews Roundup\n\n“OpenBSD Mastery: Filesystems” ebook leaking out\n\n\n\nCan Your Spam-eater Manage to Catch Seventy-one Percent Like This Other Service?\n\n\n\nCrazy unix shell prompts\n\n\n\nLinux Binary Compatibility: Ubuntu on FreeBSD\n\n\n\nReproducible Builds Summit Venice 2022\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nFelix - Managing Jails with ansible\nJohn Baldwin - bhyve networking setup article\nWelton - bhyve webadmin\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.dragonflybsd.org/release64/\" rel=\"nofollow\">Dragonfly BSD 6.4 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/running-openzfs-choosing-between-freebsd-and-linux/\" rel=\"nofollow\">Running OpenZFS – Choosing Between FreeBSD and Linux</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mwl.io/archives/22462\" rel=\"nofollow\">“OpenBSD Mastery: Filesystems” ebook leaking out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdly.blogspot.com/2022/12/can-your-spam-eater-manage-to-catch.html\" rel=\"nofollow\">Can Your Spam-eater Manage to Catch Seventy-one Percent Like This Other Service?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://lists.nycbug.org:8443/pipermail/semibug/2022-December/000775.html\" rel=\"nofollow\">Crazy unix shell prompts</a></h3>\n\n<hr>\n\n<h3><a href=\"https://byte--sized-de.translate.goog/linux-unix/linux-binary-compatibility-ubuntu-unter-freebsd/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp\" rel=\"nofollow\">Linux Binary Compatibility: Ubuntu on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/reproducible_builds_summit_venice_2022\" rel=\"nofollow\">Reproducible Builds Summit Venice 2022</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Felix%20-%20Managing%20Jails%20with%20ansible.md\" rel=\"nofollow\">Felix - Managing Jails with ansible</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/John%20Baldwin%20-%20bhyve%20networking%20setup%20article.md\" rel=\"nofollow\">John Baldwin - bhyve networking setup article</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/491/feedback/Welton%20-%20bhyve%20webadmin.md\" rel=\"nofollow\">Welton - bhyve webadmin</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Dragonfly BSD 6.4 is out, Running OpenZFS – Choosing Between FreeBSD and Linux, OpenBSD Mastery: Filesystems ebook leaks, catching 71% spam, crazy unix shell prompts, Linux Binary Compatibility: Ubuntu on FreeBSD, Reproducible Builds Summit Venice 2022, and more","date_published":"2023-01-26T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/26dff077-f214-46c7-9ba3-a577e3c443df.mp3","mime_type":"audio/mpeg","size_in_bytes":40619520,"duration_in_seconds":2538}]},{"id":"ae658daa-12a6-4e03-b688-5970278fb273","title":"490: New Year’s Plan9’ing","url":"https://www.bsdnow.tv/490","content_text":"FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n2022 in Review: Software Development\n\n\n\nWhat can we learn from Vintage Computing\n\n\n\nNews Roundup\n\nOpenBSD KDE Status Report 2022\n\n\n\nA Decade of HardenedBSD\n\n\n\nIn Praise of Plan9\n\n\n\nBeastie Bits\n\nLibreSSL 3.7.0 Released\nOPNsense 22.7.10 released\nBSDCan 2023 call for papers\nHow to lock OpenSSH authentication agent\nOnce upon a time long ago, I was sitting alone in the UCLA ARPANET site...\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/2022-in-review-software-development/\" rel=\"nofollow\">2022 in Review: Software Development</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/readme/featured/vintage-computing\" rel=\"nofollow\">What can we learn from Vintage Computing</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.sizeofvoid.org/posts/2022-26-12-openbsd-kde-status-report-2022/\" rel=\"nofollow\">OpenBSD KDE Status Report 2022</a></h3>\n\n<hr>\n\n<h3><a href=\"https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/hardenedbsd/2023-01_decade/article.md\" rel=\"nofollow\">A Decade of HardenedBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://drewdevault.com/2022/11/12/In-praise-of-Plan-9.html\" rel=\"nofollow\">In Praise of Plan9</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20221212183516\" rel=\"nofollow\">LibreSSL 3.7.0 Released</a><br>\n<a href=\"https://opnsense.org/opnsense-22-7-10-released/\" rel=\"nofollow\">OPNsense 22.7.10 released</a><br>\n<a href=\"https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-December/000194.html\" rel=\"nofollow\">BSDCan 2023 call for papers</a><br>\n<a href=\"https://sleeplessbeastie.eu/2022/12/28/how-to-lock-openssh-authentication-agent/\" rel=\"nofollow\">How to lock OpenSSH authentication agent</a><br>\n<a href=\"https://mastodon.laurenweinstein.org/@lauren/109588605178700335\" rel=\"nofollow\">Once upon a time long ago, I was sitting alone in the UCLA ARPANET site...</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Foundation’s Software Development review of 2022, what can we learn from Vintage Computing, OpenBSD KDE Status Report 2022, a Decade of HardenedBSD, In Praise of Plan9, and more","date_published":"2023-01-19T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ae658daa-12a6-4e03-b688-5970278fb273.mp3","mime_type":"audio/mpeg","size_in_bytes":44370432,"duration_in_seconds":2773}]},{"id":"f53ef4ed-7907-4da2-8402-7154f773f79e","title":"489: Refreshing Perspective","url":"https://www.bsdnow.tv/489","content_text":"FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD vs. Linux – Networking\n\n\n\n(Solved), HDMI sound output through TV speakers Freebsd 13 or @4 plus VCHIQ audio patch - Raspberry Pi Forums\n\n\n\nNews Roundup\n\nGetting started with tmux\n\n\n\nSamba Active Directory\n\n\n\nOpenIKED 7.2 released\n\n\n\nFreeBSD Plasma 5 GUI Install\n\n\nOriginal German Article\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-vs-linux-networking/\" rel=\"nofollow\">FreeBSD vs. Linux – Networking</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.raspberrypi.com/viewtopic.php?t=343233\" rel=\"nofollow\">(Solved), HDMI sound output through TV speakers Freebsd 13 or @4 plus VCHIQ audio patch - Raspberry Pi Forums</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://ittavern.com/getting-started-with-tmux/\" rel=\"nofollow\">Getting started with tmux</a></h3>\n\n<hr>\n\n<h3><a href=\"https://cromwell-intl.com/open-source/samba-active-directory/freebsd-raspberry-pi.html\" rel=\"nofollow\">Samba Active Directory</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20221202230711\" rel=\"nofollow\">OpenIKED 7.2 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://byte--sized-de.translate.goog/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp\" rel=\"nofollow\">FreeBSD Plasma 5 GUI Install</a></h3>\n\n<ul>\n<li><a href=\"https://byte-sized.de/linux-unix/freebsd-kde-plasma-5-als-gui-installieren/\" rel=\"nofollow\">Original German Article</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD vs. Linux – Networking, HDMI sound output through TV speakers on FreeBSD 13, Getting started with tmux, Samba Active Directory, OpenIKED 7.2 released, FreeBSD Plasma 5 GUI Install, DHCP server howto in German, and more","date_published":"2023-01-12T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f53ef4ed-7907-4da2-8402-7154f773f79e.mp3","mime_type":"audio/mpeg","size_in_bytes":34737024,"duration_in_seconds":2171}]},{"id":"0ebed5dc-4761-4816-b5e6-9c17f80612b6","title":"488: Old ping(8) bug","url":"https://www.bsdnow.tv/488","content_text":"Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFuzzing ping(8) … and finding a 24 year old bug\n\n\n\nThe Role of Operating Systems in IOT\n\n\n\nNews Roundup\n\nAuthentication gateway with SSH on OpenBSD\n\n\n\nFreeBSD 12.4 is out\n\n\n\nBeastie Bits\n\nVagrant FreeBSD Boxbuilder\nLibreSSL 3.7.0 Released\nOPNsense 22.7.9 released\nBIOS Memory Map for vmd(8) Rewrite in Progress\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://tlakh.xyz/fuzzing-ping.html\" rel=\"nofollow\">Fuzzing ping(8) … and finding a 24 year old bug</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/the-role-of-operating-systems-in-iot/\" rel=\"nofollow\">The Role of Operating Systems in IOT</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-12-01-openbsd-authpf.html\" rel=\"nofollow\">Authentication gateway with SSH on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/archives/freebsd-announce/2022-December/000059.html\" rel=\"nofollow\">FreeBSD 12.4 is out</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://github.com/punktDe/vagrant-freebsd-boxbuilder\" rel=\"nofollow\">Vagrant FreeBSD Boxbuilder</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20221212183516\" rel=\"nofollow\">LibreSSL 3.7.0 Released</a><br>\n<a href=\"https://opnsense.org/opnsense-22-7-9-released\" rel=\"nofollow\">OPNsense 22.7.9 released</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20221211164822\" rel=\"nofollow\">BIOS Memory Map for vmd(8) Rewrite in Progress</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Finding a 24 year old bug in ping(8), The Role of Operating Systems in IOT, Authentication gateway with SSH on OpenBSD, FreeBSD 12.4 is out, and more","date_published":"2023-01-05T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0ebed5dc-4761-4816-b5e6-9c17f80612b6.mp3","mime_type":"audio/mpeg","size_in_bytes":34010112,"duration_in_seconds":2125}]},{"id":"0aac59a7-37df-4c7b-85fc-68c0d657cd47","title":"487: EuroBSDcon Interviews Pt. 2","url":"https://www.bsdnow.tv/487","content_text":"This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!\n\nNOTES***\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nEuroBSDCon 2022 Trip Report\n\n\n\nInterview 3 - John Baldwin - email@email / @twitter\n\nInterview topic\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!</p>\n\n<p>NOTES***<br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/eurobsdcon-2022-trip-report-patrick-mcevoy/\" rel=\"nofollow\">EuroBSDCon 2022 Trip Report</a></h3>\n\n<hr>\n\n<h2>Interview 3 - John Baldwin - <a href=\"mailto:email@email\" rel=\"nofollow\">email@email</a> / <a href=\"https://twitter.com/user\" rel=\"nofollow\">@twitter</a></h2>\n\n<p>Interview topic</p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"This year end episode of BSDNow features a trip report to EuroBSDcon by Mr. BSD.tv, as well as an interview with FreeBSD committer John Baldwin. Happy New Year, 2023!","date_published":"2022-12-29T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0aac59a7-37df-4c7b-85fc-68c0d657cd47.mp3","mime_type":"audio/mpeg","size_in_bytes":32956800,"duration_in_seconds":2059}]},{"id":"5876d0bf-0a23-4dc7-b582-fed2ae43bd85","title":"486: EuroBSDcon interviews","url":"https://www.bsdnow.tv/486","content_text":"This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHelp the OpenBSD Foundation Reach Its 2022 Funding Goal\n\n• [FreeBSD Foundation Donation Link](https://freebsdfoundation.org/donate/)\n• [NetBSD Foundation Donation Link](http://www.netbsd.org/donations/#how-to-donate)\n\n\n\n\nInterview 1 - Brooks Davis - email@email / @twitter\n\nInterview topic\n\n\n\nInterview 2 - Olivier Cochard-Labbe - email@email / @twitter\n\nInterview topic\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\n\n\nFeedback/Questions\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20221202062601\" rel=\"nofollow\">Help the OpenBSD Foundation Reach Its 2022 Funding Goal</a></h3>\n\n<pre><code>• [FreeBSD Foundation Donation Link](https://freebsdfoundation.org/donate/)\n• [NetBSD Foundation Donation Link](http://www.netbsd.org/donations/#how-to-donate)\n</code></pre>\n\n<hr>\n\n<h2>Interview 1 - Brooks Davis - <a href=\"mailto:email@email\" rel=\"nofollow\">email@email</a> / <a href=\"https://twitter.com/user\" rel=\"nofollow\">@twitter</a></h2>\n\n<p>Interview topic</p>\n\n<hr>\n\n<h2>Interview 2 - Olivier Cochard-Labbe - <a href=\"mailto:email@email\" rel=\"nofollow\">email@email</a> / <a href=\"https://twitter.com/user\" rel=\"nofollow\">@twitter</a></h2>\n\n<p>Interview topic</p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"This special episode features two interviews we did at EuroBSDcon in Vienna this year. We talk with FreeBSD developers about how they got started, their current projects and more. Also, consider donating to your favorite BSD Foundation to keep the projects going. ","date_published":"2022-12-22T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5876d0bf-0a23-4dc7-b582-fed2ae43bd85.mp3","mime_type":"audio/mpeg","size_in_bytes":37461120,"duration_in_seconds":2341}]},{"id":"b7197ea6-5468-43f4-bd01-fa80aeecc72e","title":"485: FreeBSD Home Assistant","url":"https://www.bsdnow.tv/485","content_text":"Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix's (technical) history is mostly old now, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nTails of the M1 GPU\n\n\n\nGetting Home Assistant running in a FreeBSD 13.1 jail\n\n\n\nNews Roundup\n\nA brief interview with AWK creator Dr. Brian Kernighan\n\n\n\nNext steps toward mimmutable, from deraadt@\n\n\n\nUnix's (technical) history is mostly old now\n\n\n\nMWL Update\n\n\nFediverse Servers, plus mac_portacl on FreeBSD\nFifty Books. Thirty Years. What Next?\nMailing List Freebies\n\n\n\n\nBeastie Bits\n\n\nMore #FreeBSD Power Saving Notes\nHacker Stations\nThe Cult of DD\nRavynOS\n\n\nravynOS (previously called airyxOS) is an open-source operating system based on FreeBSD, CMU Mach, and Apple open-source code that aims to be compatible with macOS applications and has no hardware restrictions.\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix&#39;s (technical) history is mostly old now, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://asahilinux.org/2022/11/tales-of-the-m1-gpu/\" rel=\"nofollow\">Tails of the M1 GPU</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2022/08/27/getting-home-assistant-running-in-a-freebsd-13-1-jail/\" rel=\"nofollow\">Getting Home Assistant running in a FreeBSD 13.1 jail</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://pldb.com/posts/brianKernighan.html\" rel=\"nofollow\">A brief interview with AWK creator Dr. Brian Kernighan</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20221120115616\" rel=\"nofollow\">Next steps toward mimmutable, from deraadt@</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixHistoryMostlyOldNow\" rel=\"nofollow\">Unix&#39;s (technical) history is mostly old now</a></h3>\n\n<hr>\n\n<h3>MWL Update</h3>\n\n<ul>\n<li><a href=\"https://mwl.io/archives/22392\" rel=\"nofollow\">Fediverse Servers, plus mac_portacl on FreeBSD</a></li>\n<li><a href=\"https://mwl.io/archives/22399\" rel=\"nofollow\">Fifty Books. Thirty Years. What Next?</a></li>\n<li><a href=\"https://mwl.io/archives/22423\" rel=\"nofollow\">Mailing List Freebies</a></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://blog.ignoranthack.me/?p=686\" rel=\"nofollow\">More #FreeBSD Power Saving Notes</a></li>\n<li><a href=\"https://hackerstations.com/\" rel=\"nofollow\">Hacker Stations</a></li>\n<li><a href=\"https://eklitzke.org/the-cult-of-dd\" rel=\"nofollow\">The Cult of DD</a></li>\n<li><a href=\"https://airyx.org/\" rel=\"nofollow\">RavynOS</a>\n\n<ul>\n<li>ravynOS (previously called airyxOS) is an open-source operating system based on FreeBSD, CMU Mach, and Apple open-source code that aims to be compatible with macOS applications and has no hardware restrictions.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Tails of the M1 GPU, Getting Home Assistant running in a FreeBSD 13.1 jail, interview with AWK creator Dr. Brian Kernighan, Next steps toward mimmutable, Unix's (technical) history is mostly old now, and more","date_published":"2022-12-15T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b7197ea6-5468-43f4-bd01-fa80aeecc72e.mp3","mime_type":"audio/mpeg","size_in_bytes":41792256,"duration_in_seconds":2612}]},{"id":"4f095d18-aa8c-465b-956d-03ca0f1f16f8","title":"484: Birth of stderr","url":"https://www.bsdnow.tv/484","content_text":"Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nVirtualization showdown – FreeBSD’s bhyve vs. Linux’s KVM\n\n\n\nThe Birth of Standard Error\n\n\n\nNews Roundup\n\nInvestigating why Steam started picking a random font\n\n\n\nCurious Case of Maintaining Sufficient Free Space with ZFS\n\n\n\nCall for testing on updated Apple M1/M2 bootloader code\n\n\n\nFreeBSD on my workstation\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - Initial Setup\nJoseph - openbsd and postgresql\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/virtualization-showdown-freebsd-bhyve-linux-kvm/\" rel=\"nofollow\">Virtualization showdown – FreeBSD’s bhyve vs. Linux’s KVM</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.spinellis.gr/blog/20131211/\" rel=\"nofollow\">The Birth of Standard Error</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://blog.pkh.me/p/35-investigating-why-steam-started-picking-a-random-font.html\" rel=\"nofollow\">Investigating why Steam started picking a random font</a></h3>\n\n<hr>\n\n<h3><a href=\"https://taras.glek.net/post/curious-case-of-maintaining-sufficient-free-space-with-zfs/\" rel=\"nofollow\">Curious Case of Maintaining Sufficient Free Space with ZFS</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20221120113149\" rel=\"nofollow\">Call for testing on updated Apple M1/M2 bootloader code</a></h3>\n\n<hr>\n\n<h3><a href=\"https://camandro.org/blog/2022-09-30-freebsd-on-my-workstation.html\" rel=\"nofollow\">FreeBSD on my workstation</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/Brad%20-%20Initial%20Setup.md\" rel=\"nofollow\">Brad - Initial Setup</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/484/feedback/joseph%20-%20openbsd%20and%20postgresql.md\" rel=\"nofollow\">Joseph - openbsd and postgresql</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Virtualization showdown, The Birth of Standard Error, why Steam started picking a random font, Maintaining Sufficient Free Space with ZFS, updated Apple M1/M2 bootloader, code, FreeBSD on my workstation, and more ","date_published":"2022-12-08T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4f095d18-aa8c-465b-956d-03ca0f1f16f8.mp3","mime_type":"audio/mpeg","size_in_bytes":34985472,"duration_in_seconds":2186}]},{"id":"a6421b51-580d-42b5-8668-9703082f861b","title":"483: ZFS Time Machine","url":"https://www.bsdnow.tv/483","content_text":"Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nInstalling and Using Research Unix Version 6 in the Open SIMH PDP-11 Emulator\n\n\n\nhttm – The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method\n\n\n\nNews Roundup\n\nNFS on NetBSD: server and client side\n\n\n\nHardenedBSD October 2022 Status Report\n\n\n\nNushell : Introduction\n\n\n\nBeastie Bits\n\nUnix Pipe Game\nSlides - The “other” FreeBSD optimizations used by Netflix to serve video at 800Gb/s from a single server\nMy FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDan - Response to Hans\nJohnny - bhyve question\nManuel - EuroBSDcon social event\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://decuser.blogspot.com/2022/10/installing-and-using-research-unix.html\" rel=\"nofollow\">Installing and Using Research Unix Version 6 in the Open SIMH PDP-11 Emulator</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/httm-is-a-zfs-based-time-machine/\" rel=\"nofollow\">httm – The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.unitedbsd.com/d/959-nfs-on-netbsd-server-and-client-side\" rel=\"nofollow\">NFS on NetBSD: server and client side</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2022-10-31/hardenedbsd-october-2022-status-report\" rel=\"nofollow\">HardenedBSD October 2022 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-10-31-nushell.html\" rel=\"nofollow\">Nushell : Introduction</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://hackaday.com/2022/10/18/if-only-the-kids-knew-about-pipes/\" rel=\"nofollow\">Unix Pipe Game</a><br>\n<a href=\"https://people.freebsd.org/%7Egallatin/talks/euro2022.pdf\" rel=\"nofollow\">Slides - The “other” FreeBSD optimizations used by Netflix to serve video at 800Gb/s from a single server</a><br>\n<a href=\"https://www.coreystephan.com/freebsd-friday/\" rel=\"nofollow\">My FreeBSD Friday Lecture: The Writing Scholar’s Guide to FreeBSD</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Dan%20-%20Response%20to%20Hans.md\" rel=\"nofollow\">Dan - Response to Hans</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Johnny%20-%20bhyve%20question.md\" rel=\"nofollow\">Johnny - bhyve question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/483/feedback/Manuel%20-%20EuroBSDcon%20social%20event.md\" rel=\"nofollow\">Manuel - EuroBSDcon social event</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Research Unix Version 6 in the Open SIMH PDP-11 Emulator, The Hot Tub Time Machine is Your ZFS Turn-Back-Time Method, NFS on NetBSD: server and client side, HardenedBSD October 2022 Status Report, Nushell : Introduction, and more","date_published":"2022-12-01T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a6421b51-580d-42b5-8668-9703082f861b.mp3","mime_type":"audio/mpeg","size_in_bytes":48744192,"duration_in_seconds":3046}]},{"id":"b4733d68-58d9-429a-b80d-d7a4522e3e33","title":"482: BSD XFCE Desktop","url":"https://www.bsdnow.tv/482","content_text":"5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\n5 Key Reasons to Consider Open Source Storage Over Commercial Offerings\n\n\n\nOpenBSD Minimalist Desktop\n\n\n\nNews Roundup\n\nBSD-XFCE\n\n\n\nCreating an Alpine Linux VM on bhyve - with root on ZFS (optionally encrypted)\n\n\n\nFreeBSD Jail Quick Setup with Networking (2022)\n\n\n\nBeastie Bits\n\nEuroBSDcon videos are now up\nLibreSSL 3.6.1 released\nRaspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab\n\nAsiaBSDcon 2023 CfP\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nJohn - Allan's meetup\nMatthew - atime and a question\nValentin - Becoming a FreeBSD Developer\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/open-source-storage-over-commercial-offerings/\" rel=\"nofollow\">5 Key Reasons to Consider Open Source Storage Over Commercial Offerings</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nechtan.io/articles/openbsd_minimalist_desktop.html\" rel=\"nofollow\">OpenBSD Minimalist Desktop</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/Wamphyre/BSD-XFCE\" rel=\"nofollow\">BSD-XFCE</a></h3>\n\n<hr>\n\n<h3><a href=\"https://it-notes.dragas.net/2022/11/01/creating-an-alpine-vm-on-bhyve-with-root-on-zfs-optionally-encrypted/\" rel=\"nofollow\">Creating an Alpine Linux VM on bhyve - with root on ZFS (optionally encrypted)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.shaka.today/freebsd-jail-quick-setup-with-networking-2022/\" rel=\"nofollow\">FreeBSD Jail Quick Setup with Networking (2022)</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://www.youtube.com/c/EuroBSDcon/videos\" rel=\"nofollow\">EuroBSDcon videos are now up</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20221104064712\" rel=\"nofollow\">LibreSSL 3.6.1 released</a><br>\n<a href=\"https://www.coreystephan.com/pi4-freebsd/\" rel=\"nofollow\">Raspberry Pi 4 with FreeBSD 13-RELEASE: A Perfect Miniature Homelab</a></p>\n\n<p><a href=\"https://2023.asiabsdcon.org/cfp.html.en\" rel=\"nofollow\">AsiaBSDcon 2023 CfP</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/John%20-%20Allan&#x27;s%20meetup.md\" rel=\"nofollow\">John - Allan&#39;s meetup</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Matthew%20-%20atime%20and%20a%20question.md\" rel=\"nofollow\">Matthew - atime and a question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/482/feedback/Valentin%20-%20Becoming%20a%20FreeBSD%20Developer.md\" rel=\"nofollow\">Valentin - Becoming a FreeBSD Developer</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"5 Key Reasons to Consider Open Source Storage, OpenBSD Minimalist Desktop, BSD XFCE, Alpine Linux VM on bhyve - with root on ZFS, FreeBSD Jail Quick Setup with Networking, and more.","date_published":"2022-11-24T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b4733d68-58d9-429a-b80d-d7a4522e3e33.mp3","mime_type":"audio/mpeg","size_in_bytes":37766784,"duration_in_seconds":2360}]},{"id":"f0df0143-84f7-40aa-9802-be21a870c0c1","title":"481: Fiery Crackers","url":"https://www.bsdnow.tv/481","content_text":"FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don't use Reddit for Linux or BSD related questions, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Quarterly Status Report Third Quarter 2022\n\n\n\nAvoid Infrastructure Vendor Lock-in by leveraging MinIO and OpenZFS\n\n\n\nAnnouncing the FreeBSD/Firecracker platform\n\n\n\nNews Roundup\n\nHow Much Faster Is Making A Tar Archive Without Gzip?\n\n\n\nPostgreSQL from packages on OpenBSD\n\n\n\nUpgrading an NVMe zpool from 222G to 1TB drives\n\n\n\nPSA: Don't use Reddit for Linux or BSD related questions\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nHinnerk - vnet jails\nTom’s response example: https://adventurist.me/posts/00304\nHugo - Apple M2\nkevin - emacs backspace\n)\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don&#39;t use Reddit for Linux or BSD related questions, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2022-07-2022-09/\" rel=\"nofollow\">FreeBSD Quarterly Status Report Third Quarter 2022</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/avoid-vendor-lock-in-with-minio-and-openzfs/\" rel=\"nofollow\">Avoid Infrastructure Vendor Lock-in by leveraging MinIO and OpenZFS</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.daemonology.net/blog/2022-10-18-FreeBSD-Firecracker.html\" rel=\"nofollow\">Announcing the FreeBSD/Firecracker platform</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://lowendbox.com/blog/how-much-faster-is-making-a-tar-archive-without-gzip/\" rel=\"nofollow\">How Much Faster Is Making A Tar Archive Without Gzip?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.dbi-services.com/blog/postgresql-from-packages-on-openbsd/\" rel=\"nofollow\">PostgreSQL from packages on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2022/10/18/upgrading-an-nvme-zpool-from-222g-to-1tb-drives/\" rel=\"nofollow\">Upgrading an NVMe zpool from 222G to 1TB drives</a></h3>\n\n<hr>\n\n<h3><a href=\"https://unixsheikh.com/articles/dont-use-reddit-for-linux-or-bsd-related-questions.html\" rel=\"nofollow\">PSA: Don&#39;t use Reddit for Linux or BSD related questions</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hinnerk%20-%20vnet%20jails.md\" rel=\"nofollow\">Hinnerk - vnet jails</a><br>\nTom’s response example: <a href=\"https://adventurist.me/posts/00304\" rel=\"nofollow\">https://adventurist.me/posts/00304</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/Hugo%20-%20Apple%20M2.md\" rel=\"nofollow\">Hugo - Apple M2</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/481/feedback/kevin%20-%20emacs%20backspace.md\" rel=\"nofollow\">kevin - emacs backspace</a><br>\n)</p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"FreeBSD Q3 2022 status report, Leveraging MinIO and OpenZFS to avoid vendor lock in, FreeBSD on Firecracker platform, How Much Faster Is Making A Tar Archive Without Gzip, Postgres from packages on OpenBSD, Upgrading an NVMe zpool from 222G to 1TB drives, Don't use Reddit for Linux or BSD related questions, and more.","date_published":"2022-11-17T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f0df0143-84f7-40aa-9802-be21a870c0c1.mp3","mime_type":"audio/mpeg","size_in_bytes":50564656,"duration_in_seconds":2874}]},{"id":"304e9711-6a86-42b7-a144-191aa1f900b7","title":"480: OpenBSD 7.2","url":"https://www.bsdnow.tv/480","content_text":"OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD 7.2 has been released\n\n\nFuguIta 7.2 is out as well\n***\n### Keeping FreeBSD Secure: Learn the Whys and Hows with the FreeBSD Sec Team\n\n\n\n\nNews Roundup\n\nHowto: be notified of FreeBSD upgrades, security updates and package updates at login\n\n\n\nAds blocking with OpenBSD unbound(8)\n\n\n\nFurther memory protections committed to -current\n\n\n\nBeastie Bits\n\n• [“OpenBSD Mastery: Filesystems” Print/Ebook Bundle Preorder](https://mwl.io/archives/22352)\n• [Klara is hiring a FreeBSD Kernel Developer](https://klarasystems.com/careers/freebsd-kernel-developer/)\n• [FreeBSD 12.4-BETA1 Now Available](https://lists.freebsd.org/archives/freebsd-stable/2022-October/000920.html)\n• [Hunting kernel lock and interrupt latency](https://mail-index.netbsd.org/tech-kern/2022/10/30/msg028499.html)\n• [EuroBSDcon 2022 videos available](https://undeadly.org/cgi?action=article;sid=20221027232308)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nCharles - BSD Now Bingo\nJake - FreeBSD Security defaults\nSam - FreeBSD and SSDs\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openbsd.org/72.html\" rel=\"nofollow\">OpenBSD 7.2 has been released</a></h3>\n\n<ul>\n<li><a href=\"https://fuguita.org/index.php?FuguIta%2F7.2=\" rel=\"nofollow\">FuguIta 7.2 is out as well</a>\n***\n### <a href=\"https://freebsdfoundation.org/blog/keeping-freebsd-secure-learn-the-whys-and-hows-with-the-freebsd-sec-team/\" rel=\"nofollow\">Keeping FreeBSD Secure: Learn the Whys and Hows with the FreeBSD Sec Team</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://forums.freebsd.org/threads/howto-be-notified-of-freebsd-upgrades-security-updates-and-package-updates-at-login.86660/\" rel=\"nofollow\">Howto: be notified of FreeBSD upgrades, security updates and package updates at login</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2022/ads-blocking-with-openbsd-unbound8/\" rel=\"nofollow\">Ads blocking with OpenBSD unbound(8)</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20221008100649\" rel=\"nofollow\">Further memory protections committed to -current</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [“OpenBSD Mastery: Filesystems” Print/Ebook Bundle Preorder](https://mwl.io/archives/22352)\n• [Klara is hiring a FreeBSD Kernel Developer](https://klarasystems.com/careers/freebsd-kernel-developer/)\n• [FreeBSD 12.4-BETA1 Now Available](https://lists.freebsd.org/archives/freebsd-stable/2022-October/000920.html)\n• [Hunting kernel lock and interrupt latency](https://mail-index.netbsd.org/tech-kern/2022/10/30/msg028499.html)\n• [EuroBSDcon 2022 videos available](https://undeadly.org/cgi?action=article;sid=20221027232308)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Charles%20-%20BSD%20Now%20Bingo.md\" rel=\"nofollow\">Charles - BSD Now Bingo</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Jake%20-%20FreeBSD%20Security%20defaults.md\" rel=\"nofollow\">Jake - FreeBSD Security defaults</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/480/feedback/Sam%20-%20FreeBSD%20and%20SSDs.md\" rel=\"nofollow\">Sam - FreeBSD and SSDs</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD 7.2 and FuguIta have been released, Learn the Whys and Hows with the FreeBSD Sec Team, how to get notified about FreeBSD updates, using unbound for ad blocking on OpenBSD, further memory protections on OpenBSD current, and more. ","date_published":"2022-11-10T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/304e9711-6a86-42b7-a144-191aa1f900b7.mp3","mime_type":"audio/mpeg","size_in_bytes":46963584,"duration_in_seconds":2935}]},{"id":"1f8daae0-ec33-4016-b70d-b6a31783eeea","title":"479: OpenBSD Docker Host","url":"https://www.bsdnow.tv/479","content_text":"EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nEuroBSDCon 2022, my first BSD conference (and how they are different)\n\n\n\nRed Hat’s OpenShift vs FreeBSD Jails\n\n\n\nNews Roundup\n\nThe history of sending signals to Unix process groups\n\n\n\nRunning a Docker Host under OpenBSD using vmd(8)\n\n\n\nToolchains adventures - Q3 2022\n\n\n\nBeastie Bits\n\n-current has moved to 7.2\nSeveral /sbin daemons are now dynamically-linked\nAnnouncing the pkgsrc 2022Q3 branch\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nHans - datacenters and dust\nTim - Boot issue\naaron- dwm tiling\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2022/09/25/eurobsdcon-2022-my-first-bsd-conference-and-how-they-are-different/\" rel=\"nofollow\">EuroBSDCon 2022, my first BSD conference (and how they are different)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/red-hats-openshift-vs-freebsd-jails/\" rel=\"nofollow\">Red Hat’s OpenShift vs FreeBSD Jails</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessGroupsAndSignals\" rel=\"nofollow\">The history of sending signals to Unix process groups</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2022/running-docker-host-openbsd-vmd/\" rel=\"nofollow\">Running a Docker Host under OpenBSD using vmd(8)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/toolchains-adventures-q3-2022/\" rel=\"nofollow\">Toolchains adventures - Q3 2022</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://undeadly.org/cgi?action=article;sid=20220912055003\" rel=\"nofollow\">-current has moved to 7.2</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20220830052924\" rel=\"nofollow\">Several /sbin daemons are now dynamically-linked</a><br>\n<a href=\"https://mail-index.netbsd.org/netbsd-announce/2022/09/29/msg000341.html\" rel=\"nofollow\">Announcing the pkgsrc 2022Q3 branch</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Hans%20-%20datacenters%20and%20dust.md\" rel=\"nofollow\">Hans - datacenters and dust</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/Tim%20-%20Boot%20issue.md\" rel=\"nofollow\">Tim - Boot issue</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/476/feedback/aaron-%20dwm%20tiling%20.md\" rel=\"nofollow\">aaron- dwm tiling</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"EuroBSDcon 2022 as first BSD conference, Red Hat’s OpenShift vs FreeBSD Jails, Running a Docker Host under OpenBSD using vmd(8), history of sending signals to Unix process groups, Toolchains adventures - Q3 2022, and more","date_published":"2022-11-03T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1f8daae0-ec33-4016-b70d-b6a31783eeea.mp3","mime_type":"audio/mpeg","size_in_bytes":40382208,"duration_in_seconds":2523}]},{"id":"1cacdcc7-e6f6-4193-b76d-f99ab20f08fc","title":"478: Debunking sudo myths ","url":"https://www.bsdnow.tv/478","content_text":"Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpen Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward?\n\n\n\nYour Comprehensive Guide to rc(8): FreeBSD Services and Automation\n\n\n\nNews Roundup\n\nHow Rob Pike got hired by Dennis Richie\n\n\n\nCartron asks what FreeBSD machines I use\n\n\n\nMy new debugbreak command\n\n\n\n7 sudo myths debunked\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAndy - sharing and acls\nReptilicus Rex - boot environments\ni3luefire - byhve issue\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://bsdly.blogspot.com/2022/09/open-source-in-enterprise-environments.html\" rel=\"nofollow\">Open Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/rc8-freebsd-services-and-automation/\" rel=\"nofollow\">Your Comprehensive Guide to rc(8): FreeBSD Services and Automation</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://minnie.tuhs.org/pipermail/tuhs/2022-September/026506.html\" rel=\"nofollow\">How Rob Pike got hired by Dennis Richie</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/cartron-asks-what-freebsd-machines-i-use/\" rel=\"nofollow\">Cartron asks what FreeBSD machines I use</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nullprogram.com/blog/2022/07/31/\" rel=\"nofollow\">My new debugbreak command</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opensource.com/article/22/8/debunk-sudo-myths\" rel=\"nofollow\">7 sudo myths debunked</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Andy%20-%20sharing%20and%20acls.md\" rel=\"nofollow\">Andy - sharing and acls</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/Reptilicus%20Rex%20-%20boot%20environments.md\" rel=\"nofollow\">Reptilicus Rex - boot environments</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/478/feedback/i3luefire%20-%20byhve%20issue.md\" rel=\"nofollow\">i3luefire - byhve issue</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Open Source in Enterprise Environments, Your Comprehensive Guide to rc(8): FreeBSD Services and Automation, How Rob Pike got hired by Dennis Richie, what FreeBSD machines rubenerd uses, new debugbreak command, 7 sudo myths debunked","date_published":"2022-10-27T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1cacdcc7-e6f6-4193-b76d-f99ab20f08fc.mp3","mime_type":"audio/mpeg","size_in_bytes":66564288,"duration_in_seconds":2773}]},{"id":"58511dab-5dc9-4024-9373-30c152784856","title":"477: Uninitialized Memory Disclosures","url":"https://www.bsdnow.tv/477","content_text":"Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nMindshare: Analyzing Bsd Kernels for Uninitialized Memory Disclosures Using Binary Ninja\n\n\n\nSharing Dual-Licensed Drivers between Linux and FreeBSD\n\n\n\nNews Roundup\n\nA Few of My Favorite Things About The OpenBSD Packet Filter Tools\n\n\n\nHow to trigger services restart after OpenBSD update\n\n\n\nGems from the Man Page Trenches\n\n\n\nBeastie Bits\n\nThe MIPS ThinkPad\nNix Gems\nRunning PalmOS without PalmOS\n\"OpenBSD Mastery: Filesystems\" draft done!\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - zfs and databases\nKevin - EMACS\nMichal - virtual OSS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.zerodayinitiative.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-binary-ninja\" rel=\"nofollow\">Mindshare: Analyzing Bsd Kernels for Uninitialized Memory Disclosures Using Binary Ninja</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/sharing-dual-licensed-drivers-between-linux-and-freebsd/\" rel=\"nofollow\">Sharing Dual-Licensed Drivers between Linux and FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://nxdomain.no/%7Epeter/better_off_with_pf.html\" rel=\"nofollow\">A Few of My Favorite Things About The OpenBSD Packet Filter Tools</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-09-25-openbsd-reboot-syspatch.html\" rel=\"nofollow\">How to trigger services restart after OpenBSD update</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.saminiir.com/gems-from-man-page-trenches/\" rel=\"nofollow\">Gems from the Man Page Trenches</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://oldvcr.blogspot.com/2022/09/the-mips-thinkpad-kind-of.html\" rel=\"nofollow\">The MIPS ThinkPad</a><br>\n<a href=\"https://gitlab.com/DeaDSouL/NixGems\" rel=\"nofollow\">Nix Gems</a><br>\n<a href=\"https://pmig96.wordpress.com/2022/09/18/running-palmos-without-palmos/\" rel=\"nofollow\">Running PalmOS without PalmOS</a><br>\n<a href=\"https://mwl.io/archives/22303\" rel=\"nofollow\">&quot;OpenBSD Mastery: Filesystems&quot; draft done!</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Brad%20-%20zfs%20and%20databases.md\" rel=\"nofollow\">Brad - zfs and databases</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Kevin%20-%20EMACS.md\" rel=\"nofollow\">Kevin - EMACS</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/477/feedback/Michal%20-%20virtual%20OSS.md\" rel=\"nofollow\">Michal - virtual OSS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Analyzing BSD Kernels for Uninitialized Memory Disclosures Using Binary Ninja, Sharing Dual-Licensed Drivers between Linux and FreeBSD, favorite Things About The OpenBSD Packet Filter Tools, How to trigger services restart after OpenBSD update, Gems from the Man Page Trenches, and more.","date_published":"2022-10-20T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/58511dab-5dc9-4024-9373-30c152784856.mp3","mime_type":"audio/mpeg","size_in_bytes":67616640,"duration_in_seconds":2817}]},{"id":"64bc3a0c-43cf-4e97-af97-b31d799c1154","title":"476: Warren Toomey interview","url":"https://www.bsdnow.tv/476","content_text":"In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\n\n\nInterview - Warren Toomey - wkt@tuhs.org\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Warren Toomey.","content_html":"<p>In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<hr>\n\n<h2>Interview - Warren Toomey - <a href=\"mailto:wkt@tuhs.org\" rel=\"nofollow\">wkt@tuhs.org</a></h2>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Warren Toomey.</p>","summary":"In this special episode, we interview Warren Toomey from the Unix Historical Society. We chat about his involvement in preserving old Unix systems and why that is important.","date_published":"2022-10-13T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/64bc3a0c-43cf-4e97-af97-b31d799c1154.mp3","mime_type":"audio/mpeg","size_in_bytes":64196352,"duration_in_seconds":2674}]},{"id":"8308672c-2f88-4a7b-9619-ed61184f731d","title":"475: Prompt Injection Attacks","url":"https://www.bsdnow.tv/475","content_text":"Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nPrompt injection attacks against GPT-3\n\n\n\nA Quick Look at the History of Package Management on FreeBSD\n\n\n\nNews Roundup\n\nA fresh look at FreeBSD\n\n\n\nFile Management Tools for Your Favorite Shell\n\n\n\nVideo Playback on FreeBSD – Quick Guide\n\n\n\nBeastie Bits\n\nps(1) gains support for tree-like display of processes\n... interesting old-timey UNIXes ...\nA retro style online SSH client to play Nethack\nThe Good, the Bad, and the Ugly: The Unix! Legacy\nGame of Trees 0.75 released\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKen - HPR\nKevin - FreeBSD and EMACS\nNathan - Handbook contribution Question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://simonwillison.net/2022/Sep/12/prompt-injection/\" rel=\"nofollow\">Prompt injection attacks against GPT-3</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/a-quick-look-at-the-history-of-package-management-on-freebsd/\" rel=\"nofollow\">A Quick Look at the History of Package Management on FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://liam-on-linux.dreamwidth.org/86277.html\" rel=\"nofollow\">A fresh look at FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://thevaluable.dev/file-management-tools-linux-shell/\" rel=\"nofollow\">File Management Tools for Your Favorite Shell</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/resource/video-playback-on-freebsd-quick-guide/\" rel=\"nofollow\">Video Playback on FreeBSD – Quick Guide</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20220902085038\" rel=\"nofollow\">ps(1) gains support for tree-like display of processes</a><br>\n<a href=\"https://minnie.tuhs.org/pipermail/tuhs/2022-September/026393.html\" rel=\"nofollow\">... interesting old-timey UNIXes ...</a><br>\n<a href=\"https://nethack.glitch.me/?retro=true\" rel=\"nofollow\">A retro style online SSH client to play Nethack</a><br>\n<a href=\"http://herpolhode.com/rob/ugly.pdf\" rel=\"nofollow\">The Good, the Bad, and the Ugly: The Unix! Legacy</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20220910120430\" rel=\"nofollow\">Game of Trees 0.75 released</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Ken%20-%20HPR.md\" rel=\"nofollow\">Ken - HPR</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Kevin%20-%20FreeBSD%20and%20EMACS.md\" rel=\"nofollow\">Kevin - FreeBSD and EMACS</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/475/feedback/Nathan%20-%20Handbook%20contribution%20Question.md\" rel=\"nofollow\">Nathan - Handbook contribution Question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Prompt injection attacks against GPT-3, the History of Package Management on FreeBSD, A fresh look at FreeBSD, File Management Tools for Your Favorite Shell, Quick Guide about Video Playback on FreeBSD, and more. ","date_published":"2022-10-06T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8308672c-2f88-4a7b-9619-ed61184f731d.mp3","mime_type":"audio/mpeg","size_in_bytes":68584320,"duration_in_seconds":2857}]},{"id":"7b0f6fc2-b232-4eb6-87e8-d945c7a02f25","title":"474: EuroBSDcon 2022","url":"https://www.bsdnow.tv/474","content_text":"Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDeploying FreeBSD on Oracle Cloud\n\n\n\nThe Things Spammers Believe - A Tale of 300,000 Imaginary Friends\n\n\n\nEuroBSDcon 2022\n\n\n\nNews Roundup\n\n“OpenBSD Mastery: Filesystems” Status Report\n\n\n\nOpenBGPD 7.6 Released\n\n\n\nOpenBSD may soon gain further memory protections: immutable userland mappings\n\n\n\nPortable OpenSSH commits now SSH-signed\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/deploying-freebsd-on-oracle-cloud/\" rel=\"nofollow\">Deploying FreeBSD on Oracle Cloud</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdly.blogspot.com/2022/09/the-things-spammers-believe-tale-of.html\" rel=\"nofollow\">The Things Spammers Believe - A Tale of 300,000 Imaginary Friends</a></h3>\n\n<hr>\n\n<h3><a href=\"https://peter.czanik.hu/posts/eurobsdcon2022/\" rel=\"nofollow\">EuroBSDcon 2022</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mwl.io/archives/22031\" rel=\"nofollow\">“OpenBSD Mastery: Filesystems” Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20220916051806\" rel=\"nofollow\">OpenBGPD 7.6 Released</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20220902100648\" rel=\"nofollow\">OpenBSD may soon gain further memory protections: immutable userland mappings</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20220902045137\" rel=\"nofollow\">Portable OpenSSH commits now SSH-signed</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Deploying FreeBSD on Oracle Cloud, A Tale of 300,000 Imaginary Friends, EuroBSDcon 2022 recap, OpenBSD Mastery: Filesystems” Status Report, OpenBGPD 7.6 Released, immutable userland mappings, Portable OpenSSH commits now SSH-signed, and more.","date_published":"2022-09-29T03:15:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b0f6fc2-b232-4eb6-87e8-d945c7a02f25.mp3","mime_type":"audio/mpeg","size_in_bytes":66559680,"duration_in_seconds":2773}]},{"id":"3adcda1d-0fbb-4a3a-a4cb-b63c6268b837","title":"473: Rusty Kernel Modules","url":"https://www.bsdnow.tv/473","content_text":"Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWriting FreeBSD Kernel modules in Rust\n\n\n\nDetails behind the FreeBSD aio LPE\n\n\n\nNews Roundup\n\nLinux Subsystem for FreeBSD\n\n\n\nFreeBSD Journal: Science, Systems, and FreeBSD \n\n\n\nNetBSD improves its support for the Commodore Amiga\n\n\n\nInstalling OpenBSD on Scaleway Elastic Metal\n\n\n\nBeastie Bits\n\n\n/usr/games removed from the default $PATH\nHow to install and configure mDNSResponder\nHow to use consistent exit codes in shell scripts\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n[TheHolm - zfs question)[https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md]\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://research.nccgroup.com/2022/08/31/writing-freebsd-kernel-modules-in-rust/\" rel=\"nofollow\">Writing FreeBSD Kernel modules in Rust</a></h3>\n\n<hr>\n\n<h3><a href=\"https://accessvector.net/2022/freebsd-aio-lpe\" rel=\"nofollow\">Details behind the FreeBSD aio LPE</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://medium.com/nttlabs/linux-subsystem-for-freebsd-500b9a88fda4\" rel=\"nofollow\">Linux Subsystem for FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/wp-content/uploads/2022/08/03ae2705ab4362602a6bb90c5b9628c595d8b4fa.2.pdf\" rel=\"nofollow\">FreeBSD Journal: Science, Systems, and FreeBSD </a></h3>\n\n<hr>\n\n<h3><a href=\"https://thenewstrace.com/netbsd-an-operating-system-that-is-serious-about-being-cross-platform-now-improves-its-support-for-the-commodore-amiga-1985/243892/\" rel=\"nofollow\">NetBSD improves its support for the Commodore Amiga</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.senzilla.io/blog/2022/08/10/installing-openbsd-scaleway-elastic-metal/\" rel=\"nofollow\">Installing OpenBSD on Scaleway Elastic Metal</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><p><a href=\"http://undeadly.org/cgi?action=article;sid=20220810120423\" rel=\"nofollow\">/usr/games removed from the default $PATH</a></p></li>\n<li><p><a href=\"https://forums.FreeBSD.org/threads/how-to-install-and-configure-mdnsresponder.70713/\" rel=\"nofollow\">How to install and configure mDNSResponder</a></p></li>\n<li><p><a href=\"https://sleeplessbeastie.eu/2022/08/12/how-to-use-consistent-exit-codes-in-shell-scripts\" rel=\"nofollow\">How to use consistent exit codes in shell scripts</a></p>\n\n<hr></li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>[TheHolm - zfs question)[<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/TheHolm%20-%20zfs%20question.md</a>]\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Writing FreeBSD kernel modules in Rust, Details behind the FreeBSD aio LPE, Linux subsystem for FreeBSD, FreeBSD Journal: Science, Systems, and FreeBSD, NetBSD improves Amiga support, OpenBSD on Scaleway Elastic Metal, and more","date_published":"2022-09-22T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3adcda1d-0fbb-4a3a-a4cb-b63c6268b837.mp3","mime_type":"audio/mpeg","size_in_bytes":66747456,"duration_in_seconds":2781}]},{"id":"8d63b5c4-f59c-4142-a030-f0791de6b56a","title":"472: Consistent Exit Code","url":"https://www.bsdnow.tv/472","content_text":"FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD on the Framework laptop\n\n\n\nWin32 is the only stable ABI on Linux\n\n\n\nNews Roundup\n\nWhy is the OpenBSD documentation so good?\n\n\n\nHow I configure dma for mail delivery in jails on my internet hosts\n\n\n\nIntroducing muxfs\n\n\n\nRAID 1C boot support added\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n[Oliver - shell tip)[https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md]\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://xyinn.org/md/freebsd/framework_laptop\" rel=\"nofollow\">FreeBSD on the Framework laptop</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.hiler.eu/win32-the-only-stable-abi/\" rel=\"nofollow\">Win32 is the only stable ABI on Linux</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-08-18-why-openbsd-documentation-is-good.html\" rel=\"nofollow\">Why is the OpenBSD documentation so good?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2022/08/15/how-i-configure-dma-for-mail-delivery-in-jails-on-my-internet-hosts/\" rel=\"nofollow\">How I configure dma for mail delivery in jails on my internet hosts</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sdadams.org/blog/introducing-muxfs/\" rel=\"nofollow\">Introducing muxfs</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20220813110021\" rel=\"nofollow\">RAID 1C boot support added</a></h3>\n\n<hr>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>[Oliver - shell tip)[<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/469/feedback/Oliver%20-%20shell%20tip.md</a>]</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD on the Framework Laptop, Win32 is the only stable ABI on Linux, why OpenBSD’s documentation is so good, configure dma for mail delivery in jails on internet hosts, introducing muxfs, RAID1C boot support, and more","date_published":"2022-09-15T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8d63b5c4-f59c-4142-a030-f0791de6b56a.mp3","mime_type":"audio/mpeg","size_in_bytes":65335680,"duration_in_seconds":2722}]},{"id":"6550223a-8916-4ffc-ab29-30b5caa18d2c","title":"471: De-Penguinization","url":"https://www.bsdnow.tv/471","content_text":"Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nTen Things To Do After Installing FreeBSD\n\n\n\nNews Roundup\n\nhpr3655 :: BSD for Linux users\n\n\n\nr2k22 Hackathon Report: Job Snijders (job@) on rpki-client and more\n\n\n\nConfiguring OpenIKED\n\n\n\nDe-Penguin Me\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://bastillebsd.org/blog/2022/07/14/ten-things-to-do-after-installing-freebsd/\" rel=\"nofollow\">Ten Things To Do After Installing FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://hackerpublicradio.org/eps.php?id=3655\" rel=\"nofollow\">hpr3655 :: BSD for Linux users</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20220701171631\" rel=\"nofollow\">r2k22 Hackathon Report: Job Snijders (job@) on rpki-client and more</a></h3>\n\n<hr>\n\n<h3><a href=\"https://wiki.ircnow.org/index.php?n=Iked.Configure\" rel=\"nofollow\">Configuring OpenIKED</a></h3>\n\n<hr>\n\n<h3><a href=\"https://depenguin.me/\" rel=\"nofollow\">De-Penguin Me</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Ten Things To Do After Installing FreeBSD, BSD for Linux users, r2k22 Hackathon Report on rpki-client, Configuring OpenIKED, De-Penguin Me, and more ","date_published":"2022-09-08T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6550223a-8916-4ffc-ab29-30b5caa18d2c.mp3","mime_type":"audio/mpeg","size_in_bytes":70774272,"duration_in_seconds":2948}]},{"id":"3f9451dd-059e-44da-9055-d7e119765d55","title":"470: 0mp interview","url":"https://www.bsdnow.tv/470","content_text":"In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nInterview - Mateusz Piotrowski - 0mp@freebsd.org / @0mpts\n\nInterview\n\n\nBR: Welcome Mateusz. Can you tell our audience a bit about yourself and how you got started with Unix/BSD?\nTJ: What can we blame you for (prior/current work, planned projects)?\nBR: You served as the first doceng secretary and joined the FreeBSD core team in this term. What interested you in these roles and what do you want to accomplish in this term?\nTJ: You are also busy with maintaining some FreeBSD ports. What ports are those?\nBR: Can you tell us a bit about your thesis work?\nTJ: What does open source work mean for you?\nBR: Do you have a cool Unix/BSD tip for us?\nTJ: Is there anything else that you'd like to mention before we let you go?\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Mateusz Piotrowski.","content_html":"<p>In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h2>Interview - Mateusz Piotrowski - <a href=\"mailto:0mp@freebsd.org\" rel=\"nofollow\">0mp@freebsd.org</a> / <a href=\"https://twitter.com/0mpts\" rel=\"nofollow\">@0mpts</a></h2>\n\n<p>Interview</p>\n\n<ul>\n<li>BR: Welcome Mateusz. Can you tell our audience a bit about yourself and how you got started with Unix/BSD?</li>\n<li>TJ: What can we blame you for (prior/current work, planned projects)?</li>\n<li>BR: You served as the first doceng secretary and joined the FreeBSD core team in this term. What interested you in these roles and what do you want to accomplish in this term?</li>\n<li>TJ: You are also busy with maintaining some FreeBSD ports. What ports are those?</li>\n<li>BR: Can you tell us a bit about your thesis work?</li>\n<li>TJ: What does open source work mean for you?</li>\n<li>BR: Do you have a cool Unix/BSD tip for us?</li>\n<li>TJ: Is there anything else that you&#39;d like to mention before we let you go?</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Mateusz Piotrowski.</p>","summary":"In this special episode, we are interviewing Mateusz Piotrowski about his various roles in the FreeBSD project, his ports work, and a few other interesting things he’s involved with. Enjoy this interview episode, we’ll be back with a regular episode next week.  ","date_published":"2022-09-01T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3f9451dd-059e-44da-9055-d7e119765d55.mp3","mime_type":"audio/mpeg","size_in_bytes":75793536,"duration_in_seconds":3158}]},{"id":"7c5cb6f6-6eba-4430-9347-89e87c1e230b","title":"469: Ctrl-C Reset","url":"https://www.bsdnow.tv/469","content_text":"FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t \"Reset\" Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Q2 2022 Status Report\n\n\n\nFreeBSD in Science\n\n\n\nNews Roundup\n\nFastest yes(1) in the west\n\n\n\nCtrl-C: Why Programmers Can’t \"Reset\" Programs With Ctrl-C, but Used to Be Able To, and Why They Should Be Able to Again\n\n\n\nRun Slack in FreeBSD’s Linuxulator\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2022-04-2022-06/\" rel=\"nofollow\">FreeBSD Q2 2022 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/guest-post-freebsd-in-science/\" rel=\"nofollow\">FreeBSD in Science</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://codegolf.stackexchange.com/questions/199528/fastest-yes-in-the-west/199622#199622\" rel=\"nofollow\">Fastest yes(1) in the west</a></h3>\n\n<hr>\n\n<h3><a href=\"https://kevinlawler.com/ctrl-c\" rel=\"nofollow\">Ctrl-C: Why Programmers Can’t &quot;Reset&quot; Programs With Ctrl-C, but Used to Be Able To, and Why They Should Be Able to Again</a></h3>\n\n<hr>\n\n<h3><a href=\"https://meka.rs/blog/2022/07/01/freebsd-linuxulator/\" rel=\"nofollow\">Run Slack in FreeBSD’s Linuxulator</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Q2 2022 Status Report, FreeBSD in Science, fastest yes(1) in the west, Why Programmers Can’t \"Reset\" Programs With Ctrl-C, Run Slack in FreeBSD’s Linuxulator, and more.","date_published":"2022-08-25T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7c5cb6f6-6eba-4430-9347-89e87c1e230b.mp3","mime_type":"audio/mpeg","size_in_bytes":61200576,"duration_in_seconds":2550}]},{"id":"8142f047-532d-4b74-9f4f-45ee6e5f5e57","title":"468: Apples and CHERI","url":"https://www.bsdnow.tv/468","content_text":"Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more\n\nNotes\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nAdvocating for FreeBSD in 2022 and Beyond\n\n\n\nNetBSD 9.3 released\n\n\n\nNews Roundup\n\nOPNsense 22.7 released\n\n\n\nCHERI-based computer runs KDE for the first time\n\n\n\nGuide: Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac\n\n\n\nBeastie Bits\n\n• [In -current, dhclient(8) now just logs warnings and executes ifconfig(8)](http://undeadly.org/cgi?action=article;sid=20220703114819)\n• [Freshly installed #NetBSD 4.0.1 booting on a 80386 DX40 with 8MB of RAM in 2022](https://twitter.com/lefinnois/status/1553246084675375104)\n• [nerdctl](https://twitter.com/woodsb02/status/1554481441060560898?s=28&amp;t=8K7_A1RiWnCDU_Mme4_Yqw)\n• [Even more Randomness](https://undeadly.org/cgi?action=article;sid=20220731110742)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more</p>\n\n<p><strong><em>Notes</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/advocating-for-freebsd-in-2022-and-beyond/\" rel=\"nofollow\">Advocating for FreeBSD in 2022 and Beyond</a></h3>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/netbsd_9_3_released\" rel=\"nofollow\">NetBSD 9.3 released</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://forum.opnsense.org/index.php?topic=29507.0\" rel=\"nofollow\">OPNsense 22.7 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.theregister.com/2022/07/26/cheri_computer_runs_kde/\" rel=\"nofollow\">CHERI-based computer runs KDE for the first time</a></h3>\n\n<hr>\n\n<h3><a href=\"https://gist.github.com/ctsrc/a1f57933a2cde9abc0f07be12889f97f\" rel=\"nofollow\">Guide: Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [In -current, dhclient(8) now just logs warnings and executes ifconfig(8)](http://undeadly.org/cgi?action=article;sid=20220703114819)\n• [Freshly installed #NetBSD 4.0.1 booting on a 80386 DX40 with 8MB of RAM in 2022](https://twitter.com/lefinnois/status/1553246084675375104)\n• [nerdctl](https://twitter.com/woodsb02/status/1554481441060560898?s=28&amp;t=8K7_A1RiWnCDU_Mme4_Yqw)\n• [Even more Randomness](https://undeadly.org/cgi?action=article;sid=20220731110742)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Advocating for FreeBSD in 2022 and Beyond, NetBSD 9.3 released, OPNsense 22.7 available, CHERI-based computer runs KDE for the first time, Run FreeBSD 13.1-RELEASE for ARM64 in QEMU on Apple Silicon Mac, and more","date_published":"2022-08-18T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8142f047-532d-4b74-9f4f-45ee6e5f5e57.mp3","mime_type":"audio/mpeg","size_in_bytes":22136952,"duration_in_seconds":2299}]},{"id":"9b71b507-e030-4903-b7ea-9abf525548cd","title":"467: Minecraft on NetBSD","url":"https://www.bsdnow.tv/467","content_text":"Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the yes Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nInstalling BSDs on Cubieboard1\n\n\n\nSelf-hosting a static site with OpenBSD, httpd, and relayd\n\nNews Roundup\n\nNetBSD can also run a Minecraft server\n\n\n\nA Little Story About the yes Unix Command\n\n\n\nShell History: Unix\n\n\n\nOpenBGPD 7.5 released\n\n\n\nBeastie Bits\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nLudensen - Feedback\nVidar - OpenRGB\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the <code>yes</code> Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://mekboy.ru/post/bsd-on-cubieboard1.en/\" rel=\"nofollow\">Installing BSDs on Cubieboard1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://citizen428.net/blog/self-hosting-static-site-openbsd-httpd-relayd/\" rel=\"nofollow\">Self-hosting a static site with OpenBSD, httpd, and relayd</a></h3>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rubenerd.com/netbsd-can-also-run-a-minecraft-server/\" rel=\"nofollow\">NetBSD can also run a Minecraft server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://endler.dev/2017/yes/\" rel=\"nofollow\">A Little Story About the <code>yes</code> Unix Command</a></h3>\n\n<hr>\n\n<h3><a href=\"https://portal.mozz.us/gemini/auragem.space/%7Ekrixano/ShellHistory-Unix.pdf\" rel=\"nofollow\">Shell History: Unix</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20220716101930\" rel=\"nofollow\">OpenBGPD 7.5 released</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Ludensen%20-%20Feedback.md\" rel=\"nofollow\">Ludensen - Feedback</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/467/feedback/Vidar%20-%20OpenRGB.md\" rel=\"nofollow\">Vidar - OpenRGB</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Installing BSDs on Cubieboard1, Self-hosting a static site with OpenBSD, httpd, and relayd, NetBSD can also run a Minecraft server, A Little Story About the `yes` Unix Command, Shell History: Unix, OpenBGPD 7.5 released, and more","date_published":"2022-08-11T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b71b507-e030-4903-b7ea-9abf525548cd.mp3","mime_type":"audio/mpeg","size_in_bytes":29179728,"duration_in_seconds":2910}]},{"id":"507205dc-d2f0-4e96-ba40-fea8171e2125","title":"466: cat(1)’s efficiency","url":"https://www.bsdnow.tv/466","content_text":"Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nContributing to Open Source Beyond Software Development\n\n\n\nCrypto Ancienne 2.0 now brings TLS 1.3 to the Internet of Old Things (except BeOS)\n\n\n\nNews Roundup\n\nHow efficient can cat(1) be?\n\n\n\nTechnique significantly boosts the speeds of programs that run in the Unix shell\n\n• [binpa.sh](http://binpa.sh/)\n\n\n\n\nRunning FreeBSD VNET Jails on AWS EC2 with Bastille\n\n\n\nBeastie Bits\n\nGame of Trees 0.74 released\nOpenBSD -current has moved to 7.2-beta\nA Unix Command Line Crash Course\nBSD.DOG vimrc\nFreeBSD Speedruns\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/contributing-to-open-source-beyond-software-development/\" rel=\"nofollow\">Contributing to Open Source Beyond Software Development</a></h3>\n\n<hr>\n\n<h3><a href=\"https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html\" rel=\"nofollow\">Crypto Ancienne 2.0 now brings TLS 1.3 to the Internet of Old Things (except BeOS)</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://ariadne.space/2022/07/17/how-efficient-can-cat1-be/\" rel=\"nofollow\">How efficient can cat(1) be?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://techxplore.com/news/2022-06-technique-significantly-boosts-unix-shell.html\" rel=\"nofollow\">Technique significantly boosts the speeds of programs that run in the Unix shell</a></h3>\n\n<pre><code>• [binpa.sh](http://binpa.sh/)\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://pertho.net/posts/bastille-vnet-jails-ec2/\" rel=\"nofollow\">Running FreeBSD VNET Jails on AWS EC2 with Bastille</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"http://undeadly.org/cgi?action=article;sid=20220720220958\" rel=\"nofollow\">Game of Trees 0.74 released</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20220721122727\" rel=\"nofollow\">OpenBSD -current has moved to 7.2-beta</a><br>\n<a href=\"https://itnext.io/unix-command-line-crash-course-453e409d62f5\" rel=\"nofollow\">A Unix Command Line Crash Course</a><br>\n<a href=\"https://bsd.dog/project/bsd-dog-vimrc/\" rel=\"nofollow\">BSD.DOG vimrc</a><br>\n<a href=\"https://wiki.freebsd.org/Speedruns\" rel=\"nofollow\">FreeBSD Speedruns</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Contributing to Open Source Beyond Software Development, bringing TLS 1.3 to the Internet of Old Things, How efficient can cat(1) be, boost the speed of Unix shell programs, Running FreeBSD VNET Jails on AWS EC2 with Bastille, and more","date_published":"2022-08-04T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/507205dc-d2f0-4e96-ba40-fea8171e2125.mp3","mime_type":"audio/mpeg","size_in_bytes":32073600,"duration_in_seconds":3219}]},{"id":"f6b15e42-bd5a-47de-9df4-b207d0becb33","title":"465: Deep Space Debugging","url":"https://www.bsdnow.tv/465","content_text":"Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nNASA Programmer Remembers Debugging Lisp in Deep Space\n\n\n\n0 Dependency Websites with OpenBSD &amp; AsciiDoc\n\n\n\nNews Roundup\n\nFreeBSD - Deleting old snapshots\n\n\n\nFull multiprocess support in lldb-server\n\n\n\nBasic fix between pf tables and macros on FreeBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBen - Jail Question\nMalcolm - encryption\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD &amp; AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://thenewstack.io/nasa-programmer-remembers-debugging-lisp-in-deep-space/\" rel=\"nofollow\">NASA Programmer Remembers Debugging Lisp in Deep Space</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.passwordclass.xyz/blogs/2022/06/0-dependency-websites-with-openbsd-asciidoc.html\" rel=\"nofollow\">0 Dependency Websites with OpenBSD &amp; AsciiDoc</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.jan0sch.de/post/deleting-old-zfs-snapshots/\" rel=\"nofollow\">FreeBSD - Deleting old snapshots</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.moritz.systems/blog/full-multiprocess-support-in-lldb-server/\" rel=\"nofollow\">Full multiprocess support in lldb-server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/basic-fix-between-pf-tables-and-macros-on-freebsd/\" rel=\"nofollow\">Basic fix between pf tables and macros on FreeBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Ben%20-%20Jail%20Question.md\" rel=\"nofollow\">Ben - Jail Question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/464/feedback/Malcolm%20-%20encryption.md\" rel=\"nofollow\">Malcolm - encryption</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Debugging Lisp in Deep Space, 0 Dependency Websites with OpenBSD & AsciiDoc, Deleting old snapshots on FreeBSD, Full multiprocess support in lldb-server, Basic fix between pf tables and macros, and more","date_published":"2022-07-28T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f6b15e42-bd5a-47de-9df4-b207d0becb33.mp3","mime_type":"audio/mpeg","size_in_bytes":24400296,"duration_in_seconds":2325}]},{"id":"c5e043ce-2ec3-4eef-8d99-0ca38ed1fad5","title":"464: Compiling with kefir","url":"https://www.bsdnow.tv/464","content_text":"From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFrom 0 to Bhyve on FreeBSD 13.1\n\n\n\nAnalyze OpenBSD’s Kernel with Domain-Specific Knowledge\n\n\n\nNews Roundup\n\nOpenBSD Webzine: ISSUE #10\n\n\n\nHardenedBSD June 2022 Status Report\n\n\n\nOpenBSD has two new C compilers: chibicc and kefir\n\n\n\nSSD TRIM in NetBSD HEAD (-current)\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/from-0-to-bhyve-on-freebsd-13-1/\" rel=\"nofollow\">From 0 to Bhyve on FreeBSD 13.1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://medium.com/@chrissicool/analyze-openbsds-kernel-with-domain-specific-knowledge-ca665d92eebb\" rel=\"nofollow\">Analyze OpenBSD’s Kernel with Domain-Specific Knowledge</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://webzine.puffy.cafe/issue-10.html\" rel=\"nofollow\">OpenBSD Webzine: ISSUE #10</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2022-06-28/hardenedbsd-june-2022-status-report\" rel=\"nofollow\">HardenedBSD June 2022 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://briancallahan.net/blog/20220629.html\" rel=\"nofollow\">OpenBSD has two new C compilers: chibicc and kefir</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.unitedbsd.com/d/859-ssd-trim-in-netbsd-head-current\" rel=\"nofollow\">SSD TRIM in NetBSD HEAD (-current)</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"From 0 to bhyve on FreeBSD, Analyze OpenBSD’s Kernel with Domain-Specific Knowledge, OpenBSD Webzine: ISSUE #10, HardenedBSD June 2022 Status Report, two new C compilers: chibicc and kefir in OpenBSD, SSD TRIM in NetBSD HEAD, and more","date_published":"2022-07-21T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c5e043ce-2ec3-4eef-8d99-0ca38ed1fad5.mp3","mime_type":"audio/mpeg","size_in_bytes":23780520,"duration_in_seconds":2360}]},{"id":"3131f5d6-8a20-474b-94c3-1da8ebac50ce","title":"463: The 1.0 Legend","url":"https://www.bsdnow.tv/463","content_text":"Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nDifferences between base and ports LLVM in OpenBSD\n\n\n\nUsing Netgraph for FreeBSD’s bhyve Networking\n\n\n\nNews Roundup\n\nAudio on FreeBSD – Quick Guide\n\n[Legends start at 1.0! – FreeBSD in 1993]\n\n\nPart 1\nPart 2\n***\n### Hacker News running by FreeBSD. Take that, Linux!\n***\n### TrueNAS 13\n***\n\n\nBeastie Bits\n\n\nNotable OpenBSD news you may have missed, 2022-06-28 edition\nrEFInd design for all the BSDs\nOpenBGPD 7.4 released\nHotfix GhostBSD 22.06.18 ISO is now available\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - Jails Question\nFreezr - A few questions\nA different Brad - Drive question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.cambus.net/differences-between-base-and-ports-llvm-in-openbsd/\" rel=\"nofollow\">Differences between base and ports LLVM in OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/using-netgraph-for-freebsds-bhyve-networking/?utm_source=bsdweekly\" rel=\"nofollow\">Using Netgraph for FreeBSD’s bhyve Networking</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/freebsd-project/resources/audio-on-freebsd/\" rel=\"nofollow\">Audio on FreeBSD – Quick Guide</a></h3>\n\n<h3>[Legends start at 1.0! – FreeBSD in 1993]</h3>\n\n<ul>\n<li><a href=\"https://eerielinux.wordpress.com/2022/06/18/legends-start-at-1-0-freebsd-in-1993-pt-1/\" rel=\"nofollow\">Part 1</a></li>\n<li><a href=\"https://eerielinux.wordpress.com/2022/06/19/legends-start-at-1-0-freebsd-in-1993-pt-2/\" rel=\"nofollow\">Part 2</a>\n***\n### <a href=\"https://news.ycombinator.com/item?id=16076041\" rel=\"nofollow\">Hacker News running by FreeBSD. Take that, Linux!</a>\n***\n### <a href=\"https://www.theregister.com/2022/05/11/truenas_13_released/\" rel=\"nofollow\">TrueNAS 13</a>\n***</li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20220628135253\" rel=\"nofollow\">Notable OpenBSD news you may have missed, 2022-06-28 edition</a></li>\n<li><a href=\"https://github.com/indgy/refind-bsd-black\" rel=\"nofollow\">rEFInd design for all the BSDs</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20220619185920\" rel=\"nofollow\">OpenBGPD 7.4 released</a></li>\n<li><a href=\"http://ghostbsd.org/22.06.18_iso_is_now_available\" rel=\"nofollow\">Hotfix GhostBSD 22.06.18 ISO is now available</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Brad%20-%20Jails%20Question.md\" rel=\"nofollow\">Brad - Jails Question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/Freezr%20-%20A%20few%20questions.md\" rel=\"nofollow\">Freezr - A few questions</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/463/feedback/A%20different%20Brad%20-%20Drive%20question.md\" rel=\"nofollow\">A different Brad - Drive question</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Differences between base and ports LLVM in OpenBSD, Netgraph for FreeBSD’s bhyve Networking, Audio on FreeBSD – Quick Guide, FreeBSD’s Legend starts at 1.0, Hacker News running by FreeBSD, TrueNAS 13, and more","date_published":"2022-07-14T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3131f5d6-8a20-474b-94c3-1da8ebac50ce.mp3","mime_type":"audio/mpeg","size_in_bytes":32116704,"duration_in_seconds":3311}]},{"id":"6db1831f-5ad9-4b9b-a29d-6acb2e5399c6","title":"462: OpenBSD Sales Pitch","url":"https://www.bsdnow.tv/462","content_text":"The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe Design and Implementation of the NetBSD rc.d system\n\n\n\nHow I would sell OpenBSD as a salesperson\n\n\n\nNews Roundup\n\nSpeeding up autoconf with caching\n\n\n\nAllowing non-root execution of a jailed application\n\n\n\nConfigure login(1) and sshd(8) for YubiKey on OpenBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nGlen - Thanks Todd\nKarl - Memory Question\nalejandro - Tom's laptop\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://www.mewburn.net/luke/papers/rc.d.pdf\" rel=\"nofollow\">The Design and Implementation of the NetBSD rc.d system</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-06-22-openbsd-selling-arguments.html\" rel=\"nofollow\">How I would sell OpenBSD as a salesperson</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jmmv.dev/2022/06/autoconf-caching.html\" rel=\"nofollow\">Speeding up autoconf with caching</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.freebsd.org/threads/allowing-non-root-execution-of-a-jailed-application.85532/\" rel=\"nofollow\">Allowing non-root execution of a jailed application</a></h3>\n\n<hr>\n\n<h3><a href=\"https://romanzolotarev.com/openbsd/yubikey.html\" rel=\"nofollow\">Configure login(1) and sshd(8) for YubiKey on OpenBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Glen%20-%20Thanks%20Todd.md\" rel=\"nofollow\">Glen - Thanks Todd</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/Karl%20-%20Memory%20Question.md\" rel=\"nofollow\">Karl - Memory Question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/462/feedback/alejandro%20-%20Tom&#x27;s%20laptop.md\" rel=\"nofollow\">alejandro - Tom&#39;s laptop</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The Design and Implementation of the NetBSD rc.d system, selling OpenBSD as a salesperson, Speeding up autoconf with caching, Allowing non-root execution of a jailed application, Configure login(1) and sshd(8) for YubiKey on OpenBSD, and more.","date_published":"2022-07-07T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6db1831f-5ad9-4b9b-a29d-6acb2e5399c6.mp3","mime_type":"audio/mpeg","size_in_bytes":31027704,"duration_in_seconds":3229}]},{"id":"8809dc88-c752-4733-9f19-4bcd7e2ca683","title":"461: Persistent Memory Allocation","url":"https://www.bsdnow.tv/461","content_text":"Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Quarterly Status Report First Quarter 2022\n\n\n\nInstalling Nginx on OpenBSD 7.1\n\n\n\nNews Roundup\n\nLive Webinar: Open-source Virtualization: Getting started with bhyve \n\n\nHosted by Jim Salter and Allan Jude\nLive July 12th at 13:00 ET\nAvailable on-demand a few days later\n\n\n\n\nPersistent Memory Allocation\n\n\n\nColorize your BSD shell\n\n\n\nHow to Install cgit With Gitolite and Nginx on FreeBSD 13\n\n\n\nEuroBSDCon 2022 (Austria) Program announced\n\n\nCome to Austria and learn about the latest happenings in the BSDs\n2 days of tutorials, and 2 days of 3 concurrent tracks of talks\nRegistration is open now. See you there!\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - Drive question\nCarl - Wiring question\nJon - Jails question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2022-01-2022-03/\" rel=\"nofollow\">FreeBSD Quarterly Status Report First Quarter 2022</a></h3>\n\n<hr>\n\n<h3><a href=\"https://unixcop.com/installing-nginx-on-openbsd-7-1/\" rel=\"nofollow\">Installing Nginx on OpenBSD 7.1</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/\" rel=\"nofollow\">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>\n\n<ul>\n<li>Hosted by Jim Salter and Allan Jude</li>\n<li>Live July 12th at 13:00 ET</li>\n<li>Available on-demand a few days later</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://queue.acm.org/detail.cfm?id=3534855\" rel=\"nofollow\">Persistent Memory Allocation</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/colorize-your-bsd-shell.85458/\" rel=\"nofollow\">Colorize your BSD shell</a></h3>\n\n<hr>\n\n<h3><a href=\"https://herrbischoff.com/2021/10/how-to-install-cgit-with-gitolite-and-nginx-on-freebsd-13\" rel=\"nofollow\">How to Install cgit With Gitolite and Nginx on FreeBSD 13</a></h3>\n\n<hr>\n\n<h3><a href=\"https://2022.eurobsdcon.org/program/\" rel=\"nofollow\">EuroBSDCon 2022 (Austria) Program announced</a></h3>\n\n<ul>\n<li>Come to Austria and learn about the latest happenings in the BSDs</li>\n<li>2 days of tutorials, and 2 days of 3 concurrent tracks of talks</li>\n<li>Registration is open now. See you there!\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Brad%20-%20Drive%20question.md\" rel=\"nofollow\">Brad - Drive question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Carl%20-%20Wiring%20question.md\" rel=\"nofollow\">Carl - Wiring question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/461/feedback/Jon%20-%20Jails%20question.md\" rel=\"nofollow\">Jon - Jails question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Q1 FreeBSD Quarterly Status Report 2022, Nginx on OpenBSD 7.1, Persistent Memory Allocation, Colorize your BSD shell, cgit With Gitolite and Nginx on FreeBSD 13, and more","date_published":"2022-06-30T03:45:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8809dc88-c752-4733-9f19-4bcd7e2ca683.mp3","mime_type":"audio/mpeg","size_in_bytes":28160232,"duration_in_seconds":2980}]},{"id":"9c05a38c-a1d1-467b-aac4-a360bedcb20f","title":"460: OpenBSD airport folklore","url":"https://www.bsdnow.tv/460","content_text":"Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nContainerd gains support for launching Linux containers on FreeBSD\n\n\nUses Linux compat and the Linux Jails concept to deploy a full Linux container userland on FreeBSD\n\n\n\n\nOpenBSD 7.1 on PINE64 RockPro64\n\n\n\nNews Roundup\n\nLive Webinar: Open-source Virtualization: Getting started with bhyve \n\n\nHosted by Jim Salter and Allan Jude\nLive July 12th at 13:00 ET\nAvailable on-demand a few days later\n\n\n\n\nThe True Minimalistic Window Manager Does Not Exist\n\n\n\nOpenBSD folklore and share/misc/airport\n\n\n\nHardenedBSD May 2022 Status Report\n\n\n\nDragonFlyBSD 6.2.2 out\n\n\nChangelog\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nNorbert - question\nPaulo - network question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://github.com/containerd/containerd/pull/7000\" rel=\"nofollow\">Containerd gains support for launching Linux containers on FreeBSD</a></h3>\n\n<ul>\n<li>Uses Linux compat and the Linux Jails concept to deploy a full Linux container userland on FreeBSD</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://bsandro.tech/posts/openbsd-7.1-on-pine64-rockpro64/\" rel=\"nofollow\">OpenBSD 7.1 on PINE64 RockPro64</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://klarasystems.com/webinars/live-sessions-singup/webinar-open-source-virtualization-getting-started-with-bhyve/\" rel=\"nofollow\">Live Webinar: Open-source Virtualization: Getting started with bhyve </a></h3>\n\n<ul>\n<li>Hosted by Jim Salter and Allan Jude</li>\n<li>Live July 12th at 13:00 ET</li>\n<li>Available on-demand a few days later</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://serhanekici.com/ttmwm.html\" rel=\"nofollow\">The True Minimalistic Window Manager Does Not Exist</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/openbsd-folklore-and-share-misc-airport/\" rel=\"nofollow\">OpenBSD folklore and share/misc/airport</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2022-06-01/hardenedbsd-may-2022-status-report\" rel=\"nofollow\">HardenedBSD May 2022 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2022/06/10/27047.html\" rel=\"nofollow\">DragonFlyBSD 6.2.2 out</a></h3>\n\n<ul>\n<li><a href=\"https://lists.dragonflybsd.org/pipermail/commits/2022-June/820953.html\" rel=\"nofollow\">Changelog</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Norbert%20-%20question.md\" rel=\"nofollow\">Norbert - question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/460/feedback/Paulo%20-%20network%20question.md\" rel=\"nofollow\">Paulo - network question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Containerd gains support for launching Linux containers on FreeBSD, OpenBSD 7.1 on PINE64 RockPro64, true minimalistic window manager does not exist, OpenBSD folklore, HardenedBSD May 2022 Status Report, DragonFlyBSD 6.2.2 out, and more","date_published":"2022-06-23T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9c05a38c-a1d1-467b-aac4-a360bedcb20f.mp3","mime_type":"audio/mpeg","size_in_bytes":23500632,"duration_in_seconds":2258}]},{"id":"111c15bd-3906-4d2b-aaec-9d29bc06672a","title":"459: NetBSD Kernel benchmark","url":"https://www.bsdnow.tv/459","content_text":"Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp; Diagnostics for New FreeBSD Users, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nEvaluating FreeBSD CURRENT for Production Use\n\n\n\nTime Machine like Backups on OpenBSD\n\n\n\nNews Roundup\n\nFreeBSD on the Graviton 3\n\n\n\nCompiling the NetBSD kernel as a benchmark\n\n\n\nNetwork Management with the OpenBSD Packet Filter Toolset from BSDCan 2022\n\n\n\nHardware Detection &amp; Diagnostics for New FreeBSD Users &amp; PCs\n\n\n\nBeastie Bits\n\n• [NetBSD - Announcing Google Summer of Code 2022 projects](https://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code3)\n• [Welcome FreeBSD Google Summer of Code Participants](https://freebsdfoundation.org/blog/welcome-freebsd-google-summer-of-code-participants/)\n• [Network from Scratch](https://www.networksfromscratch.com)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection &amp; Diagnostics for New FreeBSD Users, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/evaluating-freebsd-current-for-production-use/\" rel=\"nofollow\">Evaluating FreeBSD CURRENT for Production Use</a></h3>\n\n<hr>\n\n<h3><a href=\"https://xosc.org/timemachine.html\" rel=\"nofollow\">Time Machine like Backups on OpenBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.daemonology.net/blog/2022-05-23-FreeBSD-Graviton-3.html\" rel=\"nofollow\">FreeBSD on the Graviton 3</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.anotherhomepage.org/post/2022/05/25/Compiling-the-NetBSD-kernel-as-a-benchmark/\" rel=\"nofollow\">Compiling the NetBSD kernel as a benchmark</a></h3>\n\n<hr>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20220607112236\" rel=\"nofollow\">Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/hardware-detection-diagnostics-for-new-freebsd-users-pcs.84596/\" rel=\"nofollow\">Hardware Detection &amp; Diagnostics for New FreeBSD Users &amp; PCs</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [NetBSD - Announcing Google Summer of Code 2022 projects](https://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code3)\n• [Welcome FreeBSD Google Summer of Code Participants](https://freebsdfoundation.org/blog/welcome-freebsd-google-summer-of-code-participants/)\n• [Network from Scratch](https://www.networksfromscratch.com)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Evaluating FreeBSD CURRENT for Production Use, Time Machine-like Backups on OpenBSD, FreeBSD on the Graviton 3, Compiling the NetBSD kernel as a benchmark, Network Management with the OpenBSD Packet Filter Toolset from BSDCan 2022, Hardware Detection & Diagnostics for New FreeBSD Users, and more","date_published":"2022-06-16T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/111c15bd-3906-4d2b-aaec-9d29bc06672a.mp3","mime_type":"audio/mpeg","size_in_bytes":32577552,"duration_in_seconds":3245}]},{"id":"a8dc34c4-e5aa-4409-bc38-28b891bf97a4","title":"458: Traceroute interpretation","url":"https://www.bsdnow.tv/458","content_text":"Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp; spleen, interpreting a traceroute, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFundamentals of the FreeBSD Shell\n\n\n\nSpammers in the Public Cloud, Protected by SPF; Intensified Password Groping Still Ongoing; Spamware Hawked to Spamtraps\n\n\n\nNews Roundup\n\nA cautionary tale about locking Linux &amp; FreeBSD user accounts\n\n\n\nOvergrowth runs on NetBSD\n\n\n\nmoreutils\n\n\n\nNetBSD, CTWM, and Spleen\n\n\n\nHow to properly interpret a traceroute or mtr\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nLets talk a bit about some of the events happening this year, BSDCan in virtual this weekend, emfcamp is this weekend too and in person, MCH is this summer and eurobsdcon is in september. How were the postgres conferences benedict?\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm &amp; spleen, interpreting a traceroute, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/interacting-with-freebsd-learning-the-fundamentals-of-the-freebsd-shell-2/\" rel=\"nofollow\">Fundamentals of the FreeBSD Shell</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdly.blogspot.com/2022/04/spammers-in-public-cloud-protected-by.html\" rel=\"nofollow\">Spammers in the Public Cloud, Protected by SPF; Intensified Password Groping Still Ongoing; Spamware Hawked to Spamtraps</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.cyberciti.biz/networking/a-cautionary-tale-about-locking-linux-freebsd-user-accounts/\" rel=\"nofollow\">A cautionary tale about locking Linux &amp; FreeBSD user accounts</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/ucgavg/i_was_able_to_build_overgrowth_on_netbsd/\" rel=\"nofollow\">Overgrowth runs on NetBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://joeyh.name/code/moreutils/\" rel=\"nofollow\">moreutils</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/netbsd-ctwm-and-spleen/\" rel=\"nofollow\">NetBSD, CTWM, and Spleen</a></h3>\n\n<hr>\n\n<p><a href=\"https://phil.lavin.me.uk/2022/03/how-to-properly-interpret-a-traceroute-or-mtr/\" rel=\"nofollow\">How to properly interpret a traceroute or mtr</a></p>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p>Lets talk a bit about some of the events happening this year, BSDCan in virtual this weekend, emfcamp is this weekend too and in person, MCH is this summer and eurobsdcon is in september. How were the postgres conferences benedict?</p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Fundamentals of the FreeBSD Shell, Spammers in the Public Cloud, locking user accounts properly, overgrowth on NetBSD, moreutils, ctwm & spleen, interpreting a traceroute, and more","date_published":"2022-06-09T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a8dc34c4-e5aa-4409-bc38-28b891bf97a4.mp3","mime_type":"audio/mpeg","size_in_bytes":28773216,"duration_in_seconds":2921}]},{"id":"4cb3f0eb-514d-4a26-9173-15d6eab282c0","title":"457: The NetBSD Wheelbarrow","url":"https://www.bsdnow.tv/457","content_text":"Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe journey to ZFS raidz1 with different sized disks (On NetBSD) (Wheelbarrow optional)\n\n\n\nFreeBSD Networking Basics: WiFi and Bluetooth\n\n\n\nNews Roundup\n\nPlaystation: Hole in NetBSD driver could allow code smuggling\n\n\nArchive link if the page is down (no images)\nOriginal Announcment\nGerman Article\n\n\n\n\nKDE-FreeBSD CI\n\n\n\nRemembering Buildtool\n\n\n\nBeastie Bits\n\nBy the Way... Kubernetes for FreeBSD\nFreeBSD Games Directory\nCandlelit Console patch set to the framebuffer console\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDan - A couple things\nPaul - BSD Business Justifications\nTodd - Feedback to prior feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://netbsd0.blogspot.com/2022/05/the-journey-to-zfs-raidz1-with.html\" rel=\"nofollow\">The journey to ZFS raidz1 with different sized disks (On NetBSD) (Wheelbarrow optional)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/freebsd-project/resources/networking-basics-wifi-and-bluetooth/\" rel=\"nofollow\">FreeBSD Networking Basics: WiFi and Bluetooth</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/\" rel=\"nofollow\">Playstation: Hole in NetBSD driver could allow code smuggling</a></h3>\n\n<ul>\n<li><a href=\"https://web.archive.org/web/20220519162432/https://www.kiratas.com/playstation-hole-in-netbsd-driver-could-allow-code-smuggling-2/\" rel=\"nofollow\">Archive link if the page is down (no images)</a></li>\n<li><a href=\"https://hackerone.com/reports/1350653\" rel=\"nofollow\">Original Announcment</a></li>\n<li><a href=\"https://www.heise.de/news/Playstation-Luecke-in-NetBSD-Treiber-koennte-Codeschmuggel-ermoeglichen-7091153.html\" rel=\"nofollow\">German Article</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://euroquis.nl//kde/2022/04/26/freebsd-ci.html\" rel=\"nofollow\">KDE-FreeBSD CI</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jmmv.dev/2022/05/remembering-buildtool.html\" rel=\"nofollow\">Remembering Buildtool</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://medium.com/@norlin.t/by-the-way-kubernetes-for-freebsd-d0ba4dab8d8e\" rel=\"nofollow\">By the Way... Kubernetes for FreeBSD</a><br>\n<a href=\"https://github.com/tigersharke/FreeBSD-Games-Directory\" rel=\"nofollow\">FreeBSD Games Directory</a><br>\n<a href=\"http://undeadly.org/cgi?action=article;sid=20220516093712\" rel=\"nofollow\">Candlelit Console patch set to the framebuffer console</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Dan%20-%20A%20couple%20things.md\" rel=\"nofollow\">Dan - A couple things</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Paul%20-%20BSD%20Business%20Justifications.md\" rel=\"nofollow\">Paul - BSD Business Justifications</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/457/feedback/Todd%20-%20Feedback%20to%20prior%20feedback.md\" rel=\"nofollow\">Todd - Feedback to prior feedback</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"Journey to ZFS RAIDZ1 on NetBSD, FreeBSD networking basics: WiFi and Bluetooth, smuggling code into the playstation via NetBSD driver hole, KDE FreeBSD CI, remembering buildtool, and more","date_published":"2022-06-02T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4cb3f0eb-514d-4a26-9173-15d6eab282c0.mp3","mime_type":"audio/mpeg","size_in_bytes":27225288,"duration_in_seconds":2823}]},{"id":"634c66ea-7d91-4d0d-bb47-5d55f50b7029","title":"456: FreeBSD 13.1","url":"https://www.bsdnow.tv/456","content_text":"FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD 13.1 Release is available\n\nUnix command line conventions over time\n\n\n\nNews Roundup\n\nBranching for NetBSD 10\n\n\n\nMicrobyhve\n\n\n\nOwn Your Calendar &amp; Contacts With OpenBSD, Baïkal, and FOSS Android\n\n\n\nTwenty years ago today, Jeff filed the PSARC case for the ZFS filesystem\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nScott - FreeBSD and supercomputing\nNick - Thanks and some shout outs\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/13.1R/announce/\" rel=\"nofollow\">FreeBSD 13.1 Release is available</a></h3>\n\n<h3><a href=\"https://blog.liw.fi/posts/2022/05/07/unix-cli/\" rel=\"nofollow\">Unix command line conventions over time</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mail-index.netbsd.org/current-users/2022/05/02/msg042278.html\" rel=\"nofollow\">Branching for NetBSD 10</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/cbsd/microbhyve\" rel=\"nofollow\">Microbyhve</a></h3>\n\n<hr>\n\n<h3><a href=\"https://baak6.com/baikal-openbsd-fossdroid/\" rel=\"nofollow\">Own Your Calendar &amp; Contacts With OpenBSD, Baïkal, and FOSS Android</a></h3>\n\n<hr>\n\n<h3><a href=\"https://twitter.com/mmusante/status/1518947283626246145?t=tzR6KeMx2mhjJfeoOqrHIw&s=03\" rel=\"nofollow\">Twenty years ago today, Jeff filed the PSARC case for the ZFS filesystem</a></h3>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Scott%20-%20FreeBSD%20and%20supercomputing.md\" rel=\"nofollow\">Scott - FreeBSD and supercomputing</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/456/feedback/Nick%20-%20Thanks%20and%20some%20shout%20outs.md\" rel=\"nofollow\">Nick - Thanks and some shout outs</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD 13.1 is released, Unix command line conventions over time, Branching for NetBSD 10, Microbhyve, Own your Calendar and Contacts with OpenBSD, the PSARC case for ZFS, and more","date_published":"2022-05-26T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/634c66ea-7d91-4d0d-bb47-5d55f50b7029.mp3","mime_type":"audio/mpeg","size_in_bytes":29382912,"duration_in_seconds":3079}]},{"id":"9b545f6d-5e83-47f1-93c0-9be7f81b9cee","title":"455: Ken Thompson Singularity","url":"https://www.bsdnow.tv/455","content_text":"OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD is the Perfect OS post Nuclear Apocalypse\n\n\n\nMultiprocess support for LLDB\n\n\n\nNews Roundup\n\nI ported the new Hare compiler to OpenBSD\n\n\n\nWriting my first OpenBSD game using Godot\n\n\n\nFreeBSD 13 on Thinkpad T460s\n\n\n\nBeastie Bits\n\nOpen Source Voices interview with Deb Goodkin\nTachyum Successfully Runs FreeBSD in Prodigy Ecosystem, Expands Open-Source OS Support\nMidnightBSD Minor Update 2.1.7\nLibreSSL 3.5.2 Released\nOpenBGPD 7.3 is out\nPlaying the game Bottomless on OpenBSD\nWindows Central: OpenBSD already has a version for Apple Silicon\nOpenBSD Webzine #9 is out\nIn the \"Everone makes mistakes catagory\" : I forgot to enable compression on ZFS\n\"Ken Thompson is a singularity\" ~Brian Kernighan\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBen - Securing FreeBSD\nDave - BSD certifications\nSam - maintaining a port\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://confuzeus.com/shorts/openbsd-nuclear-apocalypse/\" rel=\"nofollow\">OpenBSD is the Perfect OS post Nuclear Apocalypse</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.moritz.systems/blog/multiprocess-support-for-lldb/\" rel=\"nofollow\">Multiprocess support for LLDB</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://briancallahan.net/blog/20220427.html\" rel=\"nofollow\">I ported the new Hare compiler to OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-04-28-writing-a-game-with-godot.html\" rel=\"nofollow\">Writing my first OpenBSD game using Godot</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/\" rel=\"nofollow\">FreeBSD 13 on Thinkpad T460s</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://www.opensourcevoices.org/29\" rel=\"nofollow\">Open Source Voices interview with Deb Goodkin</a><br>\n<a href=\"https://www.hpcwire.com/off-the-wire/tachyum-successfully-runs-freebsd-in-prodigy-ecosystem-expands-open-source-os-support/\" rel=\"nofollow\">Tachyum Successfully Runs FreeBSD in Prodigy Ecosystem, Expands Open-Source OS Support</a><br>\n<a href=\"https://midnightbsd.org/security/index.html#a20220404\" rel=\"nofollow\">MidnightBSD Minor Update 2.1.7</a><br>\n<a href=\"https://bsdsec.net/articles/libressl-3-5-2-released\" rel=\"nofollow\">LibreSSL 3.5.2 Released</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20220414091532\" rel=\"nofollow\">OpenBGPD 7.3 is out</a><br>\n<a href=\"https://videos.pair2jeux.tube/w/jheVDTPmBTQzkmSpNSvk8J\" rel=\"nofollow\">Playing the game Bottomless on OpenBSD</a><br>\n<a href=\"https://windows11central.com/en/openbsd-already-has-a-version-for-apple-silicon/\" rel=\"nofollow\">Windows Central: OpenBSD already has a version for Apple Silicon</a><br>\n<a href=\"https://webzine.puffy.cafe/issue-9.html\" rel=\"nofollow\">OpenBSD Webzine #9 is out</a><br>\n<a href=\"https://dan.langille.org/2022/04/28/i-forgot-to-enable-compression-on-zfs/\" rel=\"nofollow\">In the &quot;Everone makes mistakes catagory&quot; : I forgot to enable compression on ZFS</a><br>\n<a href=\"https://www.youtube.com/watch?v=fL2QwyxcJ5s\" rel=\"nofollow\">&quot;Ken Thompson is a singularity&quot; ~Brian Kernighan</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Ben%20-%20Securing%20FreeBSD.md\" rel=\"nofollow\">Ben - Securing FreeBSD</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Dave%20-%20BSD%20certifications.md\" rel=\"nofollow\">Dave - BSD certifications</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/455/feedback/Sam%20-%20maintaining%20a%20port.md\" rel=\"nofollow\">Sam - maintaining a port</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD is the Perfect OS post Nuclear Apocalypse, Multiprocess support for LLDB, porting the new Hare compiler to OpenBSD, Writing my first OpenBSD game using Godot, FreeBSD 13 on Thinkpad T460s, and more.","date_published":"2022-05-19T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b545f6d-5e83-47f1-93c0-9be7f81b9cee.mp3","mime_type":"audio/mpeg","size_in_bytes":27344184,"duration_in_seconds":2721}]},{"id":"4bfd5be2-a833-45ee-b097-a68a8af6b122","title":"454: Compiling 50% faster","url":"https://www.bsdnow.tv/454","content_text":"OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let's try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nOpenBSD 7.1 is out\n\n\n\nBuilding Your Own FreeBSD-based NAS with ZFS Part 2\n\n\n\nNews Roundup\n\nLet's try V on OpenBSD\n\n\n\nWaiting for Randot (or: nia and maya were right and I was wrong)\n\n\n\nCompiling an openbsd kernel 50% faster\n\n\n\nA Salute for 10+ years of service  https://archive.ph/JL5hf (if the site is down)\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nGlenn - Toms Home Lab\nI_am_chunky_pie - unix tool writing\nMike - Making Routers\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let&#39;s try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openbsd.org/71.html\" rel=\"nofollow\">OpenBSD 7.1 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/part-2-tuning-your-freebsd-configuration-for-your-nas/\" rel=\"nofollow\">Building Your Own FreeBSD-based NAS with ZFS Part 2</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://briancallahan.net/blog/20220426.html\" rel=\"nofollow\">Let&#39;s try V on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"http://mail-index.netbsd.org/tech-security/2021/01/11/msg001100.html\" rel=\"nofollow\">Waiting for Randot (or: nia and maya were right and I was wrong)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://flak.tedunangst.com/post/compiling-an-openbsd-kernel-50-faster\" rel=\"nofollow\">Compiling an openbsd kernel 50% faster</a></h3>\n\n<hr>\n\n<h3><a href=\"http://aboutbsd.net/?page_id=26661\" rel=\"nofollow\">A Salute for 10+ years of service</a>  <a href=\"https://archive.ph/JL5hf\" rel=\"nofollow\">https://archive.ph/JL5hf</a> (if the site is down)</h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Glenn%20-%20Toms%20Home%20Lab.md\" rel=\"nofollow\">Glenn - Toms Home Lab</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/I_am_chunky_pie%20-%20unix%20tool%20writing.md\" rel=\"nofollow\">I_am_chunky_pie - unix tool writing</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/454/feedback/Mike%20-%20Making%20Routers.md\" rel=\"nofollow\">Mike - Making Routers</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD 7.1 is out, Building Your Own FreeBSD-based NAS with ZFS Part 2, Let's try V on OpenBSD, Waiting for Randot, Compiling an OpenBSD kernel 50% faster, A Salute for 10+ years of service, and more","date_published":"2022-05-12T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4bfd5be2-a833-45ee-b097-a68a8af6b122.mp3","mime_type":"audio/mpeg","size_in_bytes":28305048,"duration_in_seconds":2930}]},{"id":"ddb0b2b0-a944-41a5-96c2-63fc5c3b43f1","title":"453: TwinCat/BSD Hypervisor","url":"https://www.bsdnow.tv/453","content_text":"Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nBuilding Your Own FreeBSD-based NAS\n\n\n\nWriting a device driver for Unix V6\n\n\n\nNews Roundup\n\nFreeBSD/EC2: What I've been up to\n\n\n\nBeckhoff has released its TwinCAT/BSD Hypervisor\n\n\n\nWriting a NetBSD kernel module\n\n\n\nBenedicts Git Finds\n\n\nProjects\n\n\nRun anything (like full blown GTK apps) under Capsicum\nTwitter client for UEFI\nn³ The unorthodox terminal file manager\nOpenVi: Portable OpenBSD vi for UNIX systems\n\nGists and Articles\n\n\nStep-by-step instructions on installing the latest NVIDIA drivers on FreeBSD 13.0 and above\nFreeBSD SSH Hardening\nGTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nBen - Backing Up\n\nEthan - Thanks\n\nMaxi - question about note taking\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/building-your-own-freebsd-based-nas-with-zfs/\" rel=\"nofollow\">Building Your Own FreeBSD-based NAS</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mveg.es/posts/writing-a-device-driver-for-unix-v6/\" rel=\"nofollow\">Writing a device driver for Unix V6</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.daemonology.net/blog/2022-03-29-FreeBSD-EC2-report.html\" rel=\"nofollow\">FreeBSD/EC2: What I&#39;ve been up to</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.automationworld.com/control/article/22144694/beckhoff-hypervisor-enables-virtual-machines-for-control-applications\" rel=\"nofollow\">Beckhoff has released its TwinCAT/BSD Hypervisor</a></h3>\n\n<hr>\n\n<h3><a href=\"https://saurvs.github.io/post/writing-netbsd-kern-mod/\" rel=\"nofollow\">Writing a NetBSD kernel module</a></h3>\n\n<hr>\n\n<h2>Benedicts Git Finds</h2>\n\n<ul>\n<li>Projects\n\n<ul>\n<li><a href=\"https://github.com/unrelentingtech/capsicumizer\" rel=\"nofollow\">Run anything (like full blown GTK apps) under Capsicum</a></li>\n<li><a href=\"https://github.com/arata-nvm/mitnal\" rel=\"nofollow\">Twitter client for UEFI</a></li>\n<li><a href=\"https://github.com/jarun/nnn\" rel=\"nofollow\">n³ The unorthodox terminal file manager</a></li>\n<li><a href=\"https://github.com/johnsonjh/OpenVi\" rel=\"nofollow\">OpenVi: Portable OpenBSD vi for UNIX systems</a></li>\n</ul></li>\n<li>Gists and Articles\n\n<ul>\n<li><a href=\"https://gist.github.com/Mostly-BSD/4d3cacc0ee2f045ed8505005fd664c6e\" rel=\"nofollow\">Step-by-step instructions on installing the latest NVIDIA drivers on FreeBSD 13.0 and above</a></li>\n<li><a href=\"https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11\" rel=\"nofollow\">FreeBSD SSH Hardening</a></li>\n<li><a href=\"https://gtfobins.github.io\" rel=\"nofollow\">GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems</a></li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ben%20-%20Backing%20Up.md\" rel=\"nofollow\">Ben - Backing Up</a></p>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Ethan%20-%20Thanks.md\" rel=\"nofollow\">Ethan - Thanks</a></p>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/453/feedback/Maxi%20%20-%20question%20about%20note%20taking.md\" rel=\"nofollow\">Maxi - question about note taking</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Building Your Own FreeBSD-based NAS, Writing a device driver for Unix V6, EC2: What Colin Percival’s been up to, Beckhoff releases TwinCAT/BSD Hypervisor, Writing a NetBSD kernel module, and more.","date_published":"2022-05-05T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ddb0b2b0-a944-41a5-96c2-63fc5c3b43f1.mp3","mime_type":"audio/mpeg","size_in_bytes":26501664,"duration_in_seconds":2713}]},{"id":"115f6a28-dc39-4136-bed4-7f3dc1e13aa7","title":"452: The unknown hackers","url":"https://www.bsdnow.tv/452","content_text":"The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe unknown hackers\n\n\nBill Jolitz passed away in March 2022\n***\n\n\nFreeBSD Documentation: Papers We Love To Read\n\n\n\n\n\nNews Roundup\n\nFreeBSD/Ubuntu Dual Boot Homelab in The Bedroom by the bed testbed\n\n\n\nOpenSSH 9.0 has been released\n\n\n\nOperating systems battle: OpenBSD vs NixOS\n\n\n\nBeastie Bits\n\nCelebrating 50 years of the Unix Operating System\nKickstarter Campaign Results\nFreeBSD Virtualization Series\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nJeff - ZFS checksum repair\n\nNelson - General Thanks\n\nSam - FOSS Power Support\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.salon.com/2000/05/17/386bsd/\" rel=\"nofollow\">The unknown hackers</a></h3>\n\n<ul>\n<li><a href=\"https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html\" rel=\"nofollow\">Bill Jolitz passed away in March 2022</a>\n***</li>\n</ul>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-documentation-papers-we-love-to-read/\" rel=\"nofollow\">FreeBSD Documentation: Papers We Love To Read</a></h3>\n\n<hr>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://adventurist.me/posts/00307\" rel=\"nofollow\">FreeBSD/Ubuntu Dual Boot Homelab in The Bedroom by the bed testbed</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.openssh.com/txt/release-9.0\" rel=\"nofollow\">OpenSSH 9.0 has been released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-04-18-openbsd-vs-nixos.html\" rel=\"nofollow\">Operating systems battle: OpenBSD vs NixOS</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://www.reddit.com/r/BSD/comments/u4t25c/celebrating_50_years_of_the_unix_operating_system/\" rel=\"nofollow\">Celebrating 50 years of the Unix Operating System</a><br>\n<a href=\"https://mwl.io/archives/13627\" rel=\"nofollow\">Kickstarter Campaign Results</a><br>\n<a href=\"https://productionwithscissors.run/freebsd-virtualization-series/\" rel=\"nofollow\">FreeBSD Virtualization Series</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Jeff%20-%20ZFS%20checksum%20repair.md\" rel=\"nofollow\">Jeff - ZFS checksum repair</a></p>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Nelson%20-%20General%20Thanks.md\" rel=\"nofollow\">Nelson - General Thanks</a></p>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/452/feedback/Sam%20-%20FOSS%20Power%20Support.md\" rel=\"nofollow\">Sam - FOSS Power Support</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The unknown hackers, Papers we love to read, Dual Boot Homelab in The Bedroom by the bed testbed, OpenSSH 9.0 released, OS battle: OpenBSD vs. NixOS, and more ","date_published":"2022-04-28T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/115f6a28-dc39-4136-bed4-7f3dc1e13aa7.mp3","mime_type":"audio/mpeg","size_in_bytes":27640824,"duration_in_seconds":2789}]},{"id":"e05f4b5e-9285-42ae-87ba-151ec71f80b7","title":"451: Tuning ZFS recordsize","url":"https://www.bsdnow.tv/451","content_text":"Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFull system backups with FFS snapshots, ZFS and dump(8)\n\n\n\nTuning Recordsize in OpenZFS\n\n\n\nNews Roundup\n\nOptimizing FreeBSD Power Consumption on Modern Intel Laptops\n\n\n\nI need to remember to check for ZFS filesystems being mounted\n\n\n\nUse tcpdump to save wireless bridge\n\n\n\nBeastie Bits\n\n• [FreeBSD on the Vortex86DX CPU](https://www.cambus.net/freebsd-on-the-vortex86dx-cpu/)\n• [HAMMER2 vs USB stick pulls](https://www.dragonflydigest.com/2022/03/22/26800.html)\n• [New US mirror for DragonFly](https://www.dragonflydigest.com/2022/03/09/26742.html)\n• [HelloSystem 13.1 RC1](https://github.com/helloSystem/ISO/releases/tag/experimental-13.1-RC1)\n• [Video introduction to OpenBSD 7.0](https://www.youtube.com/watch?v=KeUsE-3nSes)\n• [Losses in the community](https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nSam - BSD Laptops\nReese - Electric Groff\nAlexandra - New to BSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.unitedbsd.com/d/705-full-system-backups-with-ffs-snapshots-zfs-and-dump8\" rel=\"nofollow\">Full system backups with FFS snapshots, ZFS and dump(8)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/tuning-recordsize-in-openzfs/\" rel=\"nofollow\">Tuning Recordsize in OpenZFS</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.neelc.org/posts/optimize-freebsd-for-intel-tigerlake/\" rel=\"nofollow\">Optimizing FreeBSD Power Consumption on Modern Intel Laptops</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSCheckForMounted\" rel=\"nofollow\">I need to remember to check for ZFS filesystems being mounted</a></h3>\n\n<hr>\n\n<h3><a href=\"https://adventurist.me/posts/0027\" rel=\"nofollow\">Use tcpdump to save wireless bridge</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [FreeBSD on the Vortex86DX CPU](https://www.cambus.net/freebsd-on-the-vortex86dx-cpu/)\n• [HAMMER2 vs USB stick pulls](https://www.dragonflydigest.com/2022/03/22/26800.html)\n• [New US mirror for DragonFly](https://www.dragonflydigest.com/2022/03/09/26742.html)\n• [HelloSystem 13.1 RC1](https://github.com/helloSystem/ISO/releases/tag/experimental-13.1-RC1)\n• [Video introduction to OpenBSD 7.0](https://www.youtube.com/watch?v=KeUsE-3nSes)\n• [Losses in the community](https://minnie.tuhs.org/pipermail/tuhs/2022-April/025643.html)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Sam%20-%20BSD%20Laptops.md\" rel=\"nofollow\">Sam - BSD Laptops</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Reese%20-%20Electric%20Groff.md\" rel=\"nofollow\">Reese - Electric Groff</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/451/feedback/Alexandra%20-%20New%20to%20BSD.md\" rel=\"nofollow\">Alexandra - New to BSD</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Full system backups with FFS snapshots, ZFS and dump(8), tuning recordsize in OpenZFS, Optimizing FreeBSD Power Consumption on Modern Intel Laptops, remember to check for ZFS filesystems being mounted, Use tcpdump to save wireless bridge, and more","date_published":"2022-04-21T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e05f4b5e-9285-42ae-87ba-151ec71f80b7.mp3","mime_type":"audio/mpeg","size_in_bytes":35683176,"duration_in_seconds":3645}]},{"id":"d267be2a-c2ba-4bbc-a520-cfa5153a7683","title":"450: Unix Tool Writing","url":"https://www.bsdnow.tv/450","content_text":"The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nUnix Philosophy: A Quick Look at the Ideas that Made Unix\n\n\n\nHints for writing Unix Tools\n\n\n\nNews Roundup\n\nCron best practices\n\n\n\nFilesystems can experience at least three different sorts of errors\n\n\n\nLibreSSL 3.5.1 development branch as well as 3.4.3 (stable) and 3.3.6 released\n\n\n\nTaskwarrior to manage tasks\n\n\n\nBeastie Bits\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAndrew - virtualization\nBrad - jails applications and interoperability\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/unix-philosophy-a-quick-look-at-the-ideas-that-made-unix/\" rel=\"nofollow\">Unix Philosophy: A Quick Look at the Ideas that Made Unix</a></h3>\n\n<hr>\n\n<h3><a href=\"https://monkey.org/%7Emarius/unix-tools-hints.html\" rel=\"nofollow\">Hints for writing Unix Tools</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.sanctum.geek.nz/cron-best-practices/\" rel=\"nofollow\">Cron best practices</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/tech/FilesystemsThreeErrorTypes\" rel=\"nofollow\">Filesystems can experience at least three different sorts of errors</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20220318065203\" rel=\"nofollow\">LibreSSL 3.5.1 development branch as well as 3.4.3 (stable) and 3.3.6 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://adventurist.me/posts/0165\" rel=\"nofollow\">Taskwarrior to manage tasks</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/Andrew%20-%20virtualization.md\" rel=\"nofollow\">Andrew - virtualization</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/450/feedback/brad%20-%20jails%20applications%20and%20interoperability.md\" rel=\"nofollow\">Brad - jails applications and interoperability</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The ideas that made Unix, hints for writing Unix tools, cron best practices, three different sorts of filesystem errors, LibreSSL 3.5.1 released, taskwarrior to manage tasks, and more.","date_published":"2022-04-14T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d267be2a-c2ba-4bbc-a520-cfa5153a7683.mp3","mime_type":"audio/mpeg","size_in_bytes":34318152,"duration_in_seconds":3533}]},{"id":"8b30bba3-3ef0-454a-ad6d-1984c90575a5","title":"449: Reproducible clean $HOME","url":"https://www.bsdnow.tv/449","content_text":"FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Quarterly Status Report 4th Quarter 2021\n\n\n\nReproducible clean $HOME in OpenBSD using impermanence\n\n\n\nNews Roundup\n\nMaking RockPro64 a NetBSD Server\n\n\n\nhelloSystem 0.7.0 is out\n\n\n\nMy lazy approach to FreeBSD dual-booting\n\n\n\nGoing to jail\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• No Feedback emails this week, so instead we can have “Story Time with Allan” and he can regale us with an entertaining BSD story.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2021-10-2021-12/\" rel=\"nofollow\">FreeBSD Quarterly Status Report 4th Quarter 2021</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2022-03-15-openbsd-impermanence.html\" rel=\"nofollow\">Reproducible clean $HOME in OpenBSD using impermanence</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/making_rockpro64_a_netbsd_server\" rel=\"nofollow\">Making RockPro64 a NetBSD Server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/helloSystem/ISO/releases/tag/r0.7.0\" rel=\"nofollow\">helloSystem 0.7.0 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/my-lazy-approach-to-freebsd-dual-booting/\" rel=\"nofollow\">My lazy approach to FreeBSD dual-booting</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opekkt.tech/docs/vps_migration/going2jail/\" rel=\"nofollow\">Going to jail</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• No Feedback emails this week, so instead we can have “Story Time with Allan” and he can regale us with an entertaining BSD story.\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Status Report 4th Quarter 2021, Reproducible clean $HOME in OpenBSD using impermanence, Making RockPro64 a NetBSD Server, helloSystem 0.7.0 is out,  lazy approach to FreeBSD dual-booting, going to jail, and more.","date_published":"2022-04-07T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8b30bba3-3ef0-454a-ad6d-1984c90575a5.mp3","mime_type":"audio/mpeg","size_in_bytes":29224896,"duration_in_seconds":3017}]},{"id":"8590bd30-1871-4f8d-a3f8-34cb04d9a17f","title":"448: Controlling Resource Limits","url":"https://www.bsdnow.tv/448","content_text":"Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nControlling Resource Limits with rctl in FreeBSD\n\n\n\nIt's DNS. Of course it's DNS, it's always DNS.\n\n\n\nNews Roundup\n\nGSOC\n\n• [Work with FreeBSD in Google Summer of Code](https://freebsdfoundation.org/blog/work-with-freebsd-in-google-summer-of-code/)\n• [The NetBSD Foundation is a mentoring organization at Google Summer of Code 2022](https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_is_a)\n\n\n\n\nRsync Technical Notes - Q4 2021\n\n\n\nUserland CPU frequency scheduling for OpenBSD\n\n\n\nBeastie Bits\n\n\nUnofficial HardenedBSD liveCD\nThe eurobsdcon 2022 CFP is open\nTesting parallel forwarding\nOpenBSD iwx(4) gains 11ac 80MHz channel support\nOpenBSD/arm64 on Apple M1 systems\nFreeBSD on the CubieBoard2\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nEric - periodic notifications\nKevin - no question\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/controlling-resource-limits-with-rctl-in-freebsd/\" rel=\"nofollow\">Controlling Resource Limits with rctl in FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/DNSVariabilityProblems\" rel=\"nofollow\">It&#39;s DNS. Of course it&#39;s DNS, it&#39;s always DNS.</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3>GSOC</h3>\n\n<pre><code>• [Work with FreeBSD in Google Summer of Code](https://freebsdfoundation.org/blog/work-with-freebsd-in-google-summer-of-code/)\n• [The NetBSD Foundation is a mentoring organization at Google Summer of Code 2022](https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_is_a)\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://www.rsync.net/resources/notes/2021-q4-rsync.net_technotes.html\" rel=\"nofollow\">Rsync Technical Notes - Q4 2021</a></h3>\n\n<hr>\n\n<h3><a href=\"https://tildegit.org/solene/obsdfreqd\" rel=\"nofollow\">Userland CPU frequency scheduling for OpenBSD</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://groups.google.com/a/hardenedbsd.org/g/users/c/QUTUJfm30Dg/m/0VNKUeVhHgAJ\" rel=\"nofollow\">Unofficial HardenedBSD liveCD</a></li>\n<li><a href=\"https://2022.eurobsdcon.org/the-call-for-talk-and-presentation-proposals-for-eurobsdcon-2022-is-now-open/\" rel=\"nofollow\">The eurobsdcon 2022 CFP is open</a></li>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20220319123157\" rel=\"nofollow\">Testing parallel forwarding</a></li>\n<li><a href=\"https://www.undeadly.org/cgi?action=article;sid=20220315070043\" rel=\"nofollow\">OpenBSD iwx(4) gains 11ac 80MHz channel support</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20220320115932\" rel=\"nofollow\">OpenBSD/arm64 on Apple M1 systems</a></li>\n<li><a href=\"https://www.cambus.net/freebsd-on-the-cubieboard2/\" rel=\"nofollow\">FreeBSD on the CubieBoard2</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Eric%20-%20periodic%20notifications.md\" rel=\"nofollow\">Eric - periodic notifications</a><br>\n<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/448/feedback/Kevin%20-%20no%20question.md\" rel=\"nofollow\">Kevin - no question</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Controlling Resource Limits with rctl in FreeBSD, It’s always DNS, Google Summer of Code in BSD Projects, Rsync Technical Notes - Q4 2021, Userland CPU frequency scheduling for OpenBSD, and more.","date_published":"2022-03-31T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8590bd30-1871-4f8d-a3f8-34cb04d9a17f.mp3","mime_type":"audio/mpeg","size_in_bytes":26155080,"duration_in_seconds":2722}]},{"id":"ab14e67f-b3b7-4ce0-8ce4-b2035c16745a","title":"447: Path to BSD","url":"https://www.bsdnow.tv/447","content_text":"FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nProject Proposal Overview\n\n\n\nUNIX: On the Path to BSD\n\n\n\nNews Roundup\n\nFujitsu is ending its mainframe and Unix services\n\n\n\nTUTORIAL: Install burpsuite on FreeBSD using Linuxulator\n\n\n\nOpenBSD Webzine\n\n\n\nBeastie Bits\n\n\nA Trio if OPNsense releases:\n\n\n21.7.8\n21.10.3\n22.1.1\n\nFreeBSD 12.2 end-of-life\nDragonFly as a KVM guest\nRIP Lorinda Cherry\nPrecursor: From Boot to Root\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nNo Feedback emails this week, so instead Tom can regale us with an entertaining BSD story.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\n","content_html":"<p>FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/get-involved/project-proposal-overview/\" rel=\"nofollow\">Project Proposal Overview</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/unix-on-the-path-to-bsd/\" rel=\"nofollow\">UNIX: On the Path to BSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.techradar.com/in/news/fujitsu-is-ending-its-mainframe-and-unix-services\" rel=\"nofollow\">Fujitsu is ending its mainframe and Unix services</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.FreeBSD.org/threads/tutorial-install-burpsuite-on-freebsd-using-linuxulator.84310/\" rel=\"nofollow\">TUTORIAL: Install burpsuite on FreeBSD using Linuxulator</a></h3>\n\n<hr>\n\n<h3><a href=\"https://webzine.puffy.cafe/issue-7.html\" rel=\"nofollow\">OpenBSD Webzine</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li>A Trio if OPNsense releases:\n\n<ul>\n<li><a href=\"https://opnsense.org/opnsense-21-7-8-released/\" rel=\"nofollow\">21.7.8</a></li>\n<li><a href=\"https://opnsense.org/opnsense-business-edition-21-10-3-released/\" rel=\"nofollow\">21.10.3</a></li>\n<li><a href=\"https://opnsense.org/opnsense-22-1-1-released-2\" rel=\"nofollow\">22.1.1</a></li>\n</ul></li>\n<li><a href=\"https://lists.freebsd.org/archives/freebsd-announce/2022-March/000018.html\" rel=\"nofollow\">FreeBSD 12.2 end-of-life</a></li>\n<li><a href=\"https://www.dragonflybsd.org/docs/howtos/HowToKvmGuest/\" rel=\"nofollow\">DragonFly as a KVM guest</a></li>\n<li><a href=\"https://lwn.net/ml/tuhs/CAKH6PiVi+JoxDG7ACMG5G+qnTkxTMsohGx6Wq3UNVkogO4N0Vg@mail.gmail.com/\" rel=\"nofollow\">RIP Lorinda Cherry</a></li>\n<li><a href=\"https://www.bunniestudios.com/blog/?p=6336\" rel=\"nofollow\">Precursor: From Boot to Root</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p>No Feedback emails this week, so instead Tom can regale us with an entertaining BSD story.</p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul></li>\n</ul>","summary":"FreeBSD Foundation Proposals, UNIX: On the Path to BSD, Fujitsu ends its mainframe and Unix services, Install burpsuite on FreeBSD using Linuxulator, new OpenBSD Webzine is out, and more.","date_published":"2022-03-24T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ab14e67f-b3b7-4ce0-8ce4-b2035c16745a.mp3","mime_type":"audio/mpeg","size_in_bytes":33494808,"duration_in_seconds":3234}]},{"id":"b8932853-588e-4ed2-8bd3-b8d3552b820d","title":"446: Debugging ioctl problems ","url":"https://www.bsdnow.tv/446","content_text":"Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nRestoring a Tadpole SPARCbook 3 Part 1: Introduction\n\n\n\nThe FreeBSD Boot Process\n\n\n\nNews Roundup\n\nDebugging an ioctl Problem on OpenBSD\n\n\n\nWhy my game PC runs FreeBSD and Kubuntu\n\n\n\nDNSSEC, Badgers, and Orcs, Oh My!\n\n\n\nBeastie Bits\n\n• [LibreSSL 3.5.0 development branch released](https://undeadly.org/cgi?action=article;sid=20220301063844)\n• [OpenSSH updated to 8.9](https://undeadly.org/cgi?action=article;sid=20220301063428)\n• [Recent developments in OpenBSD, 2022-02-21 summary](https://undeadly.org/cgi?action=article;sid=20220221060700)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nJonathan - X-Wing and Tie Fighter\nJoshontech - pool options\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.rs-online.com/designspark/restoring-a-tadpole-sparcbook-3-part-1-introduction\" rel=\"nofollow\">Restoring a Tadpole SPARCbook 3 Part 1: Introduction</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/the-freebsd-boot-process/\" rel=\"nofollow\">The FreeBSD Boot Process</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jcs.org/2022/02/16/ioctl\" rel=\"nofollow\">Debugging an ioctl Problem on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/why-my-game-pc-also-runs-freebsd/\" rel=\"nofollow\">Why my game PC runs FreeBSD and Kubuntu</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/14708\" rel=\"nofollow\">DNSSEC, Badgers, and Orcs, Oh My!</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [LibreSSL 3.5.0 development branch released](https://undeadly.org/cgi?action=article;sid=20220301063844)\n• [OpenSSH updated to 8.9](https://undeadly.org/cgi?action=article;sid=20220301063428)\n• [Recent developments in OpenBSD, 2022-02-21 summary](https://undeadly.org/cgi?action=article;sid=20220221060700)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/Jonathan%20-%20X-Wing%20and%20Tie%20Fighter.md\" rel=\"nofollow\">Jonathan - X-Wing and Tie Fighter</a><br>\n<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/446/joshontech%20-%20pool%20options.md\" rel=\"nofollow\">Joshontech - pool options</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Restoring a Tadpole SPARCbook 3, The FreeBSD Boot Process, Debugging an ioctl Problem on OpenBSD, Why my game PC runs FreeBSD and Kubuntu, DNSSEC, Badgers, and Orcs, Oh My, and more.","date_published":"2022-03-17T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b8932853-588e-4ed2-8bd3-b8d3552b820d.mp3","mime_type":"audio/mpeg","size_in_bytes":29044560,"duration_in_seconds":2904}]},{"id":"a4bbf2bd-8191-4faa-9dec-2b8a2f9de7fd","title":"445: Journey to BSD","url":"https://www.bsdnow.tv/445","content_text":"Idiot's guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe complete idiot's guide to OpenBSD on the Pinebook Pro\n\n\n\nFreeBSD Periodic Scripts\n\n\n\nNews Roundup\n\nThe history (sort of) of service management in Unix\n\n\n\nMy journey from macOS to FreeBSD\n\n\n\nA nice story about Unix processes \"infecting\" each other\n\n\n\nNavidrome music server on FreeBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nTyler - Is this enough for VMs\nKevin - BSD from RAMdisk\nMalcolm - wired headset in FreeBSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Idiot&#39;s guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://tomscii.sig7.se/2022/02/Guide-to-OpenBSD-on-the-PinebookPro\" rel=\"nofollow\">The complete idiot&#39;s guide to OpenBSD on the Pinebook Pro</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-periodic-scripts/\" rel=\"nofollow\">FreeBSD Periodic Scripts</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ServiceManagementHistory\" rel=\"nofollow\">The history (sort of) of service management in Unix</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.boucek.me/blog/from-mac-to-freebsd/\" rel=\"nofollow\">My journey from macOS to FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rachelbythebay.com/w/2022/02/09/nice/\" rel=\"nofollow\">A nice story about Unix processes &quot;infecting&quot; each other</a></h3>\n\n<hr>\n\n<h3><a href=\"https://web.archive.org/web/20220101220446/https://www.danschmid.me/article/install-navidrome-music-server-on-freebsd\" rel=\"nofollow\">Navidrome music server on FreeBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Tyler%20-%20Is%20this%20enough%20for%20VMs.md\" rel=\"nofollow\">Tyler - Is this enough for VMs</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Kevin%20-%20BSD%20from%20RAMdisk.md\" rel=\"nofollow\">Kevin - BSD from RAMdisk</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/445/feedback/Malcolm%20-%20wired%20headset%20in%20FreeBSD.md\" rel=\"nofollow\">Malcolm - wired headset in FreeBSD</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Idiot's guide to OpenBSD on the Pinebook Pro, FreeBSD Periodic Scripts, history of service management in Unix, journey from macOS to FreeBSD, Unix processes “infecting” each other, navidrom music server on FreeBSD, and more.","date_published":"2022-03-10T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a4bbf2bd-8191-4faa-9dec-2b8a2f9de7fd.mp3","mime_type":"audio/mpeg","size_in_bytes":28948800,"duration_in_seconds":2832}]},{"id":"859e26d8-a3d7-4df6-8ea2-eb22ab8babb5","title":"444: Historic Developments","url":"https://www.bsdnow.tv/444","content_text":"The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nA Conversation with Margo Seltzer and Mike Olson: The history of Berkeley DB\n\n\n\nModern inetd in FreeBSD\n\n\n\nNews Roundup\n\nThe reason Unix has the argv[0] issue (and API)\n\n\n\nRetrocomputing can be more than games\n\n\n\nYou should read Section 8 of the Unix User's Manual\n\n\n\nBeastie Bits\n\n\nNew 'Reckless guide to OpenBSD' published\nGhostBSD Online Meetup\nHAMBug online meeting, March 8th @ 18:30 ET\nHardenedBSD 12-STABLE support will be dropped in May 2022\nOption options for getopt\nNew Tarsnap version is out\n pfSense Plus version 22.01 and pfSense CE version 2.6.0 Software are Now Available\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKarst - replacing disks\nTheHolm - zfs and booting\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://queue.acm.org/detail.cfm?id=3501713\" rel=\"nofollow\">A Conversation with Margo Seltzer and Mike Olson: The history of Berkeley DB</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/modern-inetd-in-freebsd/\" rel=\"nofollow\">Modern inetd in FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/Argv0IsEasy\" rel=\"nofollow\">The reason Unix has the argv[0] issue (and API)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/retrocomputing-is-more-than-games/\" rel=\"nofollow\">Retrocomputing can be more than games</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.theregister.com/2022/02/09/section_8_unix_user_manual/\" rel=\"nofollow\">You should read Section 8 of the Unix User&#39;s Manual</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20220214061716\" rel=\"nofollow\">New &#39;Reckless guide to OpenBSD&#39; published</a></li>\n<li><a href=\"http://ghostbsd.org/node/243\" rel=\"nofollow\">GhostBSD Online Meetup</a></li>\n<li><a href=\"http://hambug.ca/\" rel=\"nofollow\">HAMBug online meeting, March 8th @ 18:30 ET</a></li>\n<li><a href=\"https://twitter.com/HardenedBSD/status/1492249763193970689\" rel=\"nofollow\">HardenedBSD 12-STABLE support will be dropped in May 2022</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2022/02/16/26684.html\" rel=\"nofollow\">Option options for getopt</a></li>\n<li><a href=\"https://mail.tarsnap.com/tarsnap-announce/msg00046.html\" rel=\"nofollow\">New Tarsnap version is out</a></li>\n<li> <a href=\"https://www.netgate.com/blog/pfsense-plus-software-version-22.01-and-ce-2.6.0-are-now-available\" rel=\"nofollow\">pfSense Plus version 22.01 and pfSense CE version 2.6.0 Software are Now Available</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/Karst%20-%20replacing%20disks.md\" rel=\"nofollow\">Karst - replacing disks</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/444/feedback/TheHolm%20-%20zfs%20and%20booting.md\" rel=\"nofollow\">TheHolm - zfs and booting</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"The History of Berkeley DB, modern inetd in FreeBSD, the Unix argv[0] issue, retrocomputing can be more than games, read section 8 of the Unix users manual, and more.","date_published":"2022-03-03T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/859e26d8-a3d7-4df6-8ea2-eb22ab8babb5.mp3","mime_type":"audio/mpeg","size_in_bytes":31350552,"duration_in_seconds":3216}]},{"id":"07a074a7-cfc0-4058-a637-3c58c89a919a","title":"443: Certified Unix Compliant","url":"https://www.bsdnow.tv/443","content_text":"Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why \"process substitution\" is a late feature in Unix shells, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhat goes into making an OS to be Unix compliant certified?\n\n\n\n2021 FreeBSD Foundation Impact Report\n\n\n\nNews Roundup\n\nPlay Netflix, Disney, and other widevine content on FreeBSD\n\n\n\nNote: two files changed and hashes/signatures updated for NetBSD 8.1\n\n\n\nPlaying with CD-RWs on FreeBSD\n\n\n\nWhy \"process substitution\" is a late feature in Unix shells\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMarty - shell communities\nNate - Helping Mike Out\nTom - convincing others to switch\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why &quot;process substitution&quot; is a late feature in Unix shells, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.quora.com/What-goes-into-making-an-OS-to-be-Unix-compliant-certified\" rel=\"nofollow\">What goes into making an OS to be Unix compliant certified?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/2021-freebsd-foundation-impact-report/\" rel=\"nofollow\">2021 FreeBSD Foundation Impact Report</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://danschmid.de/article/play-netflix-disney-and-other-widevine-content-on-freebsd\" rel=\"nofollow\">Play Netflix, Disney, and other widevine content on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdsec.net/articles/note-two-files-changed-and-hashes-signatures-updated-for-netbsd-8-1\" rel=\"nofollow\">Note: two files changed and hashes/signatures updated for NetBSD 8.1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/playing-with-cd-rws-on-freebsd/\" rel=\"nofollow\">Playing with CD-RWs on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProcessSubstitutionWhyLate\" rel=\"nofollow\">Why &quot;process substitution&quot; is a late feature in Unix shells</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Marty%20-%20shell%20communities.md\" rel=\"nofollow\">Marty - shell communities</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Nate%20-%20Helping%20Mike%20Out.md\" rel=\"nofollow\">Nate - Helping Mike Out</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/443/feedback/Tom%20-%20convincing%20others%20to%20switch.md\" rel=\"nofollow\">Tom - convincing others to switch</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Certifying an OS Unix compliant, 2021 FreeBSD Foundation Impact Report, Netflix, Disney, and other widevine content on FreeBSD, file hashes updated for NetBSD 8.1, Playing with CD-RWs on FreeBSD, Why \"process substitution\" is a late feature in Unix shells, and more.","date_published":"2022-02-24T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/07a074a7-cfc0-4058-a637-3c58c89a919a.mp3","mime_type":"audio/mpeg","size_in_bytes":30076104,"duration_in_seconds":2789}]},{"id":"6c41b9bf-54fb-42e4-88de-6df0daca6ad1","title":"442: Birthing Unix","url":"https://www.bsdnow.tv/442","content_text":"The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 \"Observant Owl\" released, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nThe Birth of Unix\n\n\n\nHelp requested for three big items for Lumina\n\n\n\nNews Roundup\n\nFreeBSD 13 on Thinkpad T460s\n\n\n\nHardenedBSD January 2022 Status Report\n\n\n\nOPNsense 22.1 \"Observant Owl\" released\n\n\n\nBeastie Bits\n\n\nThe early days of Unix at Bell Labs - Brian Kernighan (LCA 2022 Online)\nBastilleBSD User Survey\nSmallest desktop of the day with BSD: Raspberry Pi 400\nReminder BSDCan 2022 - online only\nJoshua Stein Video: Q&amp;A\nDNSSEC Mastery, second edition, creeping out\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAlec - Playstation FreeBSD-Linux question\nNelson - Interesting Interview\nOscar - Omni OS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 &quot;Observant Owl&quot; released, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/the-birth-of-unix/\" rel=\"nofollow\">The Birth of Unix</a></h3>\n\n<hr>\n\n<h3><a href=\"https://lumina-desktop.org/post/2022-02-08/\" rel=\"nofollow\">Help requested for three big items for Lumina</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.tumfatig.net/2022/freebsd-13-on-thinkpad-t460s/\" rel=\"nofollow\">FreeBSD 13 on Thinkpad T460s</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2022-01-30/hardenedbsd-january-2022-status-report\" rel=\"nofollow\">HardenedBSD January 2022 Status Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-22-1-released/\" rel=\"nofollow\">OPNsense 22.1 &quot;Observant Owl&quot; released</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=ECCr_KFl41E\" rel=\"nofollow\">The early days of Unix at Bell Labs - Brian Kernighan (LCA 2022 Online)</a></li>\n<li><a href=\"https://docs.google.com/forms/d/e/1FAIpQLSddMMIFW9mHMnpMjMQZfFVCubVywmCXZHI7lqE2tS4k503uPw/viewform\" rel=\"nofollow\">BastilleBSD User Survey</a>\n<a href=\"https://www.reddit.com/r/BSD/comments/sgk5y0/smallest_desktop_of_the_day_with_bsd_raspberry_pi/\" rel=\"nofollow\">Smallest desktop of the day with BSD: Raspberry Pi 400</a></li>\n<li><a href=\"https://lists.bsdcan.org/pipermail/bsdcan-announce/2022-January/000191.html\" rel=\"nofollow\">Reminder BSDCan 2022 - online only</a></li>\n<li><a href=\"https://jcs.org/2022/01/14/q&a\" rel=\"nofollow\">Joshua Stein Video: Q&amp;A</a></li>\n<li><a href=\"https://mwl.io/archives/14427\" rel=\"nofollow\">DNSSEC Mastery, second edition, creeping out</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Alec%20-%20Playstation%20FreeBSD-Linux%20question.md\" rel=\"nofollow\">Alec - Playstation FreeBSD-Linux question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Nelson%20-%20Interesting%20Interview.md\" rel=\"nofollow\">Nelson - Interesting Interview</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/442/feedback/Oscar%20-%20Omni%20OS.md\" rel=\"nofollow\">Oscar - Omni OS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The Birth of Unix, Help request for three big Lumina items, FreeBSD 13 on Thinkpad T460s, HardenedBSD January 2022 Status Report, OPNsense 22.1 \"Observant Owl\" released, and more.","date_published":"2022-02-17T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6c41b9bf-54fb-42e4-88de-6df0daca6ad1.mp3","mime_type":"audio/mpeg","size_in_bytes":28180392,"duration_in_seconds":2779}]},{"id":"9b36f236-73a8-4846-af4e-cd774790c11b","title":"441: Migration to BSD","url":"https://www.bsdnow.tv/441","content_text":"Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhy we're migrating (many of) our servers from Linux to FreeBSD\n\n\n\nCluster provisioning with Nomad and Pot on FreeBSD\n\n\n\nNews Roundup\n\nLibBSDDialog\n\n\n\nFreeBSD 13.0 Base Jails with ZFS and VNET\n\n\n\nBeastie Bits\n\n\nOpenBSD on the Pinephone\nFreeBSD SSH Hardening\nMaking the ZFS file system\nA Linux Users Experience Switching To OpenBSD\nAdd Nix, a purely functional package manager to FreeBSD\nioztat is a storage load analysis tool for OpenZFS\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nScott - esxi\nThe Holm - noob question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://it-notes.dragas.net/2022/01/24/why-were-migrating-many-of-our-servers-from-linux-to-freebsd/\" rel=\"nofollow\">Why we&#39;re migrating (many of) our servers from Linux to FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/cluster-provisioning-with-nomad-and-pot-on-freebsd/\" rel=\"nofollow\">Cluster provisioning with Nomad and Pot on FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://alfonsosiciliano.gitlab.io/posts/2022-01-16-libbsddialog.html\" rel=\"nofollow\">LibBSDDialog</a></h3>\n\n<hr>\n\n<h3><a href=\"https://randomnixfix.wordpress.com/2022/01/15/freebsd-13-0-base-jails-with-zfs-and-vnet/\" rel=\"nofollow\">FreeBSD 13.0 Base Jails with ZFS and VNET</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.exoticsilicon.com/crystal/pinephone_openbsd\" rel=\"nofollow\">OpenBSD on the Pinephone</a></li>\n<li><a href=\"https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11\" rel=\"nofollow\">FreeBSD SSH Hardening</a></li>\n<li><a href=\"https://changelog.com/podcast/475\" rel=\"nofollow\">Making the ZFS file system</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=ukTOfcu1e0w\" rel=\"nofollow\">A Linux Users Experience Switching To OpenBSD</a></li>\n<li><a href=\"https://svnweb.freebsd.org/ports?view=revision&revision=550026\" rel=\"nofollow\">Add Nix, a purely functional package manager to FreeBSD</a></li>\n<li><a href=\"https://github.com/jimsalterjrs/ioztat\" rel=\"nofollow\">ioztat is a storage load analysis tool for OpenZFS</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/Scott%20-%20esxi.md\" rel=\"nofollow\">Scott - esxi</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/441/feedback/The%20Holm%20-%20noob%20question.md\" rel=\"nofollow\">The Holm - noob question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Migrating our servers from Linux to FreeBSD, Cluster provisioning with Nomad and Pot on FreeBSD, LibBSDDialog, FreeBSD 13.0 Base Jails with ZFS and VNET, and more.","date_published":"2022-02-10T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9b36f236-73a8-4846-af4e-cd774790c11b.mp3","mime_type":"audio/mpeg","size_in_bytes":31052040,"duration_in_seconds":3013}]},{"id":"ff88573d-93b8-4efc-bf5c-5acd4ac555af","title":"440: BSD Inside Zone","url":"https://www.bsdnow.tv/440","content_text":"GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the \"virtual filesystem switch\", and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nGhostBSD 22.01 is available\n\n\n\nPacket Scheduling with Dummynet and FreeBSD\n\n\n\nNews Roundup\n\nInside zone installation\n\n\n\nWhy the FreeBSD Desktop and my Linux Rant\n\n\n\nHow to install Gnome on OpenBSD\n\n\n\nThe important Unix idea of the \"virtual filesystem switch\"\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nPaul - A Plug\nRollniak - Bhyve Questions\nRussell - pf pointers\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the &quot;virtual filesystem switch&quot;, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.ghostbsd.org/ghostbsd_22.01.12_iso_is_now_available\" rel=\"nofollow\">GhostBSD 22.01 is available</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/packet-scheduling-with-dummynet-and-freebsd/\" rel=\"nofollow\">Packet Scheduling with Dummynet and FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://ptribble.blogspot.com/2022/01/inside-zone-installation.html\" rel=\"nofollow\">Inside zone installation</a></h3>\n\n<hr>\n\n<h3><a href=\"https://randomnixfix.wordpress.com/2021/10/23/why-the-freebsd-desktop-and-my-linux-rant/\" rel=\"nofollow\">Why the FreeBSD Desktop and my Linux Rant</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-05-07-openbsd-gnome.html\" rel=\"nofollow\">How to install Gnome on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VFSImportance\" rel=\"nofollow\">The important Unix idea of the &quot;virtual filesystem switch&quot;</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Paul%20-%20A%20Plug.md\" rel=\"nofollow\">Paul - A Plug</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Rollniak%20-%20Bhyve%20Questions.md\" rel=\"nofollow\">Rollniak - Bhyve Questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/440/feedback/Russell%20-%20pf%20pointers.md\" rel=\"nofollow\">Russell - pf pointers</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"GhostBSD 22.01 is available, Packet Scheduling with Dummynet and FreeBSD, Inside zone installation, Why the FreeBSD Desktop and my Linux Rant, How to install Gnome on OpenBSD, The important Unix idea of the \"virtual filesystem switch\", and more.","date_published":"2022-02-03T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ff88573d-93b8-4efc-bf5c-5acd4ac555af.mp3","mime_type":"audio/mpeg","size_in_bytes":26393592,"duration_in_seconds":2697}]},{"id":"56286ede-3bd4-47f7-8002-c09a26263c44","title":"439: Browser Tab Unix","url":"https://www.bsdnow.tv/439","content_text":"ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nIt takes a community - ACM\n\n\n\nPSA: Dont use Discord for Open Source Projects\n\n\nJeffrey Paul - Discord Is Not An Acceptable Choice For Free Software Projects\nDrew deVault - Dont use Discord for FOSS\n\n\n\n\nNews Roundup\n\n\n\nUnix in your Browser Tab\n\n\n\nOpenIndiana Hipster 2021.10 is here\n\n\n\nOmni OS CE v11 r151040 is out\n\n\n\nBeastie Bits\n\n\nDeb from the FreeBSD Foundation on FLOSS Weekly\nJailfox - BastilleBSD template to bootstrap Firefox.\nFreeBSD Journal Nov/Dec 2021\nFirst call through the 3ESS\nOpenBSD for minimalists\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDale - two zfs questions\nJohnny - home question\nMike - GhostBSD in a VM\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://queue.acm.org/detail.cfm?id=3501361\" rel=\"nofollow\">It takes a community - ACM</a></h3>\n\n<hr>\n\n<h3>PSA: Dont use Discord for Open Source Projects</h3>\n\n<ul>\n<li><a href=\"https://sneak.berlin/20200220/discord-is-not-an-acceptable-choice-for-free-software-projects/\" rel=\"nofollow\">Jeffrey Paul - Discord Is Not An Acceptable Choice For Free Software Projects</a></li>\n<li><a href=\"https://drewdevault.com/2021/12/28/Dont-use-Discord-for-FOSS.html\" rel=\"nofollow\">Drew deVault - Dont use Discord for FOSS</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<hr>\n\n<h3><a href=\"https://browsix.org/\" rel=\"nofollow\">Unix in your Browser Tab</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.openindiana.org/2021/12/05/openindiana-hipster-2021-10-is-here/\" rel=\"nofollow\">OpenIndiana Hipster 2021.10 is here</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/omniosorg/omnios-build/blob/r151040/doc/ReleaseNotes.md\" rel=\"nofollow\">Omni OS CE v11 r151040 is out</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twit.tv/shows/floss-weekly/episodes/662?autostart=false\" rel=\"nofollow\">Deb from the FreeBSD Foundation on FLOSS Weekly</a></li>\n<li><a href=\"https://github.com/ddowse/jailfox\" rel=\"nofollow\">Jailfox - BastilleBSD template to bootstrap Firefox.</a></li>\n<li><a href=\"https://freebsdfoundation.org/past-issues/storage-2/\" rel=\"nofollow\">FreeBSD Journal Nov/Dec 2021</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=WUUsAK21f20\" rel=\"nofollow\">First call through the 3ESS</a></li>\n<li><a href=\"https://github.com/krzysztofengineer/openbsd\" rel=\"nofollow\">OpenBSD for minimalists</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Dale%20-%20two%20zfs%20questions.md\" rel=\"nofollow\">Dale - two zfs questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Johnny%20-%20home%20question.md\" rel=\"nofollow\">Johnny - home question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/439/feedback/Mike%20-%20GhostBSD%20in%20a%20VM.md\" rel=\"nofollow\">Mike - GhostBSD in a VM</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"ACM: It takes a community, Don’t use discord for OSS projects, Unix in a browser tab, OpenIndiana Hipster 2021.10 available, Omni OS CE v11 is out, and more.","date_published":"2022-01-27T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/56286ede-3bd4-47f7-8002-c09a26263c44.mp3","mime_type":"audio/mpeg","size_in_bytes":25965648,"duration_in_seconds":2368}]},{"id":"7df88bb7-d7e9-4dbf-945e-7c15b4d4d963","title":"438: Toolchain Adventures","url":"https://www.bsdnow.tv/438","content_text":"FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Foundation 2021 in Review\n\n\nSoftware Development\nYear End Fundraising Report\nInfrastructure Support\nAdvocacy\nFreeBSD 2022 CfP\n\n\n\n\nDragonFlyBSD 6.2.1 is out\n\n\n\nNews Roundup\n\nLumina Desktop 1.6.2 is out\n\n\n\nToolchain Adventures\n\n\n\nThe OpenBSD BASED Challenge Day 7\n\n\n\nBastille Template: AdGuard Home\n\n\n\nSetting up ZSH on FreeBSD\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• Producers Note:  We did get some Christmas AMA questions in after we recorded that episode (since we recorded it early) but don't worry, I’ve made a note of them and we’ll save them for our next AMA episode. \n\n\n\nPatrick - Volume\nReptilicus Rex - FreeBSD Docs Team\nmichael - question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3>FreeBSD Foundation 2021 in Review</h3>\n\n<ul>\n<li><a href=\"https://freebsdfoundation.org/blog/2021-in-review-software-development/\" rel=\"nofollow\">Software Development</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/2021-year-end-fundraising-report/\" rel=\"nofollow\">Year End Fundraising Report</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/2021-in-review-infrastructure-support/\" rel=\"nofollow\">Infrastructure Support</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/2021-in-review-advocacy/\" rel=\"nofollow\">Advocacy</a></li>\n<li><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-2022-call-for-proposals/\" rel=\"nofollow\">FreeBSD 2022 CfP</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflybsd.org/release62/\" rel=\"nofollow\">DragonFlyBSD 6.2.1 is out</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://lumina-desktop.org/post/2021-12-25/\" rel=\"nofollow\">Lumina Desktop 1.6.2 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/toolchains-adventures-q4-2021/\" rel=\"nofollow\">Toolchain Adventures</a></h3>\n\n<hr>\n\n<h3><a href=\"https://write.as/adventures-in-bsd/\" rel=\"nofollow\">The OpenBSD BASED Challenge Day 7</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bastillebsd.org/blog/2022/01/03/bastille-template-examples-adguardhome/\" rel=\"nofollow\">Bastille Template: AdGuard Home</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.danschmid.me/article/setting-up-zsh-on-freebsd\" rel=\"nofollow\">Setting up ZSH on FreeBSD</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• Producers Note:  We did get some Christmas AMA questions in after we recorded that episode (since we recorded it early) but don&#39;t worry, I’ve made a note of them and we’ll save them for our next AMA episode. \n</code></pre>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Patrick%20-%20Volume.md\" rel=\"nofollow\">Patrick - Volume</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/Reptilicus%20Rex%20-%20FreeBSD%20Docs%20Team.md\" rel=\"nofollow\">Reptilicus Rex - FreeBSD Docs Team</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/438/feedback/michael%20-%20question.md\" rel=\"nofollow\">michael - question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Foundation reviews 2021 activities, DragonflyBSD 6.2.1 is here, Lumina Desktop 1.6.2 available, toolchain adventures, The OpenBSD BASED Challenge Day 7, Bastille Template: AdGuard Home, setting up ZSH on FreeBSD and more.","date_published":"2022-01-20T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7df88bb7-d7e9-4dbf-945e-7c15b4d4d963.mp3","mime_type":"audio/mpeg","size_in_bytes":29848512,"duration_in_seconds":2795}]},{"id":"3e7f064f-6f8f-49ee-a2e6-6300007b7a88","title":"437: Audit that package","url":"https://www.bsdnow.tv/437","content_text":"Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nUsing FreeBSD’s pkg-audit\n\n\n\nThe 20 year old bug that went to Mars\n\n\nIt's rare that you come across a bug so subtle that it can last for two decades. But, that's exactly what has happened with the Lempel-Ziv-Oberhumer (LZO) algorithm. Initially written in 1994, Markus Oberhumer designed a sophisticated and extremely efficient compression algorithm so elegant and well architected that it outperforms zlib and bzip by four or five times their decompression speed.\n\nI was impressed to find out that his LZO algorithm has gone to the planet Mars on NASA devices multiple times! Most recently, LZO has touched down on the red planet within the Mars Curiosity Rover, which just celebrated its first martian anniversary on Tuesday.\n\nIn the past few years, LZO has gained traction in file systems as well. LZO can be used in the Linux kernel within btrfs, squashfs, jffs2, and ubifs. A recent variant of the algorithm, LZ4, is used for compression in ZFS for Solaris, Illumos, and FreeBSD.\n\nWith its popularity increasing, Lempel-Ziv-Oberhumer has been rewritten by many engineering firms for both closed and open systems. These rewrites, however, have always been based on Oberhumer's core open source implementation. As a result, they all inherited a subtle integer overflow. Even LZ4 has the same exact bug, but changed very slightly.\n\nBecause the LZO algorithm is considered a library function, each specific implementation must be evaluated for risk, regardless of whether the algorithm used has been patched. Why? We are talking about code that has existed in the wild for two decades. The scope of this algorithm touches everything from embedded microcontrollers on the Mars Rover, mainframe operating systems, modern day desktops, and mobile phones. Engineers that have used LZO must evaluate the use case to identify whether or not the implementation is vulnerable, and in what format.\n\n\n\n\nNews Roundup\n\nFreeBSD on Slimbook -- 14 months of updates\n\n\n\nLLDB FreeBSD kernel core dump support\n\n\n\nSteam on OpenBSD\n\n\n\nBeastie Bits\n\n• [OpenSSH Agent Restriction](http://undeadly.org/cgi?action=article;sid=20211220061017)\n• [OpenBSD’s Clang upgraded to version 13](http://undeadly.org/cgi?action=article;sid=20211220060327)\n• [Cool, but obscure X11 tools](http://cyber.dabamos.de/unix/x11/)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/using-freebsds-pkg-audit-to-investigate-known-security-issues/\" rel=\"nofollow\">Using FreeBSD’s pkg-audit</a></h3>\n\n<hr>\n\n<h3><a href=\"http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html\" rel=\"nofollow\">The 20 year old bug that went to Mars</a></h3>\n\n<blockquote>\n<p>It&#39;s rare that you come across a bug so subtle that it can last for two decades. But, that&#39;s exactly what has happened with the Lempel-Ziv-Oberhumer (LZO) algorithm. Initially written in 1994, Markus Oberhumer designed a sophisticated and extremely efficient compression algorithm so elegant and well architected that it outperforms zlib and bzip by four or five times their decompression speed.</p>\n\n<p>I was impressed to find out that his LZO algorithm has gone to the planet Mars on NASA devices multiple times! Most recently, LZO has touched down on the red planet within the Mars Curiosity Rover, which just celebrated its first martian anniversary on Tuesday.</p>\n\n<p>In the past few years, LZO has gained traction in file systems as well. LZO can be used in the Linux kernel within btrfs, squashfs, jffs2, and ubifs. A recent variant of the algorithm, LZ4, is used for compression in ZFS for Solaris, Illumos, and FreeBSD.</p>\n\n<p>With its popularity increasing, Lempel-Ziv-Oberhumer has been rewritten by many engineering firms for both closed and open systems. These rewrites, however, have always been based on Oberhumer&#39;s core open source implementation. As a result, they all inherited a subtle integer overflow. Even LZ4 has the same exact bug, but changed very slightly.</p>\n\n<p>Because the LZO algorithm is considered a library function, each specific implementation must be evaluated for risk, regardless of whether the algorithm used has been patched. Why? We are talking about code that has existed in the wild for two decades. The scope of this algorithm touches everything from embedded microcontrollers on the Mars Rover, mainframe operating systems, modern day desktops, and mobile phones. Engineers that have used LZO must evaluate the use case to identify whether or not the implementation is vulnerable, and in what format.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://euroquis.nl/freebsd/2021/12/11/slimbook.html\" rel=\"nofollow\">FreeBSD on Slimbook -- 14 months of updates</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.moritz.systems/blog/lldb-freebsd-kernel-core-dump-support/\" rel=\"nofollow\">LLDB FreeBSD kernel core dump support</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-12-01-openbsd-steam.html\" rel=\"nofollow\">Steam on OpenBSD</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [OpenSSH Agent Restriction](http://undeadly.org/cgi?action=article;sid=20211220061017)\n• [OpenBSD’s Clang upgraded to version 13](http://undeadly.org/cgi?action=article;sid=20211220060327)\n• [Cool, but obscure X11 tools](http://cyber.dabamos.de/unix/x11/)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Using FreeBSD’s pkg-audit, 20 year old bug that went to Mars, FreeBSD on Slimbook, LLDB FreeBSD kernel core dump support, Steam on OpenBSD, Cool but obscure X11 tools, and more \r\n","date_published":"2022-01-13T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3e7f064f-6f8f-49ee-a2e6-6300007b7a88.mp3","mime_type":"audio/mpeg","size_in_bytes":24973752,"duration_in_seconds":2463}]},{"id":"5603c389-e7e5-4b55-ae6e-9ba425abfb2b","title":"436: Unix Standards Battle","url":"https://www.bsdnow.tv/436","content_text":"UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nUNIX Wars – The Battle for Standards\n\n\n\nWhat every IT person needs to know about OpenBSD Part 3: That packet filter\n\n\n\nFreeBSD 12.3-RELEASE Release Notes\n\n\n\nNews Roundup\n\nTrueNAS 12.0-U7 is Released &amp; TrueNAS 13.0 Begins\n\n\n\nA bit on what Unix system pre-boot environments used to look like\n\n\n\nRUN UNIX ON MICROCONTROLLERS WITH PDP-11 EMULATOR\n\n\n\nBeastie Bits\n\n• [BSDCan 2022 is a go.](https://www.bsdcan.org/2022/)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/unix-wars-the-battle-for-standards/\" rel=\"nofollow\">UNIX Wars – The Battle for Standards</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.apnic.net/2021/11/11/openbsd-part-3-that-packet-filter/\" rel=\"nofollow\">What every IT person needs to know about OpenBSD Part 3: That packet filter</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.freebsd.org/releases/12.3R/relnotes/\" rel=\"nofollow\">FreeBSD 12.3-RELEASE Release Notes</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-12-0-u7-is-released-truenas-13-0-begins/\" rel=\"nofollow\">TrueNAS 12.0-U7 is Released &amp; TrueNAS 13.0 Begins</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/UnixPreBootEnvironments\" rel=\"nofollow\">A bit on what Unix system pre-boot environments used to look like</a></h3>\n\n<hr>\n\n<h3><a href=\"https://hackaday.com/2021/11/19/run-unix-on-microcontrollers-with-pdp-11-emulator/\" rel=\"nofollow\">RUN UNIX ON MICROCONTROLLERS WITH PDP-11 EMULATOR</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [BSDCan 2022 is a go.](https://www.bsdcan.org/2022/)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"UNIX Wars, What every IT person needs to know about OpenBSD Part 3, FreeBSD 12.3 is here, TrueNAS 13 begins, what Unix pre-boot envs looked liked, run Unix on Microcontrollers with PDP-11 emulators and more.","date_published":"2022-01-06T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5603c389-e7e5-4b55-ae6e-9ba425abfb2b.mp3","mime_type":"audio/mpeg","size_in_bytes":27911640,"duration_in_seconds":2612}]},{"id":"96e38cf0-0975-4dd8-8eb3-c7626c45369a","title":"435: Year End Interview","url":"https://www.bsdnow.tv/435","content_text":"In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterview - Solene Rapenne - solene+www@dataswamp.org / [@solene@bsd.network](@solene@bsd.network (mastodon))\n\nhttps://dataswamp.org/~solene/2021-07-26-old-computer-challenge-after.html\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Solène Rapenne.","content_html":"<p>In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interview - Solene Rapenne - <a href=\"mailto:solene+www@dataswamp.org\" rel=\"nofollow\">solene+www@dataswamp.org</a> / [@<a href=\"mailto:solene@bsd.network\" rel=\"nofollow\">solene@bsd.network</a>](@<a href=\"mailto:solene@bsd.network\" rel=\"nofollow\">solene@bsd.network</a> (mastodon))</h2>\n\n<p><a href=\"https://dataswamp.org/%7Esolene/2021-07-26-old-computer-challenge-after.html\" rel=\"nofollow\">https://dataswamp.org/~solene/2021-07-26-old-computer-challenge-after.html</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Solène Rapenne.</p>","summary":"In this last episode of 2021, we interview Solene from OpenBSD. She’s blogging about her experiences with OpenBSD on dataswamp.org, the webzine she created, how she got involved and other topics. Enjoy and best wishes for 2022! ","date_published":"2021-12-30T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/96e38cf0-0975-4dd8-8eb3-c7626c45369a.mp3","mime_type":"audio/mpeg","size_in_bytes":20684232,"duration_in_seconds":2031}]},{"id":"40afa2c2-e5e7-4c5c-b505-9c02dcc8953a","title":"434: It’s Quiz-mas time","url":"https://www.bsdnow.tv/434","content_text":"In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nInterview\n\nAllan - allanjude@freebsd.org / Twitter : @allanjude\n\nBenedict - bcr@freebsd.org / Twitter : @bsdbcr\n\nTom - thj@freebsd.org / Twitter : @adventureloop\n\nJT - jt@obs-sec.com / Twitter : @q5sys\n\n\n\nTarsnap\n\n\nThis week’s episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Interview</h2>\n\n<h3>Allan - <a href=\"mailto:allanjude@freebsd.org\" rel=\"nofollow\">allanjude@freebsd.org</a> / <a href=\"https://twitter.com/allanjude\" rel=\"nofollow\">Twitter : @allanjude</a></h3>\n\n<h3>Benedict - <a href=\"mailto:bcr@freebsd.org\" rel=\"nofollow\">bcr@freebsd.org</a> / <a href=\"https://twitter.com/bsdbcr\" rel=\"nofollow\">Twitter : @bsdbcr</a></h3>\n\n<h3>Tom - <a href=\"mailto:thj@freebsd.org\" rel=\"nofollow\">thj@freebsd.org</a> / <a href=\"https://twitter.com/adventureloop\" rel=\"nofollow\">Twitter : @adventureloop</a></h3>\n\n<h3>JT - <a href=\"mailto:jt@obs-sec.com\" rel=\"nofollow\">jt@obs-sec.com</a> / <a href=\"https://twitter.com/q5sys\" rel=\"nofollow\">Twitter : @q5sys</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This week’s episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"In this special xmas episode we let the audience interview us using questions they sent us and we’ll answer now. Tom, Allan, JT, and I are all here, so stay tuned for some interesting answers to your questions.","date_published":"2021-12-23T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/40afa2c2-e5e7-4c5c-b505-9c02dcc8953a.mp3","mime_type":"audio/mpeg","size_in_bytes":35359104,"duration_in_seconds":3510}]},{"id":"a47d75e2-ee2d-4fea-af03-c7e8cab86efc","title":"433:  GhostBSD of Christmas","url":"https://www.bsdnow.tv/433","content_text":"GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem's Web Interface with OPNsense, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nGhostBSD 21.11.24 ISO is now available\n\n\n\nWhy v7 matters so much\n\n\n\nNews Roundup\n\nOpenBSD on the VIA Eden X2 powered HP t510 Thin Client\n\n\n\nOctoPkg: A Great GUI Package Manager In FreeBSD\n\n\n\nProject Report: Add support for chdir(2) support in posix_spawn(3)\n\n\n\nHow To Install doas in FreeBSD 13\n\n\n\nHow to Access Your Modem's Web Interface with OPNsense\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nNo feedback for this episode because no one sent any in. :(\nI guess we’ve answered every BSD and Unix question that everyone has.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem&#39;s Web Interface with OPNsense, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.ghostbsd.org/ghostbsd_21.11.24_iso_is_now_available\" rel=\"nofollow\">GhostBSD 21.11.24 ISO is now available</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/V7WhyItMattersSoMuch\" rel=\"nofollow\">Why v7 matters so much</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.cambus.net/openbsd-on-the-via-eden-x2-powered-hp-t510-thin-client/\" rel=\"nofollow\">OpenBSD on the VIA Eden X2 powered HP t510 Thin Client</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nudesystems.com/octopkg-a-great-gui-package-manager-in-freebsd/\" rel=\"nofollow\">OctoPkg: A Great GUI Package Manager In FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/project_report_add_support_for\" rel=\"nofollow\">Project Report: Add support for chdir(2) support in posix_spawn(3)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nudesystems.com/how-to-install-doas-in-freebsd-13/\" rel=\"nofollow\">How To Install doas in FreeBSD 13</a></h3>\n\n<hr>\n\n<h3><a href=\"https://homenetworkguy.com/how-to/access-your-modem-web-interface-with-opnsense/\" rel=\"nofollow\">How to Access Your Modem&#39;s Web Interface with OPNsense</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p>No feedback for this episode because no one sent any in. :(<br>\nI guess we’ve answered every BSD and Unix question that everyone has.</p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem's Web Interface with OPNsense, and more","date_published":"2021-12-16T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a47d75e2-ee2d-4fea-af03-c7e8cab86efc.mp3","mime_type":"audio/mpeg","size_in_bytes":17996472,"duration_in_seconds":1758}]},{"id":"754bd5bc-3e7d-4431-8afb-5d1bbed709f8","title":"432: Introducing OpenZFS 3.0 - Yeah","url":"https://www.bsdnow.tv/432","content_text":"HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nHAMBug hybrid meeting\n\n\nHoping to squeeze in an in-person meeting incase the pandemic situation regresses\n***\n### Demystifying OpenZFS 2.0\nDo you like the articles we post? We are looking for authors (or even just your ideas) to keep providing these high quality articles.\nJob Posting\n***\n### OpenZFS 3.0 Introduced at Dev Summit\n***\n### OpenZFS vdev properties feature has been merged\n***\n\n\nNews Roundup\n\nOctober 2021 Home Infrastructure Status\n\n\n\nRunning Awk in parallel to process 256M records\n\n\n\nFreeBSD Announce wayland 1.19.91\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - running linux binaries under FreeBSD\nLars - Finding BSD Topics via search engine\nMarc - Your views on this question on Reddit\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://hambug.ca/\" rel=\"nofollow\">HAMBug hybrid meeting</a></h3>\n\n<ul>\n<li>Hoping to squeeze in an in-person meeting incase the pandemic situation regresses\n***\n### <a href=\"https://klarasystems.com/articles/demystifying-openzfs-2-0/\" rel=\"nofollow\">Demystifying OpenZFS 2.0</a></li>\n<li>Do you like the articles we post? We are looking for authors (or even just your ideas) to keep providing these high quality articles.</li>\n<li><a href=\"https://lists.freebsd.org/archives/freebsd-jobs/2021-November/000003.html\" rel=\"nofollow\">Job Posting</a>\n***\n### <a href=\"https://www.ixsystems.com/blog/openzfs-3-0-introduced-at-developer-summit/\" rel=\"nofollow\">OpenZFS 3.0 Introduced at Dev Summit</a>\n***\n### <a href=\"https://github.com/openzfs/zfs/pull/11711\" rel=\"nofollow\">OpenZFS vdev properties feature has been merged</a>\n***</li>\n</ul>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://git.hardenedbsd.org/shawn.webb/articles/-/blob/master/personal/2021-10-20_home_infra/article.md\" rel=\"nofollow\">October 2021 Home Infrastructure Status</a></h3>\n\n<hr>\n\n<h3><a href=\"https://ketancmaheshwari.github.io/posts/2020/05/24/SMC18-Data-Challenge-4.html\" rel=\"nofollow\">Running Awk in parallel to process 256M records</a></h3>\n\n<hr>\n\n<h3><a href=\"https://lists.freedesktop.org/archives/wayland-devel/2021-November/042026.html\" rel=\"nofollow\">FreeBSD Announce wayland 1.19.91</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Brad%20-%20running%20linux%20binaries%20under%20FreeBSD.md\" rel=\"nofollow\">Brad - running linux binaries under FreeBSD</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Lars%20-%20Finding%20BSD%20Topics%20via%20search%20engine.md\" rel=\"nofollow\">Lars - Finding BSD Topics via search engine</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/432/feedback/Marc%20-%20Your%20views%20on%20this%20question%20on%20Reddit.md\" rel=\"nofollow\">Marc - Your views on this question on Reddit</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"HAMBug hybrid meeting, Demystifying OpenZFS 2.0, OpenZFS 3.0 introduced at Dev Summit, HardenedBSD Home Infrastructure Status, Running Awk in parallel, FreeBSD Announces Wayland 1.19.91, and more","date_published":"2021-12-09T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/754bd5bc-3e7d-4431-8afb-5d1bbed709f8.mp3","mime_type":"audio/mpeg","size_in_bytes":33615312,"duration_in_seconds":3283}]},{"id":"3b2d65ab-f8a0-4e12-b6d1-6a257aef7511","title":"431: FreeBSD EC2 Agents","url":"https://www.bsdnow.tv/431","content_text":"Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhat every IT person needs to know about OpenBSD Part 2: Why use OpenBSD?\n\n\n\nLooking Towards the Future: FreeBSD on the RISC-V Architecture\n\n\n\n\n\nNews Roundup\n\nOpenBSD Webzine Issue 4\n\n\n\nHow I ended up liking GNOME\n\n\n\nOPNsense 21.7.5 released\n\n\n\nJenkins with FreeBSD Agents in ec2\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAndreas - ZFS and Trim\nHamza - swift on the BSDs\nKendall - how many mirror\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.apnic.net/2021/11/05/openbsd-part-2-why-use-openbsd/\" rel=\"nofollow\">What every IT person needs to know about OpenBSD Part 2: Why use OpenBSD?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/looking-towards-the-future-freebsd-on-the-risc-v-architecture/\" rel=\"nofollow\">Looking Towards the Future: FreeBSD on the RISC-V Architecture</a></h3>\n\n<hr>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://webzine.puffy.cafe/issue-4.html\" rel=\"nofollow\">OpenBSD Webzine Issue 4</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-11-10-how-I-ended-liking-gnome.html\" rel=\"nofollow\">How I ended up liking GNOME</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-7-5-released/\" rel=\"nofollow\">OPNsense 21.7.5 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://beerdy.io/2021/10/jenkins-with-freebsd-agents-in-ec2/\" rel=\"nofollow\">Jenkins with FreeBSD Agents in ec2</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Andreas%20-%20ZFS%20and%20Trim.md\" rel=\"nofollow\">Andreas - ZFS and Trim</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Hamza%20-%20swift%20on%20the%20BSDs.md\" rel=\"nofollow\">Hamza - swift on the BSDs</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/431/feedback/Kendall%20-%20how%20many%20mirrors.md\" rel=\"nofollow\">Kendall - how many mirror</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Why use OpenBSD part 2, FreeBSD on the RISC-V Architecture, OpenBSD Webzine Issue 4, Ending up liking GNOME, OPNsense 21.7.5 released, Jenkins with FreeBSD Agents in EC2, and more","date_published":"2021-12-02T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3b2d65ab-f8a0-4e12-b6d1-6a257aef7511.mp3","mime_type":"audio/mpeg","size_in_bytes":26124072,"duration_in_seconds":2637}]},{"id":"a211d686-fe47-4d60-9f0d-41d44cb4af80","title":"430: OpenBSD Onwards","url":"https://www.bsdnow.tv/430","content_text":"Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nGoing From Recovery Mode to Normal Operations with OpenZFS Manipulating a Pool from the Rescue System\n\n\n\nMonitoring FreeBSD jails from the host\n\n\n\nNews Roundup\n\nFreeBSD Quarterly Status Report 3rd Quarter 2021\n\n\n\nOpenBSD on Raspberry Pi 4 with Full-Disk Encryption\n\n\n\nCatchup 2021-11-03\n\n\n\nBeastie Bits\n\n• [Manage Kubernetes cluster from FreeBSD with kubectl](https://www.youtube.com/watch?v=iUxJIXKtK7c)\n• [amdgpu support in DragonFly](https://www.dragonflydigest.com/2021/11/08/26343.html)\n• [Today is the 50th Anniversary of the 1st Edition of Unix...](https://twitter.com/bsdimp/status/1456019089466421248?s=20)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nEfraim - response to IPFS and an overlay filesystem\nPaul - FS Send question\nsev - Freebsd &amp; IPA\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/manipulating-a-pool-from-the-rescue-system/\" rel=\"nofollow\">Going From Recovery Mode to Normal Operations with OpenZFS Manipulating a Pool from the Rescue System</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2021/10/31/monitoring-freebsd-jails-from-the-host/\" rel=\"nofollow\">Monitoring FreeBSD jails from the host</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.freebsd.org/status/report-2021-07-2021-09/\" rel=\"nofollow\">FreeBSD Quarterly Status Report 3rd Quarter 2021</a></h3>\n\n<hr>\n\n<h3><a href=\"http://matecha.net/posts/openbsd-on-pi-4-with-full-disk-encryption/\" rel=\"nofollow\">OpenBSD on Raspberry Pi 4 with Full-Disk Encryption</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20211103080052\" rel=\"nofollow\">Catchup 2021-11-03</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [Manage Kubernetes cluster from FreeBSD with kubectl](https://www.youtube.com/watch?v=iUxJIXKtK7c)\n• [amdgpu support in DragonFly](https://www.dragonflydigest.com/2021/11/08/26343.html)\n• [Today is the 50th Anniversary of the 1st Edition of Unix...](https://twitter.com/bsdimp/status/1456019089466421248?s=20)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Efraim%20-%20response%20to%20IPFS%20and%20an%20overlay%20filesystem.md\" rel=\"nofollow\">Efraim - response to IPFS and an overlay filesystem</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/Paul%20-%20FS%20Send%20question.md\" rel=\"nofollow\">Paul - FS Send question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/430/feedback/sev%20-%20Freebsd%20%26%20IPA.md\" rel=\"nofollow\">sev - Freebsd &amp; IPA</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Manipulate a ZFS pool from Rescue System, FreeBSD 3rd Quarter Report, Monitoring FreeBSD jails form the host, OpenBSD on RPI4 with Full Disk Encryption, Onwards with OpenBSD, and more","date_published":"2021-11-25T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a211d686-fe47-4d60-9f0d-41d44cb4af80.mp3","mime_type":"audio/mpeg","size_in_bytes":27077856,"duration_in_seconds":2746}]},{"id":"1f4cdc97-493b-4460-a6c0-a334cc96ff50","title":"429: Advanced ZFS Snapshots","url":"https://www.bsdnow.tv/429","content_text":"FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nFreeBSD Foundation October 2021 Fundraising Update\n\n\n\nAdvanced ZFS Snapshots\n\n\n\nNews Roundup\n\nFull WireGuard setup with OpenBSD\n\n\n\nMidnightBSD a Linux Alternative\n\n\n\nFreeBSD Audio\n\n\n\nTuning Power Consumption on FreeBSD Laptops and Intel Speed Shift (6th Gen and Later)\n\n\n\nSome Thoughts on Spelling Fixes\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBens feedback to Benedict's feedback to Bens question about zpoolboy\nhcddbz - Old Technical Books\njason - a jails question\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-october-2021-fundraising-update/\" rel=\"nofollow\">FreeBSD Foundation October 2021 Fundraising Update</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/advanced-zfs-snapshots/\" rel=\"nofollow\">Advanced ZFS Snapshots</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-10-09-openbsd-wireguard-exit.html\" rel=\"nofollow\">Full WireGuard setup with OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.makeuseof.com/midnightbsd-linux-desktop-alternative/\" rel=\"nofollow\">MidnightBSD a Linux Alternative</a></h3>\n\n<hr>\n\n<h3><a href=\"https://meka.rs/blog/2021/10/12/freebsd-audio/\" rel=\"nofollow\">FreeBSD Audio</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.neelc.org/posts/freebsd-speed-shift-laptop/\" rel=\"nofollow\">Tuning Power Consumption on FreeBSD Laptops and Intel Speed Shift (6th Gen and Later)</a></h3>\n\n<hr>\n\n<h3><a href=\"http://bsdimp.blogspot.com/2021/10/spelling-fixes-some-advice.html\" rel=\"nofollow\">Some Thoughts on Spelling Fixes</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/Bens%20feedback%20to%20Benedicts%20feedback%20to%20Bens%20question%20about%20zpoolboy.md\" rel=\"nofollow\">Bens feedback to Benedict&#39;s feedback to Bens question about zpoolboy</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/hcddbz%20-%20Old%20Technical%20Books.md\" rel=\"nofollow\">hcddbz - Old Technical Books</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/429/feedback/jason%20-%20a%20jails%20question.md\" rel=\"nofollow\">jason - a jails question</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Foundation October Fundraising Update, Advanced ZFS Snapshots, Full WireGuard setup with OpenBSD, MidnightBSD a Linux Alternative, FreeBSD Audio, Tuning Power Consumption on FreeBSD Laptops, Thoughts on Spelling Fixes, and more.","date_published":"2021-11-18T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1f4cdc97-493b-4460-a6c0-a334cc96ff50.mp3","mime_type":"audio/mpeg","size_in_bytes":22911048,"duration_in_seconds":2344}]},{"id":"1d7be1ab-6939-4fcf-80da-698e14ce721d","title":"428: Cult of BSD","url":"https://www.bsdnow.tv/428","content_text":"OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon\n\nHeadlines\n\nWhat every IT person needs to know about OpenBSD Part 1: How it all started\n\n\n\nExplaining top(1) on FreeBSD\n\n\n\nNews Roundup\n\nMeasuring power efficiency of a CPU frequency scheduler on OpenBSD\n\n\n\nCultBSD\n\n\n\nBeastie Bits\n\n• [OpenBSD on the HiFive Unmatched](https://kernelpanic.life/hardware/hifive-unmatched.html)\n• [Advanced Documentation Retrieval on FreeBSD](https://adventurist.me/posts/00306)\n• [OpenBSD Webzine Issue 3 is out](https://webzine.puffy.cafe/issue-3.html)\n• [How to connect and use Bluetooth headphones on FreeBSD](https://forums.freebsd.org/threads/bluetooth-audio-how-to-connect-and-use-bluetooth-headphones-on-freebsd.82671/)\n• [How To: Execute Firefox in a jail using iocage and ssh/jailme](https://forums.freebsd.org/threads/how-to-execute-firefox-in-a-jail-using-iocage-and-ssh-jailme.53362/)\n• [Understanding AWK](https://earthly.dev/blog/awk-examples/)\n• [“Domesticate Your Badgers” Kickstarter Opens](https://mwl.io/archives/13297)\n• [Bootstrap an OPNsense development environment in Vagrant](https://github.com/punktDe/vagrant-opnsense)\n• [VLANs Bridges and LAG Interface best practice questions](https://www.truenas.com/community/threads/vlans-bridges-and-lag-interface-best-practice-questions.93275/)\n• [A Console Desktop](https://pspodcasting.net/dan/blog/2018/console_desktop.html)\n• [CharmBUG Casual BSD Meetup and Games (Online)](https://www.meetup.com/CharmBUG/events/281822524)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDan - ZFS question\nLars - Thanks for the interview\njesse - migrating data from old laptop\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a> and the <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">BSDNow Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/\" rel=\"nofollow\">What every IT person needs to know about OpenBSD Part 1: How it all started</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/explaining-top1-on-freebsd/\" rel=\"nofollow\">Explaining top(1) on FreeBSD</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-09-26-openbsd-power-usage.html\" rel=\"nofollow\">Measuring power efficiency of a CPU frequency scheduler on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sourceforge.net/projects/cult-bsd/\" rel=\"nofollow\">CultBSD</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [OpenBSD on the HiFive Unmatched](https://kernelpanic.life/hardware/hifive-unmatched.html)\n• [Advanced Documentation Retrieval on FreeBSD](https://adventurist.me/posts/00306)\n• [OpenBSD Webzine Issue 3 is out](https://webzine.puffy.cafe/issue-3.html)\n• [How to connect and use Bluetooth headphones on FreeBSD](https://forums.freebsd.org/threads/bluetooth-audio-how-to-connect-and-use-bluetooth-headphones-on-freebsd.82671/)\n• [How To: Execute Firefox in a jail using iocage and ssh/jailme](https://forums.freebsd.org/threads/how-to-execute-firefox-in-a-jail-using-iocage-and-ssh-jailme.53362/)\n• [Understanding AWK](https://earthly.dev/blog/awk-examples/)\n• [“Domesticate Your Badgers” Kickstarter Opens](https://mwl.io/archives/13297)\n• [Bootstrap an OPNsense development environment in Vagrant](https://github.com/punktDe/vagrant-opnsense)\n• [VLANs Bridges and LAG Interface best practice questions](https://www.truenas.com/community/threads/vlans-bridges-and-lag-interface-best-practice-questions.93275/)\n• [A Console Desktop](https://pspodcasting.net/dan/blog/2018/console_desktop.html)\n• [CharmBUG Casual BSD Meetup and Games (Online)](https://www.meetup.com/CharmBUG/events/281822524)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Dan%20-%20ZFS%20question.md\" rel=\"nofollow\">Dan - ZFS question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/Lars%20-%20Thanks%20for%20the%20interview.md\" rel=\"nofollow\">Lars - Thanks for the interview</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/428/feedback/jesse%20-%20migrating%20data%20from%20old%20laptop.md\" rel=\"nofollow\">jesse - migrating data from old laptop</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD Part 1: How it all started, Explaining top(1) on FreeBSD, Measuring power efficiency of a CPU frequency scheduler on OpenBSD, CultBSD, a whole lot of BSD bits, and more. ","date_published":"2021-11-11T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d7be1ab-6939-4fcf-80da-698e14ce721d.mp3","mime_type":"audio/mpeg","size_in_bytes":30685968,"duration_in_seconds":3261}]},{"id":"e0be5e06-7a29-4e22-9828-6a34074a48e5","title":"427: Logging is important","url":"https://www.bsdnow.tv/427","content_text":"Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\nIf you like BSDNow, consider supporting us on Patreon\n\nHeadlines\n\nBuilding Your FreeBSD Developer Workstation Setup\n\n\n\nWhat I learned from Russian students: logging is important\n\n\n\nNews Roundup\n\nHow BSD Authentication works\n\n\n\npfSense Software is 15 Today!\n\n\n\nOPNsense® Business Edition 21.10 released\n\n\n\nGetting started with pot\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n## Feedback/Questions\nBenjamin - Question for Benedict\nNelson - Episode 419 correction\nPeter - state machines\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a><br>\nIf you like BSDNow, consider supporting us on <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">Patreon</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-developer-workstation-setup/\" rel=\"nofollow\">Building Your FreeBSD Developer Workstation Setup</a></h3>\n\n<hr>\n\n<h3><a href=\"https://peter.czanik.hu/posts/russian_students_logging\" rel=\"nofollow\">What I learned from Russian students: logging is important</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.lambda.cx/posts/how-bsd-authentication-works/\" rel=\"nofollow\">How BSD Authentication works</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.netgate.com/blog/pfsense-software-is-15-today\" rel=\"nofollow\">pfSense Software is 15 Today!</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-business-edition-21-10-released/\" rel=\"nofollow\">OPNsense® Business Edition 21.10 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://pot.pizzamig.dev/Getting/\" rel=\"nofollow\">Getting started with pot</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n## Feedback/Questions</li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Benjamin%20-%20Question%20for%20Benedict.md\" rel=\"nofollow\">Benjamin - Question for Benedict</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Nelson%20-%20Episode%20419%20correction.md\" rel=\"nofollow\">Nelson - Episode 419 correction</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/427/feedback/Peter%20-%20state%20machines.md\" rel=\"nofollow\">Peter - state machines</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Build Your FreeBSD Developer Workstation, logging is important, how BSD authentication works, pfSense turns 15 years old, OPNsense Business Edition 21.10 released,  getting started with pot, and more","date_published":"2021-11-04T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e0be5e06-7a29-4e22-9828-6a34074a48e5.mp3","mime_type":"audio/mpeg","size_in_bytes":27413712,"duration_in_seconds":2625}]},{"id":"8a560bbe-5ee6-4ac7-96a4-2b2ec958f138","title":"426: OpenBSD 7.0 Hero","url":"https://www.bsdnow.tv/426","content_text":"A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nIf you like BSDNow, consider supporting us on Patreon\n\nWhat Makes a Good Time to Use OpenZFS Slog and When Should You Avoid It\n\n\n\nOpenBSD 7.0 is out\n\n\n\nNews Roundup\n\nOpenBSD and Wayland\n\n\n\nUnlocking UVM faults yields significant performance boost\n\n\n\nBeastie Bits\n\nPLAN 9 DESKTOP GUIDE\nlibvirt and DragonFly\nEuroBSDCon 2021 videos are available\nIssue#1 of OpenBSD Webzine\nThe Beastie has landed.\nIt’s 1998 and you are Sun Microsystems...\n\n\nReply link that's down\nRSA/SHA1 signature type disabled by default in OpenSSH\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDan - IPFS\nJack - IPFS\nJohnny - AdvanceBSD\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<p>If you like BSDNow, consider supporting us on <a href=\"https://www.patreon.com/bsdnow\" rel=\"nofollow\">Patreon</a></p>\n\n<h3><a href=\"https://klarasystems.com/articles/what-makes-a-good-time-to-use-openzfs-slog-and-when-should-you-avoid-it/\" rel=\"nofollow\">What Makes a Good Time to Use OpenZFS Slog and When Should You Avoid It</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.openbsd.org/70.html\" rel=\"nofollow\">OpenBSD 7.0 is out</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.sizeofvoid.org/posts/2021-09-26-openbsd-wayland-report/\" rel=\"nofollow\">OpenBSD and Wayland</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210908084117\" rel=\"nofollow\">Unlocking UVM faults yields significant performance boost</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://pspodcasting.net/dan/blog/2019/plan9_desktop.html\" rel=\"nofollow\">PLAN 9 DESKTOP GUIDE</a><br>\n<a href=\"https://www.dragonflydigest.com/2021/10/04/26234.html\" rel=\"nofollow\">libvirt and DragonFly</a><br>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20210928192806\" rel=\"nofollow\">EuroBSDCon 2021 videos are available</a><br>\n<a href=\"https://twitter.com/lcheylus/status/1446553240707993600?s=28\" rel=\"nofollow\">Issue#1 of OpenBSD Webzine</a><br>\n<a href=\"https://twitter.com/ed_maste/status/1446846780663123968?s=28\" rel=\"nofollow\">The Beastie has landed.</a><br>\n<a href=\"https://twitter.com/knaversr/status/1443778072113602562\" rel=\"nofollow\">It’s 1998 and you are Sun Microsystems...</a></p>\n\n<ul>\n<li><a href=\"https://web.archive.org/web/20211011003830/https://www.landley.net/history/mirror/unix/srcos.html\" rel=\"nofollow\">Reply link that&#39;s down</a>\n<a href=\"https://undeadly.org/cgi?action=article;sid=20210830113413\" rel=\"nofollow\">RSA/SHA1 signature type disabled by default in OpenSSH</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Dan%20-%20IPFS.md\" rel=\"nofollow\">Dan - IPFS</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Jack%20-%20IPFS.md\" rel=\"nofollow\">Jack - IPFS</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/426/feedback/Johnny%20-%20AdvanceBSD.md\" rel=\"nofollow\">Johnny - AdvanceBSD</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"A Good Time to Use OpenZFS Slog, OpenBSD 7.0 is out, OpenBSD and Wayland, UVM faults yield significant performance boost, and more.","date_published":"2021-10-28T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8a560bbe-5ee6-4ac7-96a4-2b2ec958f138.mp3","mime_type":"audio/mpeg","size_in_bytes":35371176,"duration_in_seconds":3552}]},{"id":"af8c08aa-71ac-4c87-8145-6a672a9d7e5d","title":"425: Releases galore","url":"https://www.bsdnow.tv/425","content_text":"The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nRISC-V: The New Architecture on the Block\n\n\nIf you want more RISC-V, check out JT's interview with Mark Himelstein the CTO of RISC-V International\n***\n### OpenBSD on the Vortex86DX CPU\n***\n## News Roundup aka there’s been lots of releases recently so lets go through them:\n### Lumina 1.6.1\n### opnsense 21.7.3\n### LibreSSL patches\n### OpenBGPD 7.2\n### Midnight BSD 2.1.0\n### GhostBSD 21.09 ISO\n### helloSystemv0.6\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrandon - FreeBSD question\nBruce - Fixing a weird Apache Bug\nDan - zfs question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/risc-v-the-new-architecture-on-the-block/\" rel=\"nofollow\">RISC-V: The New Architecture on the Block</a></h3>\n\n<ul>\n<li>If you want more RISC-V, check out <a href=\"https://www.opensourcevoices.org/20\" rel=\"nofollow\">JT&#39;s interview with Mark Himelstein the CTO of RISC-V International</a>\n***\n### <a href=\"https://www.cambus.net/openbsd-on-the-vortex86dx-cpu/\" rel=\"nofollow\">OpenBSD on the Vortex86DX CPU</a>\n***\n## News Roundup aka there’s been lots of releases recently so lets go through them:\n### <a href=\"http://lumina-desktop.org/post/2021-10-05/\" rel=\"nofollow\">Lumina 1.6.1</a>\n### <a href=\"https://opnsense.org/opnsense-21-7-3-released/\" rel=\"nofollow\">opnsense 21.7.3</a>\n### <a href=\"https://bsdsec.net/articles/openbsd-errata-september-27-2021-libressl\" rel=\"nofollow\">LibreSSL patches</a>\n### <a href=\"https://marc.info/?l=openbsd-announce&m=163239274430211&w=2\" rel=\"nofollow\">OpenBGPD 7.2</a>\n### <a href=\"https://www.midnightbsd.org/notes/\" rel=\"nofollow\">Midnight BSD 2.1.0</a>\n### <a href=\"http://ghostbsd.org/ghostbsd_21.09.29_iso_now_available\" rel=\"nofollow\">GhostBSD 21.09 ISO</a>\n### <a href=\"https://github.com/helloSystem/ISO/releases/tag/r0.6.0\" rel=\"nofollow\">helloSystemv0.6</a></li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Brandon%20-%20FreeBSD%20question.md\" rel=\"nofollow\">Brandon - FreeBSD question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Bruce%20-%20Fixing%20a%20weird%20Apache%20Bug.md\" rel=\"nofollow\">Bruce - Fixing a weird Apache Bug</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/425/feedback/Dan%20-%20zfs%20question.md\" rel=\"nofollow\">Dan - zfs question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The New Architecture on the Block, OpenBSD on Vortex86DX CPU, lots of new releases, and more.","date_published":"2021-10-21T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/af8c08aa-71ac-4c87-8145-6a672a9d7e5d.mp3","mime_type":"audio/mpeg","size_in_bytes":25604952,"duration_in_seconds":2517}]},{"id":"6f778bcb-d4a7-469d-9ec2-8fed7fbe93a1","title":"424: Unveiling OpenBSD’s pledge","url":"https://www.bsdnow.tv/424","content_text":"J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD's pledge and unveil from Python, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nI got the J language working on OpenBSD\n\n\n\nRubenerd: Comparing FreeBSD GELI and OpenZFS encrypted pools with keys\n\n\n\nNews Roundup\n\nWhat is FreeBSD, actually? Think again.\n\n\n\nOpenBSD's pledge and unveil from Python\n\n\n\nBeastie Bits\n\n• [Hibernate time reduced](http://undeadly.org/cgi?action=article;sid=20210831050932)\n• [(open)rsync gains include/exclude support](http://undeadly.org/cgi?action=article;sid=20210830081715)\n• [Producer JT's latest ancient find that he needs help with](https://twitter.com/q5sys/status/1440105555754848257)\n• [Doas comes to MidnightBSD](https://github.com/slicer69/doas)\n• [FreeBSD SSH Hardening](https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)\n• [OpenBSD 6.8 and you](https://home.nuug.no/~peter/openbsd_and_you/#1)\n• [By default, scp(1) now uses SFTP protocol](https://undeadly.org/cgi?action=article;sid=20210910074941)\n• [FreeBSD 11.4 end-of-life](https://lists.freebsd.org/pipermail/freebsd-announce/2021-September/002060.html)\n• [sched_ule(4): Improve long-term load balancer](https://cgit.freebsd.org/src/commit/?id=e745d729be60a47b49eb19c02a6864a747fb2744)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD&#39;s pledge and unveil from Python, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://briancallahan.net/blog/20210911.html\" rel=\"nofollow\">I got the J language working on OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/my-first-prod-encrypted-openzfs-pool/\" rel=\"nofollow\">Rubenerd: Comparing FreeBSD GELI and OpenZFS encrypted pools with keys</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://medium.com/@probonopd/what-is-freebsd-actually-think-again-200c2752d026\" rel=\"nofollow\">What is FreeBSD, actually? Think again.</a></h3>\n\n<hr>\n\n<h3><a href=\"https://nullprogram.com/blog/2021/09/15/\" rel=\"nofollow\">OpenBSD&#39;s pledge and unveil from Python</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [Hibernate time reduced](http://undeadly.org/cgi?action=article;sid=20210831050932)\n• [(open)rsync gains include/exclude support](http://undeadly.org/cgi?action=article;sid=20210830081715)\n• [Producer JT&#39;s latest ancient find that he needs help with](https://twitter.com/q5sys/status/1440105555754848257)\n• [Doas comes to MidnightBSD](https://github.com/slicer69/doas)\n• [FreeBSD SSH Hardening](https://gist.github.com/koobs/e01cf8869484a095605404cd0051eb11)\n• [OpenBSD 6.8 and you](https://home.nuug.no/~peter/openbsd_and_you/#1)\n• [By default, scp(1) now uses SFTP protocol](https://undeadly.org/cgi?action=article;sid=20210910074941)\n• [FreeBSD 11.4 end-of-life](https://lists.freebsd.org/pipermail/freebsd-announce/2021-September/002060.html)\n• [sched_ule(4): Improve long-term load balancer](https://cgit.freebsd.org/src/commit/?id=e745d729be60a47b49eb19c02a6864a747fb2744)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"J language working on OpenBSD, Comparing FreeBSD GELI and OpenZFS encrypted pools, What is FreeBSD, actually?, OpenBSD's pledge and unveil from Python, and more.","date_published":"2021-10-14T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f778bcb-d4a7-469d-9ec2-8fed7fbe93a1.mp3","mime_type":"audio/mpeg","size_in_bytes":30778248,"duration_in_seconds":2981}]},{"id":"4773f65c-58e5-4661-8a0e-cd636e3a9997","title":"423: RACK the Stack ","url":"https://www.bsdnow.tv/423","content_text":"FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nServing Netflix Video at 400Gb/s on FreeBSD\n\n\n\nUsing the FreeBSD RACK TCP Stack\n\n\n\nNews Roundup\n\npkgupdate, an OpenBSD script to update packages fast\n\n\n\nPlasma System Monitor and FreeBSD\n\n\n\nTrueNAS vs FreeNAS (and why you should upgrade!)\n\n\n\nAutomatically lock screen on OpenBSD using xidle and xlock\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBen - LightDM with Slick-Greeter.md\nDave - Cloned Interface.md\nMJ Rodriguez - Sony.md\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://people.freebsd.org/%7Egallatin/talks/euro2021.pdf\" rel=\"nofollow\">Serving Netflix Video at 400Gb/s on FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/using-the-freebsd-rack-tcp-stack/\" rel=\"nofollow\">Using the FreeBSD RACK TCP Stack</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-08-15-openbsd-pkgupdate.html\" rel=\"nofollow\">pkgupdate, an OpenBSD script to update packages fast</a></h3>\n\n<hr>\n\n<h3><a href=\"https://euroquis.nl//kde/2021/09/15/systemmonitor.html\" rel=\"nofollow\">Plasma System Monitor and FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-vs-freenas-and-why-you-should-upgrade/\" rel=\"nofollow\">TrueNAS vs FreeNAS (and why you should upgrade!)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-07-30-openbsd-xidle-xlock.html\" rel=\"nofollow\">Automatically lock screen on OpenBSD using xidle and xlock</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Ben%20-%20LightDM%20with%20Slick-Greeter.md\" rel=\"nofollow\">Ben - LightDM with Slick-Greeter.md</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/Dave%20-%20Cloned%20Interface.md\" rel=\"nofollow\">Dave - Cloned Interface.md</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/423/feedback/MJ%20Rodriguez%20-%20Sony.md\" rel=\"nofollow\">MJ Rodriguez - Sony.md</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD serves Netflix Video at 400Gb/s, Using the RACK TCP stack, an OpenBSD script to update packages fast, Plasma System Monitor and FreeBSD, TrueNAS vs FreeNAS (and why you should upgrade!), auto lock screen on OpenBSD using xidle and xlock, and more","date_published":"2021-10-07T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4773f65c-58e5-4661-8a0e-cd636e3a9997.mp3","mime_type":"audio/mpeg","size_in_bytes":32212584,"duration_in_seconds":3090}]},{"id":"4ca5efbc-d83b-41a2-981c-42c4dacefb05","title":"422: The Brian Callahan Interview","url":"https://www.bsdnow.tv/422","content_text":"We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nInterview - Dr. Brian Robert Callahan - https://briancallahan.net/ / bcallah@bsdnetwork\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Brian Callahan.","content_html":"<p>We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Interview - Dr. Brian Robert Callahan - <a href=\"https://briancallahan.net/\" rel=\"nofollow\">https://briancallahan.net/</a> / <a href=\"https://mastodon.com/bcallah@bsdnetwork\" rel=\"nofollow\">bcallah@bsdnetwork</a></h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Brian Callahan.</p>","summary":"We interview Dr. Brian Callahan about his language porting work for OpenBSD, teaching with BSDs and recruiting students into projects, research, and his work at NYC*BUG in this week’s episode of BSDnow.","date_published":"2021-09-30T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4ca5efbc-d83b-41a2-981c-42c4dacefb05.mp3","mime_type":"audio/mpeg","size_in_bytes":30162984,"duration_in_seconds":2999}]},{"id":"626e101a-a6c2-43ce-ad87-018474d78971","title":"421: ZFS eats CPU","url":"https://www.bsdnow.tv/421","content_text":"Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nUseless use of GNU\n\n\n\nMeet the 2021 FreeBSD Google Summer of Code Students\n\n\n\nNews Roundup\n\nLarge Unix programs were historically not all that portable between Unixes\n\n\nReferences this article: I’m not sure that UNIX won\n***\n### A new path: vm86-based venix emulator\n***\n### ZFS Is Mysteriously Eating My CPU\n***\n### traceroute(8) gets speed boost\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAl - TransAtlantic Cables\nChristopher - NVMe\nJohnnyK - Vivaldi\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://jmmv.dev/2021/08/useless-use-of-gnu.html\" rel=\"nofollow\">Useless use of GNU</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/meet-the-2021-freebsd-google-summer-of-code-students/\" rel=\"nofollow\">Meet the 2021 FreeBSD Google Summer of Code Students</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ProgramsVsPortability\" rel=\"nofollow\">Large Unix programs were historically not all that portable between Unixes</a></h3>\n\n<ul>\n<li>References this article: <a href=\"https://rubenerd.com/im-not-sure-that-unix-won/\" rel=\"nofollow\">I’m not sure that UNIX won</a>\n***\n### <a href=\"http://bsdimp.blogspot.com/2021/08/a-new-path-vm86-based-venix-emulator.html\" rel=\"nofollow\">A new path: vm86-based venix emulator</a>\n***\n### <a href=\"http://www.brendangregg.com/blog/2021-09-06/zfs-is-mysteriously-eating-my-cpu.html\" rel=\"nofollow\">ZFS Is Mysteriously Eating My CPU</a>\n***\n### <a href=\"http://undeadly.org/cgi?action=article;sid=20210903094704\" rel=\"nofollow\">traceroute(8) gets speed boost</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Al%20-%20TransAtlantic%20Cables.md\" rel=\"nofollow\">Al - TransAtlantic Cables</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/Christopher%20-%20NVMe.md\" rel=\"nofollow\">Christopher - NVMe</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/421/feedback/JohnnyK%2-%20Vivaldi.md\" rel=\"nofollow\">JohnnyK - Vivaldi</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Useless use of GNU, Meet the 2021 FreeBSD GSoC Students, historical note on Unix portability, vm86-based venix emulator, ZFS Mysteriously Eating CPU, traceroute gets speed boost, and more ","date_published":"2021-09-23T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/626e101a-a6c2-43ce-ad87-018474d78971.mp3","mime_type":"audio/mpeg","size_in_bytes":32360040,"duration_in_seconds":3042}]},{"id":"8b8bd7d2-7ac2-4c6b-a33f-fcc39e355be5","title":"420: OpenBSD makes life better","url":"https://www.bsdnow.tv/420","content_text":"Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO's now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nChoosing The Right ZFS Pool Layout\n\n\n\nRecent and not so recent changes in OpenBSD that make life better (and may turn up elsewhere too)\n\n\n\nNews Roundup\n\nGhostBSD 21.09.06 ISO's now available\n\n\n\nFair Internet bandwidth management on a network using OpenBSD\n\n\n\nNetBSD wifi router project update\n\n\nBonus NetBSD Recent Developments: NetBSD on the Apple M1\n***\n### HardenedBSD August 2021 Status Report\n### FreeBSD Journal July/August 2021: Desktop/Wireless\n***\n### Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nJames - backup question\nJonathon - certifications\nMarty - RPG CLI\n*** \nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO&#39;s now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/choosing-the-right-zfs-pool-layout/\" rel=\"nofollow\">Choosing The Right ZFS Pool Layout</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdly.blogspot.com/2021/08/recent-and-not-so-recent-changes-in.html\" rel=\"nofollow\">Recent and not so recent changes in OpenBSD that make life better (and may turn up elsewhere too)</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.ghostbsd.org/ghostbsd_21.09.06_iso_now_available\" rel=\"nofollow\">GhostBSD 21.09.06 ISO&#39;s now available</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-08-30-openbsd-qos-lan.html\" rel=\"nofollow\">Fair Internet bandwidth management on a network using OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/wifi_project_status_update\" rel=\"nofollow\">NetBSD wifi router project update</a></h3>\n\n<ul>\n<li>Bonus NetBSD Recent Developments: <a href=\"https://mobile.twitter.com/jmcwhatever/status/1431575270436319235\" rel=\"nofollow\">NetBSD on the Apple M1</a>\n***\n### <a href=\"https://hardenedbsd.org/article/shawn-webb/2021-08-31/hardenedbsd-august-2021-status-report\" rel=\"nofollow\">HardenedBSD August 2021 Status Report</a>\n### <a href=\"https://freebsdfoundation.org/past-issues/desktop-wireless/\" rel=\"nofollow\">FreeBSD Journal July/August 2021: Desktop/Wireless</a>\n***\n### Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/James%20-%20backup%20question.md\" rel=\"nofollow\">James - backup question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Jonathon%20-%20certifications.md\" rel=\"nofollow\">Jonathon - certifications</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/420/feedback/Marty%20-%20RPG%20CLI.md\" rel=\"nofollow\">Marty - RPG CLI</a>\n*** </li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Choosing The Right ZFS Pool Layout, changes in OpenBSD that make life better, GhostBSD 21.09.06 ISO's now available, Fair Internet bandwidth management with OpenBSD, NetBSD wifi router project update, NetBSD on the Apple M1, HardenedBSD August Status Report, FreeBSD Journal on Wireless and Desktop, and more.\r\n","date_published":"2021-09-16T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8b8bd7d2-7ac2-4c6b-a33f-fcc39e355be5.mp3","mime_type":"audio/mpeg","size_in_bytes":32538960,"duration_in_seconds":2958}]},{"id":"4fb1ef2f-3915-403b-9687-47451b3339a9","title":"419: Rethinking OS installs","url":"https://www.bsdnow.tv/419","content_text":"Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nReviewing my first OpenBSD port, and what I'd do differently 10 years later\n\n\n\nInstall NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11\n\n\n\nNews Roundup\n\nFreeBSD Experiment Rethinks the OS Install\n\n\n\nThe switch to FreeBSD rc.d is coming\n\n\n\nIrix gets LLVM\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMiceal - a few questions\nNelson - dummynet\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://briancallahan.net/blog/20210802.html\" rel=\"nofollow\">Reviewing my first OpenBSD port, and what I&#39;d do differently 10 years later</a></h3>\n\n<hr>\n\n<h3><a href=\"https://raymii.org/s/articles/NetBSD_on_QEMU_Alpha.html\" rel=\"nofollow\">Install NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://hackaday.com/2021/08/10/freebsd-experiment-rethinks-the-os-install/\" rel=\"nofollow\">FreeBSD Experiment Rethinks the OS Install</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.ghostbsd.org/rc_switch\" rel=\"nofollow\">The switch to FreeBSD rc.d is coming</a></h3>\n\n<hr>\n\n<h3><a href=\"https://forums.irixnet.org/thread-3043.html\" rel=\"nofollow\">Irix gets LLVM</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Miceal%20-%20a%20few%20questions.md\" rel=\"nofollow\">Miceal - a few questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/419/feedback/Nelson%20-%20dummynet.md\" rel=\"nofollow\">Nelson - dummynet</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Reviewing a first OpenBSD port, NetBSD 9.2 on a DEC Alpha CPU in QEMU with X11, FreeBSD Experiment Rethinks the OS Install, GhostBSD switching to FreeBSD rc.d, Irix gets LLVM, and more.","date_published":"2021-09-09T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4fb1ef2f-3915-403b-9687-47451b3339a9.mp3","mime_type":"audio/mpeg","size_in_bytes":33694320,"duration_in_seconds":3099}]},{"id":"5b0aa0e0-4435-47d3-841a-91793cf37806","title":"418: The greatest time in history to be a creator","url":"https://www.bsdnow.tv/418","content_text":"In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.\n\nNOTES\n\nInterview - Michael W. Lucas - mwl@mwl.io / @mwlauthor\n\n\nCashflow for Creators\nCharity Auction Against Human Trafficking\nThis is the rfc about what to not do.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\nSpecial Guest: Michael W Lucas.","content_html":"<p>In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<h2>Interview - Michael W. Lucas - <a href=\"mailto:mwl@mwl.io\" rel=\"nofollow\">mwl@mwl.io</a> / <a href=\"https://twitter.com/mwlauthor\" rel=\"nofollow\">@mwlauthor</a></h2>\n\n<ul>\n<li><a href=\"https://mwl.io/nonfiction/biz-craft\" rel=\"nofollow\">Cashflow for Creators</a></li>\n<li><a href=\"https://mwl.io/archives/12526\" rel=\"nofollow\">Charity Auction Against Human Trafficking</a></li>\n<li><a href=\"https://datatracker.ietf.org/doc/html/rfc9049\" rel=\"nofollow\">This is the rfc about what to not do.</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr><p>Special Guest: Michael W Lucas.</p>","summary":"In this episode, we interview Michael W. Lucas about his latest book projects including Git sync murder, TLS Mastery, getting paid for creative work, writing tools and techniques, and more.","date_published":"2021-09-02T03:45:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5b0aa0e0-4435-47d3-841a-91793cf37806.mp3","mime_type":"audio/mpeg","size_in_bytes":32985120,"duration_in_seconds":3145}]},{"id":"63b2639c-ad67-45db-9581-8053963313c2","title":"417: bhyve private cloud","url":"https://www.bsdnow.tv/417","content_text":"Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nAchieving RPO/RTO Objectives with ZFS - Part 1\n\n\n\nFreeBSD Foundation Q2 Report\n\n\n\nOpenBSD full Tor setup\n\n\n\nNews Roundup\n\nMyBee — FreeBSD OS and hypervisor bhyve as private cloud\n\n\n\nExpanding our FreeBSD home file server\n\n\n\nOpenBSD on the Framework Laptop\n\n\n\nPortable GELI\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChunky_pie - zfs question\nPaul - several questions\nchris - firewall question\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/achieving-rpo-rto-objectives-with-zfs-part-1/\" rel=\"nofollow\">Achieving RPO/RTO Objectives with ZFS - Part 1</a></h3>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/freebsd-foundation-q2-2021-status-update/\" rel=\"nofollow\">FreeBSD Foundation Q2 Report</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-07-25-openbsd-full-tor.html\" rel=\"nofollow\">OpenBSD full Tor setup</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://habr.com/en/post/569226/\" rel=\"nofollow\">MyBee — FreeBSD OS and hypervisor bhyve as private cloud</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/expanding-our-freebsd-home-file-server/\" rel=\"nofollow\">Expanding our FreeBSD home file server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jcs.org/2021/08/06/framework\" rel=\"nofollow\">OpenBSD on the Framework Laptop</a></h3>\n\n<hr>\n\n<h3><a href=\"http://bijanebrahimi.github.io/blog/portable-geli.html\" rel=\"nofollow\">Portable GELI</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Chunky_pie%20-%20zfs%20question.md\" rel=\"nofollow\">Chunky_pie - zfs question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/Paul%20-%20several%20questions.md\" rel=\"nofollow\">Paul - several questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/417/feedback/chris%20-%20firewall%20question.md\" rel=\"nofollow\">chris - firewall question</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Achieving RPO/RTO Objectives with ZFS pt 1, FreeBSD Foundation Q2 report, OpenBSD full Tor setup, MyBee - bhyve as private cloud, FreeBSD home fileserver expansion, OpenBSD on Framework Laptop, portable GELI, and more.","date_published":"2021-08-26T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/63b2639c-ad67-45db-9581-8053963313c2.mp3","mime_type":"audio/mpeg","size_in_bytes":34928712,"duration_in_seconds":3438}]},{"id":"c6beac7b-f1bf-40bf-aaeb-a25eed202b81","title":"416: netcat printing","url":"https://www.bsdnow.tv/416","content_text":"OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nLets talk OpenZFS snapshots\n\n\n\nOpenSUSE in Bastille\n\n\n\nNews Roundup\n\nCUPS printing with netcat\n\n\n\nOpnsense-21.1.8\n\n\n\npfSense® Plus Software Version 21.05.1 is Now Available\n\n\n\nBeastie Bits\n\n• [MAC Inspired FreeBSD release](https://github.com/mszoek/airyx)\n• [Implement unprivileged chroot](https://cgit.freebsd.org/src/commit/?id=a40cf4175c90142442d0c6515f6c83956336699b)\n• [InitWare: A systemd fork that runs on BSD](https://github.com/InitWare/InitWare)\n• [multics gets a new release](https://multics-wiki.swenson.org/index.php/Main_Page)\n• [Open Source Voices interview with Tom Jones](https://www.opensourcevoices.org/17)\n• [PDP 11/03 Engineering Drawings](https://twitter.com/q5sys/status/1423092689084551171)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nOliver - zfs\nanders - vms\njeff - byhve guests\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/lets-talk-openzfs-snapshots/\" rel=\"nofollow\">Lets talk OpenZFS snapshots</a></h3>\n\n<hr>\n\n<h3><a href=\"https://peter.czanik.hu/posts/opensuse_in_bastille/\" rel=\"nofollow\">OpenSUSE in Bastille</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://retrohacker.substack.com/p/bye-cups-printing-with-netcat\" rel=\"nofollow\">CUPS printing with netcat</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-1-8-released/\" rel=\"nofollow\">Opnsense-21.1.8</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.netgate.com/blog/pfsense-plus-software-version-21.05.1-is-now-available-for-upgrades\" rel=\"nofollow\">pfSense® Plus Software Version 21.05.1 is Now Available</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [MAC Inspired FreeBSD release](https://github.com/mszoek/airyx)\n• [Implement unprivileged chroot](https://cgit.freebsd.org/src/commit/?id=a40cf4175c90142442d0c6515f6c83956336699b)\n• [InitWare: A systemd fork that runs on BSD](https://github.com/InitWare/InitWare)\n• [multics gets a new release](https://multics-wiki.swenson.org/index.php/Main_Page)\n• [Open Source Voices interview with Tom Jones](https://www.opensourcevoices.org/17)\n• [PDP 11/03 Engineering Drawings](https://twitter.com/q5sys/status/1423092689084551171)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/Olvier%20-%20zfs.md\" rel=\"nofollow\">Oliver - zfs</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/anders%20-%20vms.md\" rel=\"nofollow\">anders - vms</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/416/feedback/jeff%20-%20byhve%20guests.md\" rel=\"nofollow\">jeff - byhve guests</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenZFS snapshots, OpenSUSE on Bastille, printing with netcat, new opnsense 21.1.8 released, new pfsense plus software available, and more.","date_published":"2021-08-19T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6beac7b-f1bf-40bf-aaeb-a25eed202b81.mp3","mime_type":"audio/mpeg","size_in_bytes":33333456,"duration_in_seconds":3194}]},{"id":"272363c1-3756-4e81-91c6-a373b2104cc6","title":"415: Wrong OS Switch","url":"https://www.bsdnow.tv/415","content_text":"Wrong Way to Switch Server OS, Net/1 and Net/2 – A Path to Freedom, Permissions Two Mistakes, OpenBSD progress in supporting riscv64 platform, I2P intro, git sync murder is out, GhostBSD init system poll, and more  \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nThe Wrong Way to Switch Operating Systems on Your Server\n\n\n\nHistory of FreeBSD Part 5: Net/1 and Net/2 – A Path to Freedom\n\n\n\nNews Roundup\n\nPermissions Two Mistakes\n\n\n\nProgress in support for the riscv64 platform\n\n\n\nI2P Intro\n\n\n\n“$ git sync murder” is out, so: how many books have I written?\n\n\n\nWhat init system would you prefer to use under GhostBSD?\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - Replication\nBenedict writes after the show was over: The tool is called https://github.com/allanjude/zxfer\nTom tweeted right after recording stopped: \nhttps://twitter.com/adventureloop/status/1420478529238622210\nCaleb - Pronunciation of Gemini\nDan - Writeup about a DO FreeBSD Droplet\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Wrong Way to Switch Server OS, Net/1 and Net/2 – A Path to Freedom, Permissions Two Mistakes, OpenBSD progress in supporting riscv64 platform, I2P intro, git sync murder is out, GhostBSD init system poll, and more  </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://figbert.com/posts/wrong-way-to-switch-server-os/\" rel=\"nofollow\">The Wrong Way to Switch Operating Systems on Your Server</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/history-of-freebsd-net-1-and-net-2-a-path-to-freedom/\" rel=\"nofollow\">History of FreeBSD Part 5: Net/1 and Net/2 – A Path to Freedom</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/PermissionsTwoMistakes\" rel=\"nofollow\">Permissions Two Mistakes</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210619161607\" rel=\"nofollow\">Progress in support for the riscv64 platform</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-06-20-i2p-intro.html\" rel=\"nofollow\">I2P Intro</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/12105\" rel=\"nofollow\">“$ git sync murder” is out, so: how many books have I written?</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.ghostbsd.org/what_init_system_pool\" rel=\"nofollow\">What init system would you prefer to use under GhostBSD?</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Brad%20-%20Replication.md\" rel=\"nofollow\">Brad - Replication</a>\nBenedict writes after the show was over: The tool is called <a href=\"https://github.com/allanjude/zxfer\" rel=\"nofollow\">https://github.com/allanjude/zxfer</a>\nTom tweeted right after recording stopped: \n<a href=\"https://twitter.com/adventureloop/status/1420478529238622210\" rel=\"nofollow\">https://twitter.com/adventureloop/status/1420478529238622210</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Caleb%20-%20Pronounciation%20of%20Gemini.md\" rel=\"nofollow\">Caleb - Pronunciation of Gemini</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/415/feedback/Dan%20-%20Writeup%20about%20a%20DO%20FreeBSD%20Droplet.md\" rel=\"nofollow\">Dan - Writeup about a DO FreeBSD Droplet</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"","date_published":"2021-08-12T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/272363c1-3756-4e81-91c6-a373b2104cc6.mp3","mime_type":"audio/mpeg","size_in_bytes":33829368,"duration_in_seconds":3257}]},{"id":"8ff1080d-5b31-430b-91ae-f2d5431bb1cb","title":"414: Running online conferences","url":"https://www.bsdnow.tv/414","content_text":"OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nOpenZFS 2.1 is out\n\n\n\nFreeBSD TCP Performance System Controls\n\n\n\nNews Roundup\n\nIPFS OpenBSD\n\n\n\nTips for running an online conference\n\n\n\nMy Fanless OpenBSD Desktop\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBruce - Upgrading\nChris - SMB Followup\ndmilith - kTLS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://arstechnica.com/gadgets/2021/07/a-deep-dive-into-openzfs-2-1s-new-distributed-raid-topology/\" rel=\"nofollow\">OpenZFS 2.1 is out</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-tcp-performance-system-controls/\" rel=\"nofollow\">FreeBSD TCP Performance System Controls</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-04-17-ipfs-openbsd.html\" rel=\"nofollow\">IPFS OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2021/07/23/tips-for-running-an-online-conference/\" rel=\"nofollow\">Tips for running an online conference</a></h3>\n\n<hr>\n\n<h3><a href=\"https://jcs.org/2021/07/19/desktop\" rel=\"nofollow\">My Fanless OpenBSD Desktop</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Bruce%20-%20Upgrading.md\" rel=\"nofollow\">Bruce - Upgrading</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/Chris%20-%20SMB%20Followup.md\" rel=\"nofollow\">Chris - SMB Followup</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/414/feedback/dmilith%20-%20kTLS.md\" rel=\"nofollow\">dmilith - kTLS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenZFS 2.1 is out, FreeBSD TCP Performance System Controls, IPFS OpenBSD, tips for running an online conference, fanless OpenBSD laptop, and more.","date_published":"2021-08-05T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8ff1080d-5b31-430b-91ae-f2d5431bb1cb.mp3","mime_type":"audio/mpeg","size_in_bytes":41045544,"duration_in_seconds":3791}]},{"id":"e54035b9-3b93-4966-b35f-d6bf7ac2c51c","title":"413: BSD/Linux Chimera","url":"https://www.bsdnow.tv/413","content_text":"Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nUpdating GCC GNAT (Ada) in pkgsrc/NetBSD\n\n\n\nAdvance!BSD – thoughts on a not-for-profit project to support *BSD (2/2)\n\n\n\nNews Roundup\n\nFreeBSD from a NetBSD user’s perspective\n\n\n\nFPGA programming and DragonFly\n\n\n\nChimera Linux - A Linux distribution based on FreeBSD userland and LLVM\n\n\n\nEuroBSDcon 2021\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nCharlie - several questions\nDan - kernel driver or module question\nJames - Apple M1\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.irvise.xyz/Projects%20&%20Engineering/updating-gcc-ada-pkgsrc.html\" rel=\"nofollow\">Updating GCC GNAT (Ada) in pkgsrc/NetBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-2-2/\" rel=\"nofollow\">Advance!BSD – thoughts on a not-for-profit project to support *BSD (2/2)</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://washbear.neocities.org/freebsd-netbsd-user.html\" rel=\"nofollow\">FreeBSD from a NetBSD user’s perspective</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mastodon.sdf.org/@yrabbit/106497663837700420\" rel=\"nofollow\">FPGA programming and DragonFly</a></h3>\n\n<hr>\n\n<h3><a href=\"https://chimera-linux.org/\" rel=\"nofollow\">Chimera Linux - A Linux distribution based on FreeBSD userland and LLVM</a></h3>\n\n<hr>\n\n<h3><a href=\"https://2021.eurobsdcon.org/about/program/\" rel=\"nofollow\">EuroBSDcon 2021</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Charlie%20-%20several%20questions.md\" rel=\"nofollow\">Charlie - several questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/Dan%20-%20kernel%20driver%20or%20module%20question.md\" rel=\"nofollow\">Dan - kernel driver or module question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/413/feedback/James%20-%20Apple%20M1.md\" rel=\"nofollow\">James - Apple M1</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Updating GCC GNAT (Ada) in pkgsrc/NetBSD, AdvanceBSD thoughts 2/2, FreeBSD from a NetBSD user’s perspective, FPGA programming and DragonFly, Chimera Linux, EuroBSDcon 2021, and more.","date_published":"2021-07-29T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e54035b9-3b93-4966-b35f-d6bf7ac2c51c.mp3","mime_type":"audio/mpeg","size_in_bytes":29515944,"duration_in_seconds":2781}]},{"id":"f3fe3f12-5ca4-4339-b8e6-b5ca17f067d9","title":"412: Command-line secrets","url":"https://www.bsdnow.tv/412","content_text":"FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has \"COVID\", and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD Performance Observability\n\n\n\nAdvance!BSD – thoughts on a not-for-profit project to support *BSD (1/2)\n\n\n\nNews Roundup\n\nMaintainership Change :: Lumina Desktop Environment\n\nStudy the past if you would define the Future\n\n\n\nHow to Handle Secrets on the Command Line\n\n\n\nFollowing NetBSD, DragonFlyBSD Now Has \"COVID\"\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nJim - freebsd kde\nmichal - zfs question\ntim - lumina and snapshots\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has &quot;COVID&quot;, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-performance-observability/\" rel=\"nofollow\">FreeBSD Performance Observability</a></h3>\n\n<hr>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2021/06/20/advancebsd-thoughts-on-a-not-for-profit-project-to-support-bsd-1-2/\" rel=\"nofollow\">Advance!BSD – thoughts on a not-for-profit project to support *BSD (1/2)</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://lumina-desktop.org/post/2021-06-23/\" rel=\"nofollow\">Maintainership Change :: Lumina Desktop Environment</a></h3>\n\n<h3><a href=\"https://lumina-desktop.org/post/2021-07-01/\" rel=\"nofollow\">Study the past if you would define the Future</a></h3>\n\n<hr>\n\n<h3><a href=\"https://smallstep.com/blog/command-line-secrets/\" rel=\"nofollow\">How to Handle Secrets on the Command Line</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-COVID\" rel=\"nofollow\">Following NetBSD, DragonFlyBSD Now Has &quot;COVID&quot;</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/Jim%20-%20freebsd%20kde.md\" rel=\"nofollow\">Jim - freebsd kde</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/michal%20-%20zfs%20question.md\" rel=\"nofollow\">michal - zfs question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/412/feedback/tim%20-%20lumina%20and%20snapshots.md\" rel=\"nofollow\">tim - lumina and snapshots</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Performance Observability, Advance!BSD thoughts 1/2, Lumina Desktop Maintainership Change, How to Handle Secrets on the Command Line, Like NetBSD DragonFlyBSD Now Has \"COVID\", and more.","date_published":"2021-07-22T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f3fe3f12-5ca4-4339-b8e6-b5ca17f067d9.mp3","mime_type":"audio/mpeg","size_in_bytes":31518216,"duration_in_seconds":3046}]},{"id":"fbef1ff0-004b-4e2f-ba8a-60da4d3d818f","title":"411: FreeBSD Deep Dive","url":"https://www.bsdnow.tv/411","content_text":"Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more\n\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nThe Evolution of the Unix System Architecture\n\n• Full IEEE article: https://ieeexplore.ieee.org/document/8704965\n\n\n\n\nDeep Diving Into the Strengths of FreeBSD\n\n\n\n\n\nInteresting read on how Developers choose Names\n\n\n\nNews Roundup\n\nOPNsense 21.1.7 released\n\n\n\nSupport for chdir(2) in posix_spawn(3)\n\n\n\nvagrant-freebsd-boxbuilder\n\n\n\nOpenBSD has a file with 3-letter IATA airport codes\n\nBeastie Bits\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nlyubo - ipfw question\nmichael - a netbsd story\nsven - a dogs garage\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more</p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.spinellis.gr/blog/20210618/index.html\" rel=\"nofollow\">The Evolution of the Unix System Architecture</a></h3>\n\n<pre><code>• Full IEEE article: https://ieeexplore.ieee.org/document/8704965\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/deep-diving-into-the-strengths-of-freebsd/\" rel=\"nofollow\">Deep Diving Into the Strengths of FreeBSD</a></h3>\n\n<hr>\n\n<hr>\n\n<h3><a href=\"https://arxiv.org/abs/2103.07487\" rel=\"nofollow\">Interesting read on how Developers choose Names</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-1-7-released/\" rel=\"nofollow\">OPNsense 21.1.7 released</a></h3>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/support_for_chdir_2_in\" rel=\"nofollow\">Support for chdir(2) in posix_spawn(3)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/punktDe/vagrant-freebsd-boxbuilder\" rel=\"nofollow\">vagrant-freebsd-boxbuilder</a></h3>\n\n<hr>\n\n<h3><a href=\"https://twitter.com/jpmens/status/1408825989174546434?s=28\" rel=\"nofollow\">OpenBSD has a file with 3-letter IATA airport codes</a></h3>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/lyubo%20-%20ipfw%20question.md\" rel=\"nofollow\">lyubo - ipfw question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/michael%20-%20a%20netbsd%20story.md\" rel=\"nofollow\">michael - a netbsd story</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/411/feedback/sven%20-%20a%20dogs%20garage.md\" rel=\"nofollow\">sven - a dogs garage</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Unix System Architecture Evolution, Deep Dive into FreeBSD’s Strengths, how developers chose names, OPNsense 21.1.7 released, Support for chdir(2) in posix_spawn(3), vagrant-freebsd-boxbuilder, OpenBSD’s IATA airport code file, and more","date_published":"2021-07-15T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fbef1ff0-004b-4e2f-ba8a-60da4d3d818f.mp3","mime_type":"audio/mpeg","size_in_bytes":29125920,"duration_in_seconds":2781}]},{"id":"ca24916c-088c-4704-b7e5-617a89307013","title":"410: OpenBSD Consumer Gateway","url":"https://www.bsdnow.tv/410","content_text":"Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nThe Open-Source Software bubble that is and the blogging bubble that was\n\n\n\nBuilding Customized FreeBSD Images\n\n\n\nNews Roundup\n\nUpdating to Minecraft 1.17 in FreeBSD\n\n\n\nUpgrading a FreeBSD 12.2 jail to FreeBSD 13 using mkjail\n\n\n\nDragonFlyBSD 6.0 Is Performing Very Well Against Ubuntu Linux, FreeBSD 13.0\n\n\n\nAn OpenBSD Consumer Gateway Launch\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nCY - bearssl\nMarc - that tarsnap ad\nnycbug\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.baldurbjarnason.com/2021/the-oss-bubble-and-the-blogging-bubble/\" rel=\"nofollow\">The Open-Source Software bubble that is and the blogging bubble that was</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/building-customized-freebsd-images/\" rel=\"nofollow\">Building Customized FreeBSD Images</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rubenerd.com/updating-to-minecraft-1-17-in-freebsd/\" rel=\"nofollow\">Updating to Minecraft 1.17 in FreeBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2021/05/31/upgrading-a-freebsd-12-2-jail-to-freebsd-13-using-mkjail/\" rel=\"nofollow\">Upgrading a FreeBSD 12.2 jail to FreeBSD 13 using mkjail</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&item=corei9-freebsd13-dfly6&num=1\" rel=\"nofollow\">DragonFlyBSD 6.0 Is Performing Very Well Against Ubuntu Linux, FreeBSD 13.0</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.mail-archive.com/misc@openbsd.org/msg178573.html\" rel=\"nofollow\">An OpenBSD Consumer Gateway Launch</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/CY%20-%20bearssl.md\" rel=\"nofollow\">CY - bearssl</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/Marc%20-%20that%20tarsnap%20ad.md\" rel=\"nofollow\">Marc - that tarsnap ad</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/410/feedback/nycbug.md\" rel=\"nofollow\">nycbug</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Open Source and Blogging Bubbles, Building Customized FreeBSD Images, Updating Minecraft in FreeBSD, Upgrading FreeBSD jails using mkjail, Dragonfly 6.0 Performance benchmark, OpenBSD Consumer Gateway Launch, and more.","date_published":"2021-07-08T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca24916c-088c-4704-b7e5-617a89307013.mp3","mime_type":"audio/mpeg","size_in_bytes":26231352,"duration_in_seconds":2514}]},{"id":"de8a3516-c307-49bf-8afc-4f880bca5739","title":"409: The Filesystem Dungeon","url":"https://www.bsdnow.tv/409","content_text":"DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nDTrace Network Probes\n\n\n\nUnix Shell Programming: The Next 50 Years\n\n\n\nNews Roundup\n\nNetBSD on the Vortex86DX CPU\n\n\n\nSystem CPU time – ‘sys’ time in top\n\n\n\nrpg-cli —your filesystem as a dungeon!\n\n\n\nDiving into toolchains\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• [Alfred - Advice](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Alfred%20-%20Advice)\n• [CY - Portable Patch Util](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/CY%20-%20Portable%20Patch%20Util)\n• [Denis - State of ZFS Ecosystem](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Denis%20-%20State%20of%20ZFS%20Ecosystem)\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/dtrace-network-probes/\" rel=\"nofollow\">DTrace Network Probes</a></h3>\n\n<hr>\n\n<h3><a href=\"https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s06-greenberg.pdf\" rel=\"nofollow\">Unix Shell Programming: The Next 50 Years</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.cambus.net/netbsd-on-the-vortex86dx-cpu/\" rel=\"nofollow\">NetBSD on the Vortex86DX CPU</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.ycrash.io/2020/11/28/system-cpu-time-sys-time-in-top/\" rel=\"nofollow\">System CPU time – ‘sys’ time in top</a></h3>\n\n<hr>\n\n<h3><a href=\"https://github.com/facundoolano/rpg-cli\" rel=\"nofollow\">rpg-cli —your filesystem as a dungeon!</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/diving-into-toolchains/\" rel=\"nofollow\">Diving into toolchains</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• [Alfred - Advice](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Alfred%20-%20Advice)\n• [CY - Portable Patch Util](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/CY%20-%20Portable%20Patch%20Util)\n• [Denis - State of ZFS Ecosystem](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/409/feedback/Denis%20-%20State%20of%20ZFS%20Ecosystem)\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"DTrace network probes, next 50 years of shell programming, NetBSD on the Vortex86DX CPU, system CPU time in top, your filesystem as a dungeon, diving into toolchains, and more","date_published":"2021-07-01T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/de8a3516-c307-49bf-8afc-4f880bca5739.mp3","mime_type":"audio/mpeg","size_in_bytes":32932752,"duration_in_seconds":3123}]},{"id":"62094053-3e0f-4996-ac35-7d3f3a62572d","title":"408: FreeBSD DevSummit 2021","url":"https://www.bsdnow.tv/408","content_text":"Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\n2021 FreeBSD Developer Summit\n\n\n\nhelloSystem – FreeBSD Based OS Brings another Promising Release 0.5.0\n\n\n\nNews Roundup\n\nGearBSD: a project to help automating your OpenBSD\n\n\n\nOpenBGPD 7.0 released\n\n\n\nSimple use of Let's Encrypt on OpenBSD is pleasantly straightforward (as of 6.8)\n\n\n\nFreeBSD 13 on the Panasonic Let’s Note CF-RZ6\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• [Paul - ZFS Questions](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Paul%20-%20ZFS%20Questions)\n• [Rafael - relic](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Rafael%20-%20relic)\n• [matthew - sendfile and ktls](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/matthew%20-%20sendfile%20and%20ktls)\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-developer-summit-2021/\" rel=\"nofollow\">2021 FreeBSD Developer Summit</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.debugpoint.com/2021/06/hellosystem-0-5-0-release/\" rel=\"nofollow\">helloSystem – FreeBSD Based OS Brings another Promising Release 0.5.0</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-06-01-gearbsd.html\" rel=\"nofollow\">GearBSD: a project to help automating your OpenBSD</a></h3>\n\n<hr>\n\n<h3><a href=\"https://bsdsec.net/articles/openbgpd-7-0-released\" rel=\"nofollow\">OpenBGPD 7.0 released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDNiceLetsEncrypt\" rel=\"nofollow\">Simple use of Let&#39;s Encrypt on OpenBSD is pleasantly straightforward (as of 6.8)</a></h3>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/freebsd-13-on-the-panasonic-cf-rz6/\" rel=\"nofollow\">FreeBSD 13 on the Panasonic Let’s Note CF-RZ6</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• [Paul - ZFS Questions](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Paul%20-%20ZFS%20Questions)\n• [Rafael - relic](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/Rafael%20-%20relic)\n• [matthew - sendfile and ktls](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/408/feedback/matthew%20-%20sendfile%20and%20ktls)\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Report from virtual FreeBSD DevSummit 2021, another promising release by FreeBSD Based helloSystem, GearBSD, OpenBGPD release, Let’s Encrypt on OpenBSD, FreeBSD 13 on the Panasonic Let’s Note, and more\r\n","date_published":"2021-06-24T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/62094053-3e0f-4996-ac35-7d3f3a62572d.mp3","mime_type":"audio/mpeg","size_in_bytes":37936488,"duration_in_seconds":3469}]},{"id":"ffb08bc6-ffde-4b63-bd68-9f70872557ef","title":"407: The jail Detail","url":"https://www.bsdnow.tv/407","content_text":"Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nJails: Confining the omnipotent root\n\n\nA dramatic reading of portions of the paper: Papers We Love: FreeBSD Jails and Solaris Zones\n***\n### \nUsing Jails with ZFS and PF on DigitalOcean\n***\n## News Roundup\n### NomadBSD 130R is out\n***\n### KDE Plasma Wayland - a week in FreeBSD\n***\n### Install Firefox under FreeBSD and Set it Up with Privacy\n***\nUsing NetBSD’s pkgsrc everywhere I can\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMalcolm - restoring a single file\nNathan - wireless support\nbluefire - zfs special vdev\nPush to next show with Allan\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://phk.freebsd.dk/pubs/sane2000-jail.pdf\" rel=\"nofollow\">Jails: Confining the omnipotent root</a></h3>\n\n<ul>\n<li>A dramatic reading of portions of the paper: <a href=\"https://paperswelove.org/2016/video/bryan-cantrill-jails-and-solaris-zones/\" rel=\"nofollow\">Papers We Love: FreeBSD Jails and Solaris Zones</a>\n***\n### \n<a href=\"https://medium.com/chris-opperwall/using-jails-with-zfs-and-pf-on-digitalocean-b25b1da82e20\" rel=\"nofollow\">Using Jails with ZFS and PF on DigitalOcean</a>\n***\n## News Roundup\n### <a href=\"https://www.itsfoss.net/nomadbsd-130r-is-now-available-to-download-based-on-freebsd-13-0/\" rel=\"nofollow\">NomadBSD 130R is out</a>\n***\n### <a href=\"https://euroquis.nl//kde/2021/05/09/wayland.html\" rel=\"nofollow\">KDE Plasma Wayland - a week in FreeBSD</a>\n***\n### <a href=\"https://danschmid.de/en/blog/install-firefox-under-freebsd-and-set-it-up-with-privacy\" rel=\"nofollow\">Install Firefox under FreeBSD and Set it Up with Privacy</a>\n***\n<a href=\"https://rubenerd.com/using-netbsds-pkgsrc-everywhere-i-can/\" rel=\"nofollow\">Using NetBSD’s pkgsrc everywhere I can</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Malcolm%20-%20restoring%20a%20single%20file\" rel=\"nofollow\">Malcolm - restoring a single file</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/Nathan%20-%20wireless%20support\" rel=\"nofollow\">Nathan - wireless support</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/407/feedback/bluefire%20-%20zfs%20special%20vdev\" rel=\"nofollow\">bluefire - zfs special vdev</a>\nPush to next show with Allan</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Confining the omnipotent root, Jails with ZFS and PF on DigitalOcean, NomadBSD 130R is out, KDE Plasma Wayland on FreeBSD, Firefox under FreeBSD with Privacy, Using NetBSD’s pkgsrc everywhere, and more.","date_published":"2021-06-17T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ffb08bc6-ffde-4b63-bd68-9f70872557ef.mp3","mime_type":"audio/mpeg","size_in_bytes":27481848,"duration_in_seconds":2729}]},{"id":"e3529950-4aa4-49f7-833d-0218a912b866","title":"406: Jailed Gemini Capsule","url":"https://www.bsdnow.tv/406","content_text":"Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nGemini Capsule in a FreeBSD Jail\n\n\nWith the recent release of FreeBSD 13, I wanted to test it out on a spare RaspberryPi 3 that was part of my old Kubernetes cluster.\nIn particular, FreeBSD Jails have always interested me, although I’ve never used them in practice. Over the years I’ve managed operating system virtualization through Solaris Zones and Docker containers, and Jails seem like and good middle ground between the two - easier to manage than zones and closer to the OS than Docker.\nI also want to run my own Gemini capsule locally to use some of the features that my other hosted capsules don’t have (like SCGI/CGI) and setting up a capsule in a Jail is a good way to learn both at the same time.\n\n\n\n\nFreeBSD Quarterly status report 2021Q1\n\n\n\nNews Roundup\n\nNetBSD VM on bhyve (on TrueNAS)\n\n\nMy new NAS at home is running TrueNAS Core. So far, it has been excellent, however I struggled a bit setting up a NetBSD VM on it. Part of the problem is that a lot of the docs and how-tos I found are stale, and the information in it no longer applies.\nTrueNAS Core allows running VMs using bhyve, which is FreeBSD’s hypervisor. NetBSD is not an officially supported OS, at least according to the guest OS chooser in the TrueNAS web UI :) But since the release of NetBSD 9 a while ago, things have become far simpler than they used to be – with one caveat (see below).\n\n\n\n\nInterview with Michael Lucas *BSD, Unix, IT and other books author\n\n\nMichael Lucas is a famous IT book author. Perhaps best know for FreeBSD, OpenBSD, and Unix book series. He worked as a system administrator for many years and has now become a full-time book writer. Lately, I did a quick Q and A with Michael about his journey as a professional book author and his daily workflow for writing books.\n+\n\n\n\npfSense – WireGuard Returns as Experimental Package\n\n\n\nCGI with Awk on OpenBSD httpd\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questionsing\n\n\nAdam - system state during upgrade\npaul - BSD grep\nsub - feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.ecliptik.com/Gemini-Capsule-in-a-FreeBSD-Jail/\" rel=\"nofollow\">Gemini Capsule in a FreeBSD Jail</a></h3>\n\n<blockquote>\n<p>With the recent release of FreeBSD 13, I wanted to test it out on a spare RaspberryPi 3 that was part of my old Kubernetes cluster.<br>\nIn particular, FreeBSD Jails have always interested me, although I’ve never used them in practice. Over the years I’ve managed operating system virtualization through Solaris Zones and Docker containers, and Jails seem like and good middle ground between the two - easier to manage than zones and closer to the OS than Docker.<br>\nI also want to run my own Gemini capsule locally to use some of the features that my other hosted capsules don’t have (like SCGI/CGI) and setting up a capsule in a Jail is a good way to learn both at the same time.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2021-May/002033.html\" rel=\"nofollow\">FreeBSD Quarterly status report 2021Q1</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://bentsukun.ch/posts/bhyve-netbsd/\" rel=\"nofollow\">NetBSD VM on bhyve (on TrueNAS)</a></h3>\n\n<blockquote>\n<p>My new NAS at home is running TrueNAS Core. So far, it has been excellent, however I struggled a bit setting up a NetBSD VM on it. Part of the problem is that a lot of the docs and how-tos I found are stale, and the information in it no longer applies.<br>\nTrueNAS Core allows running VMs using bhyve, which is FreeBSD’s hypervisor. NetBSD is not an officially supported OS, at least according to the guest OS chooser in the TrueNAS web UI :) But since the release of NetBSD 9 a while ago, things have become far simpler than they used to be – with one caveat (see below).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/interview/michael-lucas-bsd-unix-it-and-other-books-author/\" rel=\"nofollow\">Interview with Michael Lucas *BSD, Unix, IT and other books author</a></h3>\n\n<blockquote>\n<p>Michael Lucas is a famous IT book author. Perhaps best know for FreeBSD, OpenBSD, and Unix book series. He worked as a system administrator for many years and has now become a full-time book writer. Lately, I did a quick Q and A with Michael about his journey as a professional book author and his daily workflow for writing books.<br>\n+</p>\n\n<hr>\n\n<h3><a href=\"https://www.netgate.com/blog/pfsense-wireguard-returns-as-an-experimental-package.html\" rel=\"nofollow\">pfSense – WireGuard Returns as Experimental Package</a></h3>\n\n<hr>\n\n<h3><a href=\"https://box.matto.nl/cgi-with-awk-on-openbsd-httpd.html\" rel=\"nofollow\">CGI with Awk on OpenBSD httpd</a></h3>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questionsing</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/Adam%20-%20system%20state%20during%20upgrade\" rel=\"nofollow\">Adam - system state during upgrade</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/paul%20-%20BSD%20grep\" rel=\"nofollow\">paul - BSD grep</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/406/feedback/sub%20-%20feedback\" rel=\"nofollow\">sub - feedback</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Gemini Capsule in a FreeBSD Jail, FreeBSD Quarterly status report 2021Q1, NetBSD VM on bhyve (on TrueNAS), Interview with Michael Lucas, WireGuard Returns as Experimental Package in pfSense, CGI with Awk on OpenBSD httpd, and more.","date_published":"2021-06-10T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e3529950-4aa4-49f7-833d-0218a912b866.mp3","mime_type":"audio/mpeg","size_in_bytes":33123216,"duration_in_seconds":3241}]},{"id":"6773957b-a891-4528-b317-452e8e5d41fc","title":"405: OOM Killer Feature","url":"https://www.bsdnow.tv/405","content_text":"NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nNetBSD 9.2 Released\n\n\n\nDragonFly 6.0 is out!\n\n\nRelease Notes\n***\n### EuroBSDCon 2021 will be online\n***\n## News Roundup\n### Home Network Monitoring using Prometheus\n&gt; This blog post describes my setup for monitoring various devices on my home network suh as servers, laptops/desktops, networking gear etc. The setup and configuration is squarely geared towards small/medium sized network monitoring. A similar setup might work for large networks, but you will need to plan your compute/storage/bandwidth capacities accordingly. I’m running all the monitoring software on FreeBSD, but you can run it on your choice of OS. Just make sure to install the packages using your OS’s package manager.\n***\n### Preventing FreeBSD to kill PostgreSQL (aka OOM Killer prevention)\n&gt; There are a lot of interesting articles on how to prevent the Out of Memory Killer (OOM killer in short) on Linux to ruin your day, or better your night. One particularly well done explanation about how the OOM Killer works, and how to help PostgreSQL to survive, is, in my humble opinion, the one from Percona Blog.\n***\n### Customizing Emacs for Git Commit Messages\n&gt;I do a lot of commits to the FreeBSD project and elsewhere. It would be nice if I could setup emacs in a custom way for each commit message that I'm editing.\n&gt; Fortunately, GNU Emacs provides a nice way to do just that. While I likely could do some of these things with git commit hooks, I find this to be a little nicer.\n***\n### Deleting old FreeBSD boot environments\n&gt; I like boot environments (BE) on FreeBSD. They were especially handy when building the AWS host for FreshPorts, since I had no serial console. I would create a BE saving the current status, then make some changes. I’d mark the current BE as boot once, so I could boot back in the known good BE. Worst case, I could mount the storage onto a rescue EC2 instance and adjust the bootfs value of the zpool.\n***\n\n\nAlways be quitting\n\n\nA good philosophy to live by at work is to “always be quitting”. No, don’t be constantly thinking of leaving your job.  But act as if you might leave on short notice. Counterintuitively, this will make you a better engineer and open up growth opportunities.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChristopher - zfs question\nChris - two questions\nVas - zpools and moving to FreeBSD 13\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/netbsd_9_2_released\" rel=\"nofollow\">NetBSD 9.2 Released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2021/05/10/25731.html\" rel=\"nofollow\">DragonFly 6.0 is out!</a></h3>\n\n<ul>\n<li><a href=\"https://www.dragonflybsd.org/release60/\" rel=\"nofollow\">Release Notes</a>\n***\n### <a href=\"https://2021.eurobsdcon.org/\" rel=\"nofollow\">EuroBSDCon 2021 will be online</a>\n***\n## News Roundup\n### <a href=\"https://linux-bsd.github.io/post/monitoring/\" rel=\"nofollow\">Home Network Monitoring using Prometheus</a>\n&gt; This blog post describes my setup for monitoring various devices on my home network suh as servers, laptops/desktops, networking gear etc. The setup and configuration is squarely geared towards small/medium sized network monitoring. A similar setup might work for large networks, but you will need to plan your compute/storage/bandwidth capacities accordingly. I’m running all the monitoring software on FreeBSD, but you can run it on your choice of OS. Just make sure to install the packages using your OS’s package manager.\n***\n### <a href=\"https://fluca1978.github.io/2021/04/02/OOMKillerFreeBSD.html\" rel=\"nofollow\">Preventing FreeBSD to kill PostgreSQL (aka OOM Killer prevention)</a>\n&gt; There are a lot of interesting articles on how to prevent the Out of Memory Killer (OOM killer in short) on Linux to ruin your day, or better your night. One particularly well done explanation about how the OOM Killer works, and how to help PostgreSQL to survive, is, in my humble opinion, the one from Percona Blog.\n***\n### <a href=\"http://bsdimp.blogspot.com/2021/04/customizing-emacs-for-git-commit.html\" rel=\"nofollow\">Customizing Emacs for Git Commit Messages</a>\n&gt;I do a lot of commits to the FreeBSD project and elsewhere. It would be nice if I could setup emacs in a custom way for each commit message that I&#39;m editing.\n&gt; Fortunately, GNU Emacs provides a nice way to do just that. While I likely could do some of these things with git commit hooks, I find this to be a little nicer.\n***\n### <a href=\"https://dan.langille.org/2021/04/15/deleting-old-freebsd-boot-environments/\" rel=\"nofollow\">Deleting old FreeBSD boot environments</a>\n&gt; I like boot environments (BE) on FreeBSD. They were especially handy when building the AWS host for FreshPorts, since I had no serial console. I would create a BE saving the current status, then make some changes. I’d mark the current BE as boot once, so I could boot back in the known good BE. Worst case, I could mount the storage onto a rescue EC2 instance and adjust the bootfs value of the zpool.\n***</li>\n</ul>\n\n<h3><a href=\"https://jmmv.dev/2021/04/always-be-quitting.html\" rel=\"nofollow\">Always be quitting</a></h3>\n\n<blockquote>\n<p>A good philosophy to live by at work is to “always be quitting”. No, don’t be constantly thinking of leaving your job.  But act as if you might leave on short notice. Counterintuitively, this will make you a better engineer and open up growth opportunities.</p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Christopher%20-%20zfs%20question\" rel=\"nofollow\">Christopher - zfs question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Chris%20-%20two%20questions\" rel=\"nofollow\">Chris - two questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/405/feedback/Vas%20-%20zpools%20and%20moving%20to%20FreeBSD%2013\" rel=\"nofollow\">Vas - zpools and moving to FreeBSD 13</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"NetBSD 9.2 released, DragonFly 6.0 is out, Home Network Monitoring using Prometheus, Preventing FreeBSD to kill PostgreSQL, Customizing Emacs for Git Commit Messages, Deleting old FreeBSD boot environments, Always be quitting, and more","date_published":"2021-06-03T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6773957b-a891-4528-b317-452e8e5d41fc.mp3","mime_type":"audio/mpeg","size_in_bytes":34765416,"duration_in_seconds":3429}]},{"id":"b6436b27-8f23-473c-bd4d-6cbac1cc9eef","title":"404: 404 BSD Now Hosts Not Found","url":"https://www.bsdnow.tv/404","content_text":"Allan, Benedict and Tom are MIA, so JT fills in with two friends.\n\nThis episode of BSDNow is brought to you by Tarsnap\nCoHosts this week:\n    • Ash Gokhale: https://twitter.com/xpi\n    • Jeff Propes : CoHost of The Opinion Dominion\n\nThis weeks format follows the format of one of JT's other shows: The Opinion Dominion.\n\nCentralized vs Decentralized Management\n\nAsh’s draid article at Klara\n\nopenbsd’s 50th release + Release Notes\n\nBeastie Bits\n\n•  Interesting dtrace papers I found this week.  The first is unfortunately paywalled by an industry journal but hopefully it’ll be publicly available soon.    \n    ◦ [Using Dtrace for Machine Learning Solutions in Malware Detection](https://ieeexplore.ieee.org/document/9225633)\n    ◦ [Process Monitoring on Sequences of System Call Count Vectors](https://arxiv.org/pdf/1707.03821.pdf)\n    ◦ Sounds Similar to:\n\n\n\nOptimyze Cloud](https://twitter.com/OptimyzeCloud/status/1386424419418099712)\nCADETS that GNN is working on]\n\n•  Practical IOT Hacking book out by no starch press\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nOpen Source Voices episode with Colin Percival\n\n\nRIP Dan kaminski\n\n• https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html\n• https://www.darkreading.com/vulnerabilities---threats/in-appreciation-dan-kaminsky/d/d-id/1340830\n• https://www.securityweek.com/security-researcher-dan-kaminsky-passes-away\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Allan, Benedict and Tom are MIA, so JT fills in with two friends.</p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a><br>\nCoHosts this week:<br>\n    • Ash Gokhale: <a href=\"https://twitter.com/xpi\" rel=\"nofollow\">https://twitter.com/xpi</a><br>\n    • Jeff Propes : CoHost of <a href=\"https://www.theopiniondominion.org\" rel=\"nofollow\">The Opinion Dominion</a></p>\n\n<h2>This weeks format follows the format of one of JT&#39;s other shows: <a href=\"https://www.theopiniondominion.org\" rel=\"nofollow\">The Opinion Dominion</a>.</h2>\n\n<h3>Centralized vs Decentralized Management</h3>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-draid-finally/\" rel=\"nofollow\">Ash’s draid article at Klara</a></h3>\n\n<h3><a href=\"https://twitter.com/openbsd/status/1388289402934333444\" rel=\"nofollow\">openbsd’s 50th release</a> + <a href=\"https://www.openbsd.org/69.html\" rel=\"nofollow\">Release Notes</a></h3>\n\n<h3>Beastie Bits</h3>\n\n<pre><code>•  Interesting dtrace papers I found this week.  The first is unfortunately paywalled by an industry journal but hopefully it’ll be publicly available soon.    \n    ◦ [Using Dtrace for Machine Learning Solutions in Malware Detection](https://ieeexplore.ieee.org/document/9225633)\n    ◦ [Process Monitoring on Sequences of System Call Count Vectors](https://arxiv.org/pdf/1707.03821.pdf)\n    ◦ Sounds Similar to:\n</code></pre>\n\n<ul>\n<li>Optimyze Cloud](<a href=\"https://twitter.com/OptimyzeCloud/status/1386424419418099712\" rel=\"nofollow\">https://twitter.com/OptimyzeCloud/status/1386424419418099712</a>)</li>\n<li><p><a href=\"https://apps.dtic.mil/sti/citations/AD1080643\" rel=\"nofollow\">CADETS that GNN is working on</a>]</p>\n\n<p>•  <a href=\"https://nostarch.com/practical-iot-hacking\" rel=\"nofollow\">Practical IOT Hacking book out by no starch press</a></p></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n<a href=\"https://www.opensourcevoices.org/12\" rel=\"nofollow\">Open Source Voices episode with Colin Percival</a></li>\n</ul>\n\n<h3>RIP Dan kaminski</h3>\n\n<pre><code>• https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html\n• https://www.darkreading.com/vulnerabilities---threats/in-appreciation-dan-kaminsky/d/d-id/1340830\n• https://www.securityweek.com/security-researcher-dan-kaminsky-passes-away\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Allan, Benedict and Tom are MIA, so JT fills in with two friends.","date_published":"2021-05-27T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6436b27-8f23-473c-bd4d-6cbac1cc9eef.mp3","mime_type":"audio/mpeg","size_in_bytes":29400792,"duration_in_seconds":2979}]},{"id":"7f8330e4-2752-4d4c-b7c6-ca165e78cf57","title":"403: The Linuxulator Investment","url":"https://www.bsdnow.tv/403","content_text":"Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nWhy You Should Use BSD Licensing for Your Next Open Source Project or Product\n\n\nThe term “open source” has its origins in the context of software development, designating a specific approach to developing computer programs. Nowadays, however, it stands for a broad set of values – open source means open exchange, transparency, collaborative participation and development for the benefit of the entire community.\n\n\n\nUpdate on FreeBSD Foundation Investment in Linuxulator\n\nDr. Emmett Brown’s similar-sounding Flux Capacitor from the movie Back to the Future bridged the dimension of time, uniting past, present, and future for the McFlys. Similarly, the FreeBSDⓇ Linuxulator project also bridges dimensions – in our case, these are LinuxⓇ and FreeBSD. \n\n\n\nNews Roundup\n\nOPNsense 21.1.5 released\n\nThis is mainly a security and reliablility update.  There are several FreeBSD\nsecurity advisories and updates for third party tools such as curl.\n\n\nOPNsense to rebase on FreeBSD 13\n***\n### FreeBSD meetings on the Desktop\nFreeBSD on the desktop is a whole stack - X11, Qt, KDE Frameworks, KDE Plasma and KDE Gear, and Wayland, and Poppler and GTK - o my!\n***\n### Running FreeBSD jails with containerd 1.5\ncontainerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj.\n***\n### Markdown, DocBook, and the quest for semantic documentation on NetBSD.org\nRecently, I’ve been doing a lot of maintenance of the NetBSD website. It contains a boatload of documentation, much of which was originally written in the 2000s. It has some special requirements: it has to work in text-based web browsers like lynx, or maybe even without any working browser installed at all, or just ftp(1) for downloading plain text over HTTP. Naturally, the most important parts are static, suitable for serving from the standard NetBSD http server, which runs from inetd by default.\n***\n\n\n\nBeastie Bits\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAlrekur - An Interesting FreeBSD Find\nThey presented at the FreeBSD Vendor summit last year too: https://www.youtube.com/watch?v=8LUdZseNrpE\nSven - feedback\nRobert - firewalling\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/why-you-should-use-bsd-licensing-for-your-next-open-source-project-or-product/\" rel=\"nofollow\">Why You Should Use BSD Licensing for Your Next Open Source Project or Product</a></h3>\n\n<blockquote>\n<p>The term “open source” has its origins in the context of software development, designating a specific approach to developing computer programs. Nowadays, however, it stands for a broad set of values – open source means open exchange, transparency, collaborative participation and development for the benefit of the entire community.</p>\n\n<hr>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/update-on-freebsd-foundation-investment-in-linuxulator/\" rel=\"nofollow\">Update on FreeBSD Foundation Investment in Linuxulator</a></h3>\n\n<p>Dr. Emmett Brown’s similar-sounding Flux Capacitor from the movie Back to the Future bridged the dimension of time, uniting past, present, and future for the McFlys. Similarly, the FreeBSDⓇ Linuxulator project also bridges dimensions – in our case, these are LinuxⓇ and FreeBSD. </p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-1-5-released/\" rel=\"nofollow\">OPNsense 21.1.5 released</a></h3>\n\n<p>This is mainly a security and reliablility update.  There are several FreeBSD<br>\nsecurity advisories and updates for third party tools such as curl.</p>\n\n<ul>\n<li><a href=\"https://forum.opnsense.org/index.php?topic=22761.msg108313#msg108313\" rel=\"nofollow\">OPNsense to rebase on FreeBSD 13</a>\n***\n### <a href=\"https://euroquis.nl//freebsd/2021/04/20/fbsd-bbb.html\" rel=\"nofollow\">FreeBSD meetings on the Desktop</a>\nFreeBSD on the desktop is a whole stack - X11, Qt, KDE Frameworks, KDE Plasma and KDE Gear, and Wayland, and Poppler and GTK - o my!\n***\n### <a href=\"https://samuel.karp.dev/blog/2021/05/running-freebsd-jails-with-containerd-1-5/\" rel=\"nofollow\">Running FreeBSD jails with containerd 1.5</a>\ncontainerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj.\n***\n### <a href=\"https://washbear.neocities.org/markdown.html\" rel=\"nofollow\">Markdown, DocBook, and the quest for semantic documentation on NetBSD.org</a>\nRecently, I’ve been doing a lot of maintenance of the NetBSD website. It contains a boatload of documentation, much of which was originally written in the 2000s. It has some special requirements: it has to work in text-based web browsers like lynx, or maybe even without any working browser installed at all, or just ftp(1) for downloading plain text over HTTP. Naturally, the most important parts are static, suitable for serving from the standard NetBSD http server, which runs from inetd by default.\n***</li>\n</ul>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Alrekur%20-%20An%20Interesting%20FreeBSD%20Find\" rel=\"nofollow\">Alrekur - An Interesting FreeBSD Find</a>\nThey presented at the FreeBSD Vendor summit last year too: <a href=\"https://www.youtube.com/watch?v=8LUdZseNrpE\" rel=\"nofollow\">https://www.youtube.com/watch?v=8LUdZseNrpE</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Sven%20-%20feedback\" rel=\"nofollow\">Sven - feedback</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/403/feedback/Robert%20-%20firewalling\" rel=\"nofollow\">Robert - firewalling</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Why You Should Use BSD Licensing for Your Next Open Source Project or Product, Update on FreeBSD Foundation Investment in Linuxulator, OPNsense 21.1.5 released, FreeBSD meetings on the Desktop, Running FreeBSD jails with containerd 1.5, Markdown, DocBook, and the quest for semantic documentation on NetBSD.org, and more.","date_published":"2021-05-20T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7f8330e4-2752-4d4c-b7c6-ca165e78cf57.mp3","mime_type":"audio/mpeg","size_in_bytes":31084416,"duration_in_seconds":3052}]},{"id":"8fa4abac-1e15-4f91-8893-ca72a65c95c1","title":"402: Goodbye GPL","url":"https://www.bsdnow.tv/402","content_text":"It's time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU's bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nIt's time to say goodbye to the GPL\n\n\nThe trigger for this post is the reinstating of Richard Stallman, a very problematic character, to the board of the Free Software Foundation (FSF). I am appalled by this move, and join others in the call for his removal.\nThis occasion has caused me to reevaluate the position of the FSF in computing. It is the steward of the GNU project (a part of Linux distributions, loosely speaking), and of a family of software licenses centred around the GNU General Public License (GPL). These efforts are unfortunately tainted by Stallman’s behaviour. However, this is not what I actually want to talk about today.\n\n\n\nrunj: a new OCI Runtime for FreeBSD Jails\n\nToday, I open-sourced runj, a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight Board of the Open Containers Initiative, I’m also interested in understanding how the OCI runtime specification can be adapted to other operating systems like FreeBSD.\n\n\n\nNews Roundup\n\nA Bit of Xenix History\n\nFrom 1986 to 1989, I worked in the Xenix1 group at Microsoft. It was my first job out of school, and I was the most junior person on the team. I was hopelessly naive, inexperienced, generally clueless, and borderline incompetent, but my coworkers were kind, supportive and enormously forgiving – just a lovely bunch of folks.\n\n\n\nOn Updating QEMU's bsd-user fork\n\n\n\n\nFreeBSD 13 on a 12 year old laptop\n\n\nMy old (2009) HP laptop now runs FreeBSD 13.0-RELEASE.\n\n\n\n\nBeastie Bits\n\n\nRegistration is now open for the June 2021 #FreeBSD Developers Summit\n6.0RC1 images available\nLexical File Names in Plan 9 or Getting Dot-Dot Right\nThe history of UTF-8 as told by Rob Pike\nInitial Support for the riscv64 Architecture\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nHamza - Congrats on 400\nRenato - DTS and ContainerD\nRob - Music\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>It&#39;s time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU&#39;s bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://martin.kleppmann.com/2021/04/14/goodbye-gpl.html\" rel=\"nofollow\">It&#39;s time to say goodbye to the GPL</a></h3>\n\n<blockquote>\n<p>The trigger for this post is the reinstating of Richard Stallman, a very problematic character, to the board of the Free Software Foundation (FSF). I am appalled by this move, and join others in the call for his removal.<br>\nThis occasion has caused me to reevaluate the position of the FSF in computing. It is the steward of the GNU project (a part of Linux distributions, loosely speaking), and of a family of software licenses centred around the GNU General Public License (GPL). These efforts are unfortunately tainted by Stallman’s behaviour. However, this is not what I actually want to talk about today.</p>\n\n<hr>\n\n<h3><a href=\"https://samuel.karp.dev/blog/2021/03/runj-a-new-oci-runtime-for-freebsd-jails/\" rel=\"nofollow\">runj: a new OCI Runtime for FreeBSD Jails</a></h3>\n\n<p>Today, I open-sourced runj, a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight Board of the Open Containers Initiative, I’m also interested in understanding how the OCI runtime specification can be adapted to other operating systems like FreeBSD.</p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://seefigure1.com/2014/04/15/xenixtime.html\" rel=\"nofollow\">A Bit of Xenix History</a></h3>\n\n<p>From 1986 to 1989, I worked in the Xenix1 group at Microsoft. It was my first job out of school, and I was the most junior person on the team. I was hopelessly naive, inexperienced, generally clueless, and borderline incompetent, but my coworkers were kind, supportive and enormously forgiving – just a lovely bunch of folks.</p>\n\n<hr>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2021/05/on-updating-qemus-bsd-user-fork.html\" rel=\"nofollow\">On Updating QEMU&#39;s bsd-user fork</a></h3>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"http://box.matto.nl/freebsd-13-on-a-12-year-old-laptop.html\" rel=\"nofollow\">FreeBSD 13 on a 12 year old laptop</a></h3>\n\n<blockquote>\n<p>My old (2009) HP laptop now runs FreeBSD 13.0-RELEASE.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/i/web/status/1387797859479732227\" rel=\"nofollow\">Registration is now open for the June 2021 #FreeBSD Developers Summit</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2021/04/22/25663.html\" rel=\"nofollow\">6.0RC1 images available</a></li>\n<li><a href=\"https://plan9.io/sys/doc/lexnames.pdf\" rel=\"nofollow\">Lexical File Names in Plan 9 or Getting Dot-Dot Right</a></li>\n<li><a href=\"http://doc.cat-v.org/bell_labs/utf-8_history\" rel=\"nofollow\">The history of UTF-8 as told by Rob Pike</a></li>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20210423090342\" rel=\"nofollow\">Initial Support for the riscv64 Architecture</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Hamza%20-%20Congrats%20on%20400\" rel=\"nofollow\">Hamza - Congrats on 400</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Renato%20-%20DTS%20and%20ContainerD\" rel=\"nofollow\">Renato - DTS and ContainerD</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/402/feedback/Rob%20-%20Music\" rel=\"nofollow\">Rob - Music</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"It's time to say goodbye to the GPL, a new OCI Runtime for FreeBSD Jails, A bit of Xenix history, On Updating QEMU's bsd-user fork, FreeBSD 13 on a 12 year old laptop, and more ","date_published":"2021-05-13T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8fa4abac-1e15-4f91-8893-ca72a65c95c1.mp3","mime_type":"audio/mpeg","size_in_bytes":30499968,"duration_in_seconds":2978}]},{"id":"65fbc474-0108-451b-a15c-d5d9bd7ca153","title":"401: OpenBSD Dog Garage","url":"https://www.bsdnow.tv/401","content_text":"Dog's Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD's ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nMy Dog's Garage Runs OpenBSD\n\n\nI was inspired by the April 2017 article in undeadly.org about getting OpenBSD running on a Raspberry Pi 3B+. My goal was to use a Raspberry Pi running OpenBSD to monitor the temperature in my garage from my home. My dog has his own little \"apartment\" inside the garage, so I want to keep an eye on the temperature. (I don't rely on this device. He sleeps inside the house whenever he wants.)\n\n\n\n\nEuroBSDcon 2021 Call for Papers\n\n\n\nFreeBSD iostat\n\n\n\nThe state of toolchains in NetBSD\n\n\nWhile FreeBSD and OpenBSD both switched to using LLVM/Clang as their base system compiler, NetBSD picked a different path and remained with GCC and binutils regardless of the license change to GPLv3. However, it doesn't mean that the NetBSD project endorses this license, and the NetBSD Foundation's has issued a statement about its position on the subject.\n\n\n\nNetBSD’s statement\n***\n\n\nNews Roundup\n\nBandwidth limiting on OpenBSD 6.8\n\n\nI will explain how to limit bandwidth on OpenBSD using its firewall PF (Packet Filter) queuing capability. It is a very powerful feature but it may be hard to understand at first. What is very important to understand is that it's technically not possible to limit the bandwidth of the whole system, because once data is getting on your network interface, it's already there and got by your router, what is possible is to limit the upload rate to cap the download rate.\n\n\n\nFreeBSD's ports migration to git and its impact on HardenedBSD\n\nFreeBSD completed their ports migration from subversion to git. Prior to the official switch, we used the read-only mirror FreeBSD had at GitHub[1]. The new repo is at [2]. A cursory glance at the new repo will show that the commit hashes changed. This presents an issue with HardenedBSD's ports tree in our merge-based workflow.\n\n\n\n\nTrueNAS 12.0-U3 has been released\n\n\niXsystems is excited to announce TrueNAS 12.0-U3 was released today and marks an important milestone in the transition from FreeNAS to TrueNAS. TrueNAS 12.0 is now considered by iXsystems to be a higher quality release than FreeNAS 11.3-U5, our previous benchmark. The new TrueNAS documentation site has also reached a point where it has more content and capabilities than FreeNAS. TrueNAS 12.0 is ready for mission-critical enterprise deployments.\n\n\n\n\nBeastie Bits\n\n\nJoyent provides pkgsrc for MacOS X\nArchives of old Irix documentation\nFreeBSD Developer/Vendor Summit 2021\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAndre - splitting zfs array\nBruce - Command Change\nDan - Annoyances with ZFS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Dog&#39;s Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD&#39;s ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210415055717\" rel=\"nofollow\">My Dog&#39;s Garage Runs OpenBSD</a></h3>\n\n<blockquote>\n<p>I was inspired by the April 2017 article in undeadly.org about getting OpenBSD running on a Raspberry Pi 3B+. My goal was to use a Raspberry Pi running OpenBSD to monitor the temperature in my garage from my home. My dog has his own little &quot;apartment&quot; inside the garage, so I want to keep an eye on the temperature. (I don&#39;t rely on this device. He sleeps inside the house whenever he wants.)</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://2021.eurobsdcon.org/about/cfp/\" rel=\"nofollow\">EuroBSDcon 2021 Call for Papers</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-iostat-a-quick-glance/\" rel=\"nofollow\">FreeBSD iostat</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/the-state-of-toolchains-in-netbsd/\" rel=\"nofollow\">The state of toolchains in NetBSD</a></h3>\n\n<blockquote>\n<p>While FreeBSD and OpenBSD both switched to using LLVM/Clang as their base system compiler, NetBSD picked a different path and remained with GCC and binutils regardless of the license change to GPLv3. However, it doesn&#39;t mean that the NetBSD project endorses this license, and the NetBSD Foundation&#39;s has issued a statement about its position on the subject.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"http://cvsweb.netbsd.org/bsdweb.cgi/src/external/gpl3/README?rev=1.1\" rel=\"nofollow\">NetBSD’s statement</a>\n***</li>\n</ul>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-02-07-limit.html\" rel=\"nofollow\">Bandwidth limiting on OpenBSD 6.8</a></h3>\n\n<blockquote>\n<p>I will explain how to limit bandwidth on OpenBSD using its firewall PF (Packet Filter) queuing capability. It is a very powerful feature but it may be hard to understand at first. What is very important to understand is that it&#39;s technically not possible to limit the bandwidth of the whole system, because once data is getting on your network interface, it&#39;s already there and got by your router, what is possible is to limit the upload rate to cap the download rate.</p>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2021-04-06/freebsds-ports-migration-git-and-its-impact-hardenedbsd\" rel=\"nofollow\">FreeBSD&#39;s ports migration to git and its impact on HardenedBSD</a></h3>\n\n<p>FreeBSD completed their ports migration from subversion to git. Prior to the official switch, we used the read-only mirror FreeBSD had at GitHub[1]. The new repo is at [2]. A cursory glance at the new repo will show that the commit hashes changed. This presents an issue with HardenedBSD&#39;s ports tree in our merge-based workflow.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.truenas.com/docs/releasenotes/core/12.0u3/\" rel=\"nofollow\">TrueNAS 12.0-U3 has been released</a></h3>\n\n<blockquote>\n<p>iXsystems is excited to announce TrueNAS 12.0-U3 was released today and marks an important milestone in the transition from FreeNAS to TrueNAS. TrueNAS 12.0 is now considered by iXsystems to be a higher quality release than FreeNAS 11.3-U5, our previous benchmark. The new TrueNAS documentation site has also reached a point where it has more content and capabilities than FreeNAS. TrueNAS 12.0 is ready for mission-critical enterprise deployments.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://pkgsrc.joyent.com/install-on-osx/\" rel=\"nofollow\">Joyent provides pkgsrc for MacOS X</a></li>\n<li><a href=\"https://techpubs.jurassic.nl\" rel=\"nofollow\">Archives of old Irix documentation</a></li>\n<li><a href=\"https://wiki.freebsd.org/DevSummit/202106\" rel=\"nofollow\">FreeBSD Developer/Vendor Summit 2021</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Andre%20-%20splitting%20zfs%20array\" rel=\"nofollow\">Andre - splitting zfs array</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Bruce%20-%20Command%20Change\" rel=\"nofollow\">Bruce - Command Change</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/401/feedback/Dan%20-%20Annoyances%20with%20ZFS\" rel=\"nofollow\">Dan - Annoyances with ZFS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Dog's Garage Runs OpenBSD, EuroBSDcon 2021 Call for Papers, FreeBSD’s iostat, The state of toolchains in NetBSD, Bandwidth limiting on OpenBSD 6.8, FreeBSD's ports migration to git and its impact on HardenedBSD, TrueNAS 12.0-U3 has been released, and more.","date_published":"2021-05-06T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/65fbc474-0108-451b-a15c-d5d9bd7ca153.mp3","mime_type":"audio/mpeg","size_in_bytes":35418744,"duration_in_seconds":3483}]},{"id":"3117fff6-093a-49a0-b8a2-c8628deb83e5","title":"400: FreeBSD became 13","url":"https://www.bsdnow.tv/400","content_text":"FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD 13.0 R Annoucement\n\n• OpenZFS 2.0 (almost 2.1) is included in 13.0\n• Removed support for previously-deprecated algorithms in geli(8).\n• The armv8crypto(4) driver now supports AES-GCM which is used by IPsec and kernel TLS.\n\n\n\n\nEnable multi-factor authentication on OpenBSD\n\n\nIn this article I will explain how to add a bit more security to your OpenBSD system by adding a requirement for user logging into the system, locally or by ssh. I will explain how to setup 2 factor authentication (2FA) using TOTP on OpenBSD\n\n\n\n\nNews Roundup\n\nKDE on FreeBSD 2021o2\n\n\nGosh, second octant already! Well, let’s take a look at the big things that happened in KDE-on-FreeBSD in these six-and-a-half weeks.\n\n\n\n\nGSoC Reports: Make system(3), popen(3) and popenve(3) use posix_spawn(3) internally (Final report)\n\n\nMy code can be found at github.com/teknokatze/src in the gsoc2020 branch, at the time of writing some of it is still missing. The test facilities and logs can be found in github.com/teknokatze/gsoc2020. A diff can be found at github which will later be split into several patches before it is sent to QA for merging.\nThe initial and defined goal of this project was to make system(3) and popen(3) use posix_spawn(3) internally, which had been completed in June. For the second part I was given the task to replace fork+exec calls in our standard shell (sh) in one scenario. Similar to the previous goal we determined through implementation if the initial motivation, to get performance improvements, is correct otherwise we collect metrics for why posix_spawn() in this case should be avoided. This second part meant in practice that I had to add and change code in the kernel, add a new public libc function, and understand shell internals.\n\n\n\n\nA working D compiler on OpenBSD\n\n\nDr. Brian Robert Callahan (bcallah@) blogged about his work in getting D compiler(s) working under OpenBSD.\n\n\nFull Post\n***\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nVasilis - upgrade question\nDennis - zfs questions\nDaniel Dettlaff - KTLS question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/13.0R/announce/\" rel=\"nofollow\">FreeBSD 13.0 R Annoucement</a></h3>\n\n<pre><code>• OpenZFS 2.0 (almost 2.1) is included in 13.0\n• Removed support for previously-deprecated algorithms in geli(8).\n• The armv8crypto(4) driver now supports AES-GCM which is used by IPsec and kernel TLS.\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-02-06-openbsd-2fa.html\" rel=\"nofollow\">Enable multi-factor authentication on OpenBSD</a></h3>\n\n<blockquote>\n<p>In this article I will explain how to add a bit more security to your OpenBSD system by adding a requirement for user logging into the system, locally or by ssh. I will explain how to setup 2 factor authentication (2FA) using TOTP on OpenBSD</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://euroquis.nl/kde/2021/03/26/freebsd2021o2.html\" rel=\"nofollow\">KDE on FreeBSD 2021o2</a></h3>\n\n<blockquote>\n<p>Gosh, second octant already! Well, let’s take a look at the big things that happened in KDE-on-FreeBSD in these six-and-a-half weeks.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/gsoc_reports_make_system_31\" rel=\"nofollow\">GSoC Reports: Make system(3), popen(3) and popenve(3) use posix_spawn(3) internally (Final report)</a></h3>\n\n<blockquote>\n<p>My code can be found at github.com/teknokatze/src in the gsoc2020 branch, at the time of writing some of it is still missing. The test facilities and logs can be found in github.com/teknokatze/gsoc2020. A diff can be found at github which will later be split into several patches before it is sent to QA for merging.<br>\nThe initial and defined goal of this project was to make system(3) and popen(3) use posix_spawn(3) internally, which had been completed in June. For the second part I was given the task to replace fork+exec calls in our standard shell (sh) in one scenario. Similar to the previous goal we determined through implementation if the initial motivation, to get performance improvements, is correct otherwise we collect metrics for why posix_spawn() in this case should be avoided. This second part meant in practice that I had to add and change code in the kernel, add a new public libc function, and understand shell internals.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210322080633\" rel=\"nofollow\">A working D compiler on OpenBSD</a></h3>\n\n<blockquote>\n<p>Dr. Brian Robert Callahan (bcallah@) blogged about his work in getting D compiler(s) working under OpenBSD.</p>\n\n<ul>\n<li><a href=\"https://briancallahan.net/blog/20210320.html\" rel=\"nofollow\">Full Post</a>\n***</li>\n</ul>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Vasilis%20-%20upgrade%20question\" rel=\"nofollow\">Vasilis - upgrade question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/Dennis%20-%20zfs%20questions\" rel=\"nofollow\">Dennis - zfs questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/400/feedback/dmilith%20-%20KTLS\" rel=\"nofollow\">Daniel Dettlaff - KTLS question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":" FreeBSD 13 is here, multi-factor authentication on OpenBSD, KDE on FreeBSD 2021o2, NetBSD GSoC report, a working D compiler on OpenBSD, and more","date_published":"2021-04-29T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3117fff6-093a-49a0-b8a2-c8628deb83e5.mp3","mime_type":"audio/mpeg","size_in_bytes":40681968,"duration_in_seconds":3763}]},{"id":"3de2dd50-eca9-4729-9ef6-464aa4ec5795","title":"399: Comparing Sandboxes","url":"https://www.bsdnow.tv/399","content_text":"Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nComparing sandboxing techniques\n\n\nI had the opportunity to implement a sandbox and I'd like to write about the differences between the various sandboxing techniques available on three different operating systems: FreeBSD, Linux and OpenBSD.\n\n\n\nStatement on FreeBSD development processes\n\nIn light of the recent commentary on FreeBSD's development practices, members of the Core team would like to issue the following statement.\n\n\n\nCustomizing FreeBSD Ports and Packages\n\nA basic intro to building your own packages\n\n\n\n\nNews Roundup\n\nFVWM(3) and the quest for a comfortable NetBSD desktop\n\n\nFVWM substantially allows one to build a fully-fledged lightweight desktop environment from scratch, with an almost unparalleled degree of freedom. Although using FVWM does not require any knowledge of programming languages, it is possible to extend it with M4, C, and Perl preprocessing.\n\n\n\nNginx as a TCP/UDP relay\n\nIn this tutorial I will explain how to use Nginx as a TCP or UDP relay as an alternative to Haproxy or Relayd. This mean nginx will be able to accept requests on a port (TCP/UDP) and relay it to another backend without knowing about the content. It also permits to negociates a TLS session with the client and relay to a non-TLS backend. In this example I will explain how to configure Nginx to accept TLS requests to transmit it to my Gemini server Vger, Gemini protocol has TLS as a requirement.\n\n\n\nHardenedBSD March 2021 Status Report\n\nThis month, I worked on finding and fixing the regression that caused kernel panics on our package builders. I think I found the issue: I made it so that the HARDENEDBSD amd64 kernel just included GENERIC so that we follow FreeBSD's toggling of features. Doing so added QUEUE_MACRO_DEBUG_TRASH to our kernel config. That option is the likely culprit. If the next package build (with the option removed) completes, I will commit the change that removes QUEUE_MACRO_DEBUG_TRASH from the HARDENEDBSD amd64 kernel.\n\n\n\nDetailed Behaviors of Unix Signal\n\nWhen Unix is mentioned in this document it means macOS or Linux as they are the mainly used Unix at this moment. When shell is mentioned it means Bash or Zsh. Most demos are written in C for macOS with Apple libc and Linux with glibc.\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nFeedback/Questions\n\n\nandrew - flatpak\nchris - mac and truenas\nrobert - some questions\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.omarpolo.com/post/gmid-sandbox.html\" rel=\"nofollow\">Comparing sandboxing techniques</a></h3>\n\n<blockquote>\n<p>I had the opportunity to implement a sandbox and I&#39;d like to write about the differences between the various sandboxing techniques available on three different operating systems: FreeBSD, Linux and OpenBSD.</p>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057127.html\" rel=\"nofollow\">Statement on FreeBSD development processes</a></h3>\n\n<p>In light of the recent commentary on FreeBSD&#39;s development practices, members of the Core team would like to issue the following statement.</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/customizing-freebsd-ports-and-packages/\" rel=\"nofollow\">Customizing FreeBSD Ports and Packages</a></h3>\n\n<p>A basic intro to building your own packages</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.unitedbsd.com/d/442-fvwm3-and-the-quest-for-a-comfortable-netbsd-desktop\" rel=\"nofollow\">FVWM(3) and the quest for a comfortable NetBSD desktop</a></h3>\n\n<blockquote>\n<p>FVWM substantially allows one to build a fully-fledged lightweight desktop environment from scratch, with an almost unparalleled degree of freedom. Although using FVWM does not require any knowledge of programming languages, it is possible to extend it with M4, C, and Perl preprocessing.</p>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2021-02-24-nginx-stream.html\" rel=\"nofollow\">Nginx as a TCP/UDP relay</a></h3>\n\n<p>In this tutorial I will explain how to use Nginx as a TCP or UDP relay as an alternative to Haproxy or Relayd. This mean nginx will be able to accept requests on a port (TCP/UDP) and relay it to another backend without knowing about the content. It also permits to negociates a TLS session with the client and relay to a non-TLS backend. In this example I will explain how to configure Nginx to accept TLS requests to transmit it to my Gemini server Vger, Gemini protocol has TLS as a requirement.</p>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2021-03-31/hardenedbsd-march-2021-status-report\" rel=\"nofollow\">HardenedBSD March 2021 Status Report</a></h3>\n\n<p>This month, I worked on finding and fixing the regression that caused kernel panics on our package builders. I think I found the issue: I made it so that the HARDENEDBSD amd64 kernel just included GENERIC so that we follow FreeBSD&#39;s toggling of features. Doing so added QUEUE_MACRO_DEBUG_TRASH to our kernel config. That option is the likely culprit. If the next package build (with the option removed) completes, I will commit the change that removes QUEUE_MACRO_DEBUG_TRASH from the HARDENEDBSD amd64 kernel.</p>\n\n<hr>\n\n<h3><a href=\"https://www.dyx.name/posts/essays/signal.html\" rel=\"nofollow\">Detailed Behaviors of Unix Signal</a></h3>\n\n<p>When Unix is mentioned in this document it means macOS or Linux as they are the mainly used Unix at this moment. When shell is mentioned it means Bash or Zsh. Most demos are written in C for macOS with Apple libc and Linux with glibc.</p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n</blockquote>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/andrew%20-%20flatpak\" rel=\"nofollow\">andrew - flatpak</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/chris%20-%20mac%20and%20truenas\" rel=\"nofollow\">chris - mac and truenas</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/399/feedback/robert%20-%20some%20questions\" rel=\"nofollow\">robert - some questions</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Comparing sandboxing techniques, Statement on FreeBSD development processes, customizing FreeBSD ports and packages, the quest for a comfortable NetBSD desktop, Nginx as a TCP/UDP relay, HardenedBSD March 2021 Status Report, Detailed Behaviors of Unix Signal, and more\r\n","date_published":"2021-04-22T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3de2dd50-eca9-4729-9ef6-464aa4ec5795.mp3","mime_type":"audio/mpeg","size_in_bytes":36616080,"duration_in_seconds":3424}]},{"id":"690f3bec-7d66-4d05-8cee-073e2248cd50","title":"398: Coordinated Mars Time","url":"https://www.bsdnow.tv/398","content_text":"FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more\n\nNOTES\n\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD 13.0 – Full Desktop Experience\n\n\nWith the release of FreeBSD 13.0 on the horizon, I wanted to see how it shapes up on my Lenovo T450 laptop.  Previous major releases on this laptop, using it as a workstation, felt very rough around the edges but with 13, it feels like the developers got it right.\n\n\n\nFreeBSD on ARM64 in the Cloud\n\nUntil the end of June, Amazon AWS is offering free ARM64 Graviton instances, learn how to try out FreeBSD to ARMv8 in the cloud\n\n\n\n\nPlan 9 from Bell Labs in Cyberspace!\n\n\nThe releases below represent the historical releases of Plan 9. The two versions of 4th Edition represent the initial release and the final version available from Bell Labs as it was updated and patched. All historical releases of Plan 9 have been re-released under the terms of the MIT license.\n\n\nInferno is open source as well\n***\n## News Roundup\n### Hitting donation milestone, financial report for 2020\nWe nearly hit our 2020 donation milestone set after the release of 9.0 of $50,000.\n***\n\n\n\ngrep returns (standard input) on FreeBSD\n\n\nI was dealing with a bizarre error with grep(1) on FreeBSD, and it soon infected my macOS and NetBSD machines too. It was driving me crazy!\n\n\n\nRandom Programming Challenge\n\n\n\nThis better not be an April Fools Joke… I want to see this actually implemented. I’ll donate $100 to the first BSD that actually implements this for real.  Who’s with me?\n\n\nOpenBSD Adds Support for Coordinated Mars Time (MTC)\n\n\nTo make sure that OpenBSD can be used elsewhere than just earth, this diff introduces Coordinated Mars Time (MTC), the Mars equivalent of earth’s Universal Time (UTC).\nOpenZFS had a good one too\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrandon - router\nLawrence - Is BSD for me\nmiguel - printing\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more</p>\n\n<p><strong><em>NOTES</em></strong></p>\n\n<p>This episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.tubsta.com/2021/03/freebsd-13-0-full-desktop-experience/\" rel=\"nofollow\">FreeBSD 13.0 – Full Desktop Experience</a></h3>\n\n<blockquote>\n<p>With the release of FreeBSD 13.0 on the horizon, I wanted to see how it shapes up on my Lenovo T450 laptop.  Previous major releases on this laptop, using it as a workstation, felt very rough around the edges but with 13, it feels like the developers got it right.</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/the-next-level-freebsd-on-arm64-in-the-cloud/\" rel=\"nofollow\">FreeBSD on ARM64 in the Cloud</a></h3>\n\n<p>Until the end of June, Amazon AWS is offering free ARM64 Graviton instances, learn how to try out FreeBSD to ARMv8 in the cloud</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.bell-labs.com/institute/blog/plan-9-bell-labs-cyberspace/\" rel=\"nofollow\">Plan 9 from Bell Labs in Cyberspace!</a></h3>\n\n<blockquote>\n<p><a href=\"http://p9f.org/dl/index.html\" rel=\"nofollow\">The releases below represent the historical releases of Plan 9.</a> The two versions of 4th Edition represent the initial release and the final version available from Bell Labs as it was updated and patched. All historical releases of Plan 9 have been re-released under the terms of the MIT license.</p>\n\n<ul>\n<li><a href=\"https://bitbucket.org/inferno-os/inferno64-os/src/master/\" rel=\"nofollow\">Inferno is open source as well</a>\n***\n## News Roundup\n### <a href=\"http://blog.netbsd.org/tnf/entry/hitting_donation_milestone_financial_report\" rel=\"nofollow\">Hitting donation milestone, financial report for 2020</a>\nWe nearly hit our 2020 donation milestone set after the release of 9.0 of $50,000.\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://rubenerd.com/grep-returns-standard-input/\" rel=\"nofollow\">grep returns (standard input) on FreeBSD</a></h3>\n\n<blockquote>\n<p>I was dealing with a bizarre error with grep(1) on FreeBSD, and it soon infected my macOS and NetBSD machines too. It was driving me crazy!</p>\n\n<hr>\n\n<h3><a href=\"https://projecteuler.net/problem=84\" rel=\"nofollow\">Random Programming Challenge</a></h3>\n\n<hr>\n\n<h3>This better not be an April Fools Joke… I want to see this actually implemented. I’ll donate $100 to the first BSD that actually implements this for real.  Who’s with me?</h3>\n</blockquote>\n\n<p><a href=\"https://marc.info/?l=openbsd-cvs&m=161730046519995\" rel=\"nofollow\">OpenBSD Adds Support for Coordinated Mars Time (MTC)</a></p>\n\n<blockquote>\n<p>To make sure that OpenBSD can be used elsewhere than just earth, this diff introduces Coordinated Mars Time (MTC), the Mars equivalent of earth’s Universal Time (UTC).<br>\n<a href=\"https://github.com/openzfs/zfs/pull/11823\" rel=\"nofollow\">OpenZFS had a good one too</a></p>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Brandon%20-%20router\" rel=\"nofollow\">Brandon - router</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/Lawrence%20-%20Is%20FreeBSD%20for%20me\" rel=\"nofollow\">Lawrence - Is BSD for me</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/398/feedback/miguel%20-%20printing\" rel=\"nofollow\">miguel - printing</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD 13.0 Full Desktop Experience, FreeBSD on ARM64 in the Cloud, Plan 9 from Bell Labs in Cyberspace, Inferno is open source as well, NetBSD hits donation milestone, grep returns (standard input) on FreeBSD, Random Programming Challenge, OpenBSD Adds Support for Coordinated Mars Time (MTC) and more","date_published":"2021-04-15T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/690f3bec-7d66-4d05-8cee-073e2248cd50.mp3","mime_type":"audio/mpeg","size_in_bytes":30056400,"duration_in_seconds":3014}]},{"id":"c901a741-a25b-4d92-9ce4-03b5f2e18d2f","title":"397: Fresh BSD 2021","url":"https://www.bsdnow.tv/397","content_text":"Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nCustomizing the FreeBSD Kernel\n\n\nLearn more about customizing the build of the FreeBSD kernel and its loadable modules\n\n\n\nOpenBSD/loongson on the Lemote Fuloong\n\nIn my article about running OpenBSD/loongson on the Lemote Yeeloong back in 2016, I mentioned looking for a Fuloong. All hope seemed lost until the Summer of 2017, when a fellow OpenBSD developer was contacted by a generous user (Thanks again, Lars!) offering to donate two Lemote Fuloong machines, and I was lucky enough to get one of those units.\n\n\n\n\nNews Roundup\n\nHow ZFS on Linux brings up pools and filesystems at boot under systemd\n\n\nOn Solaris and Illumos, how ZFS pools and filesystems were brought up at boot was always a partial mystery to me (and it seemed to involve the kernel knowing a lot about /etc/zfs/zpool.cache). On Linux, additional software RAID arrays are brought up mostly through udev rules, which has its own complications. For a long time I had the general impression that ZFS on Linux also worked through udev rules to recognize vdev components, much like software RAID. However, this turns out to not be the case and the modern ZFS on Linux boot process is quite straightforward on systemd systems.\n\n\n\nLLDB: FreeBSD Legacy Process Plugin Removed\n\nDuring the past month we’ve successfully removed the legacy FreeBSD plugin and continued improving the new one. We have prepared an implementation of hardware breakpoint and watchpoint support for FreeBSD/AArch64, and iterated over all tests that currently fail on that platform. Therefore, we have concluded the second milestone.\n\n\n\nFreshBSD 2021\n\n6 weeks ago I created a branch for a significant rework of FreshBSD. Nearly 300 commits later, and just a week shy of our 15th anniversary, the result is what you’re looking at now. I hope you like it.\n\n\n\ngmid is a gemini server  for unixes.\n\n\n\nDanschmid’s Poudriere Guide now in english\n\nThe ports system is one of FreeBSD's greatest advantages for users who want flexibility and control over their software. It enables administrators to easily create and manage source-based installations using a system that is robust and predictable.\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Tom Jones.","content_html":"<p>Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/customizing-the-freebsd-kernel/\" rel=\"nofollow\">Customizing the FreeBSD Kernel</a></h3>\n\n<blockquote>\n<p>Learn more about customizing the build of the FreeBSD kernel and its loadable modules</p>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/openbsd-loongson-on-the-lemote-fuloong/\" rel=\"nofollow\">OpenBSD/loongson on the Lemote Fuloong</a></h3>\n\n<p>In my article about running OpenBSD/loongson on the Lemote Yeeloong back in 2016, I mentioned looking for a Fuloong. All hope seemed lost until the Summer of 2017, when a fellow OpenBSD developer was contacted by a generous user (Thanks again, Lars!) offering to donate two Lemote Fuloong machines, and I was lucky enough to get one of those units.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSBringUpOnBoot\" rel=\"nofollow\">How ZFS on Linux brings up pools and filesystems at boot under systemd</a></h3>\n\n<blockquote>\n<p>On Solaris and Illumos, how ZFS pools and filesystems were brought up at boot was always a partial mystery to me (and it seemed to involve the kernel knowing a lot about /etc/zfs/zpool.cache). On Linux, additional software RAID arrays are brought up mostly through udev rules, which has its own complications. For a long time I had the general impression that ZFS on Linux also worked through udev rules to recognize vdev components, much like software RAID. However, this turns out to not be the case and the modern ZFS on Linux boot process is quite straightforward on systemd systems.</p>\n\n<hr>\n\n<h3><a href=\"https://www.moritz.systems/blog/freebsd-legacy-process-plugin-removed/\" rel=\"nofollow\">LLDB: FreeBSD Legacy Process Plugin Removed</a></h3>\n\n<p>During the past month we’ve successfully removed the legacy FreeBSD plugin and continued improving the new one. We have prepared an implementation of hardware breakpoint and watchpoint support for FreeBSD/AArch64, and iterated over all tests that currently fail on that platform. Therefore, we have concluded the second milestone.</p>\n\n<hr>\n\n<h3><a href=\"https://freshbsd.org/news/2021/02/28\" rel=\"nofollow\">FreshBSD 2021</a></h3>\n\n<p>6 weeks ago I created a branch for a significant rework of FreshBSD. Nearly 300 commits later, and just a week shy of our 15th anniversary, the result is what you’re looking at now. I hope you like it.</p>\n\n<hr>\n\n<h3><a href=\"https://github.com/omar-polo/gmid/\" rel=\"nofollow\">gmid</a> is a <a href=\"https://gemini.circumlunar.space/\" rel=\"nofollow\">gemini</a> server  for unixes.</h3>\n\n<hr>\n\n<h3><a href=\"https://danschmid.de/en/blog/poudriere-guide\" rel=\"nofollow\">Danschmid’s Poudriere Guide now in english</a></h3>\n\n<p>The ports system is one of FreeBSD&#39;s greatest advantages for users who want flexibility and control over their software. It enables administrators to easily create and manage source-based installations using a system that is robust and predictable.</p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n</blockquote>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Tom Jones.</p>","summary":"Customizing the FreeBSD Kernel, OpenBSD/loongson on the Lemote Fuloong, how ZFS on Linux brings up pools and filesystems at boot under systemd, LLDB: FreeBSD Legacy Process Plugin Removed, FreshBSD 2021, gmid, Danschmid’s Poudriere Guide in english, and more","date_published":"2021-04-08T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c901a741-a25b-4d92-9ce4-03b5f2e18d2f.mp3","mime_type":"audio/mpeg","size_in_bytes":34526808,"duration_in_seconds":3361}]},{"id":"db1ced31-e2bc-41f2-baca-041c750229f4","title":"396: License to thrill","url":"https://www.bsdnow.tv/396","content_text":"FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD Network Troubleshooting\n\n\nFreeBSD has a full set of debugging features, and the network stack is able to report a ton of information. So much that it can be hard to figure out what is relevant and what is not.\n\n\n\nThe State of FreeBSD\n\nLicense to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything\n\n\n\n\nNews Roundup\n\ndhcpleased(8) - DHCP client daemon\n\n\nWith the following commit, Florian Obser (florian@) imported dhcpleased(8), DHCP daemon to acquire IPv4 address leases from servers, plus dhcpleasectl(8), a utility to control the daemon:\n\n\n\nbhyve for Calamares Development\n\nbhyve (pronounced “bee hive”) is a hypervisor for BSD systems (and Illumos / openSolaris). It is geared towards server workloads, but does support desktop-oriented operation as well. I spent some time wayyyy back in November wrestling with it in order to replace VirtualBox for Calamares testing on FreeBSD. The “golden hint” as far as I’m concerned came from Karen Bruner and now I have a functioning Calamares test-ground that is more useful than before.\n“Calamares is a free and open-source independent and distro-agnostic system installer for Linux distributions.“\n\n\n\nSome new FreeBSD/EC2 features: EFS automount and ebsnvme-id\n\nAs my regular readers will be aware, I've been working on and gradually improving FreeBSD/EC2 for many years. Recently I've added two new features, which are available in the weekly HEAD and 12-STABLE snapshots and will appear in releases starting from 12.2-RELEASE.\n\n\n\nOld Usenix pictures\n\n\n\nBeastie Bits\n\n[https://2021.eurobsdcon.org/](CFP is open until May 26th, 2021)\n\nEuroBSDcon is the European technical conference for users and developers of BSD-based systems. The conference is scheduled to take place September 16-19 2021 in Vienna, Austria or as an all-online event if COVID-19 developments dictate. The tutorials will be held on Thursday and Friday to registered participants and the talks are presented to conference attendees on Saturday and Sunday.\nThe Call for Talk and Presentation proposals period will close on May 26th, 2021.  Prospective speakers will be notified of acceptance or otherwise by June 1st, 2021.\n\n\n\n[https://campgnd.com/](CFP is open until 2021-04-15)\n\ncampgndd will be held May 28th, 29th and 30th 2021, from wherever you happen to be.\nWe're looking for submissions on anything you're enthusiastic and excited about. If you enjoy it, the odds are we will too! You don't need to be an expert to propose anything.\nSome example of things we are looking for are:\n    Talks\n    Walkthroughs\n    Music\n\nFrom the Desk of Michael Lucas…\n\nNew Release: Only Footnotes\nI’ve lost count of the number of people who have told me that they purchase my books only for the footnotes. That’s okay. I don’t care why people buy my books, only that they do buy them. Nevertheless, I am a businessman living under capitalism and feel compelled to respond to my market.\nAllow me to present my latest release: Only Footnotes, a handsome hardcover-only compilation of decades of footnotes. From the back cover:\n-----\nOnly Footnotes. Because that’s why you read his books.\nAcademics hate footnotes. Michael W Lucas loves them. What he does with them wouldn’t pass academic muster, but that doesn’t mean the reader should skip them. The footnotes are the best part! Why not read only the footnotes, and skip all that other junk?\nAfter literal minutes of effort, Only Footnotes collects every single footnote from all of Lucas’ books to date.* Recycle those cumbersome treatises stuffed with irrelevant facts! No more flipping through pages and pages of actual technical knowledge looking for the offhand movie reference or half-formed joke. This slender, elegant volume contains everything the man ever passed off as his dubious, malformed “wisdom.”\nSmart books have footnotes. Smarter books are only footnotes.\n*plus additional annotations from the author. Because sometimes even a footnote needs a footnote.\n----\nWith interior illustrations by OpenBSD’s akoshibe, this distinguished tome would make fine inspirational reading for a system administrator, network engineer, or anyone sentenced to a life in information technology. Available at all fine bookstores, and many mediocre ones!\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\nSpecial Guest: Tom Jones.","content_html":"<p>FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-network-troubleshooting-understanding-network-performance/\" rel=\"nofollow\">FreeBSD Network Troubleshooting</a></h3>\n\n<blockquote>\n<p>FreeBSD has a full set of debugging features, and the network stack is able to report a ton of information. So much that it can be hard to figure out what is relevant and what is not.</p>\n\n<hr>\n\n<h3><a href=\"https://www.theregister.com/2021/03/10/the_state_of_freebsd/\" rel=\"nofollow\">The State of FreeBSD</a></h3>\n\n<p>License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20210227232424\" rel=\"nofollow\">dhcpleased(8) - DHCP client daemon</a></h3>\n\n<blockquote>\n<p>With the following commit, Florian Obser (florian@) imported dhcpleased(8), DHCP daemon to acquire IPv4 address leases from servers, plus dhcpleasectl(8), a utility to control the daemon:</p>\n\n<hr>\n\n<h3><a href=\"https://euroquis.nl//freebsd/2021/03/05/bhyve.html\" rel=\"nofollow\">bhyve for Calamares Development</a></h3>\n\n<p>bhyve (pronounced “bee hive”) is a hypervisor for BSD systems (and Illumos / openSolaris). It is geared towards server workloads, but does support desktop-oriented operation as well. I spent some time wayyyy back in November wrestling with it in order to replace VirtualBox for Calamares testing on FreeBSD. The “golden hint” as far as I’m concerned came from Karen Bruner and now I have a functioning Calamares test-ground that is more useful than before.<br>\n“Calamares is a free and open-source independent and distro-agnostic system installer for Linux distributions.“</p>\n\n<hr>\n\n<h3><a href=\"https://www.daemonology.net/blog/2020-05-31-Some-new-FreeBSD-EC2-features.html\" rel=\"nofollow\">Some new FreeBSD/EC2 features: EFS automount and ebsnvme-id</a></h3>\n\n<p>As my regular readers will be aware, I&#39;ve been working on and gradually improving FreeBSD/EC2 for many years. Recently I&#39;ve added two new features, which are available in the weekly HEAD and 12-STABLE snapshots and will appear in releases starting from 12.2-RELEASE.</p>\n\n<hr>\n\n<h3><a href=\"http://lists.nycbug.org/pipermail/talk/2021-February/018304.html\" rel=\"nofollow\">Old Usenix pictures</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<h3>[<a href=\"https://2021.eurobsdcon.org/%5D(CFP\" rel=\"nofollow\">https://2021.eurobsdcon.org/](CFP</a> is open until May 26th, 2021)</h3>\n\n<p>EuroBSDcon is the European technical conference for users and developers of BSD-based systems. The conference is scheduled to take place September 16-19 2021 in Vienna, Austria or as an all-online event if COVID-19 developments dictate. The tutorials will be held on Thursday and Friday to registered participants and the talks are presented to conference attendees on Saturday and Sunday.<br>\nThe Call for Talk and Presentation proposals period will close on May 26th, 2021.  Prospective speakers will be notified of acceptance or otherwise by June 1st, 2021.</p>\n\n<hr>\n\n<h3>[<a href=\"https://campgnd.com/%5D(CFP\" rel=\"nofollow\">https://campgnd.com/](CFP</a> is open until 2021-04-15)</h3>\n\n<p>campgndd will be held May 28th, 29th and 30th 2021, from wherever you happen to be.<br>\nWe&#39;re looking for submissions on anything you&#39;re enthusiastic and excited about. If you enjoy it, the odds are we will too! You don&#39;t need to be an expert to propose anything.<br>\nSome example of things we are looking for are:<br>\n    Talks<br>\n    Walkthroughs<br>\n    Music</p>\n\n<h3>From the Desk of Michael Lucas…</h3>\n\n<pre><code>New Release: Only Footnotes\nI’ve lost count of the number of people who have told me that they purchase my books only for the footnotes. That’s okay. I don’t care why people buy my books, only that they do buy them. Nevertheless, I am a businessman living under capitalism and feel compelled to respond to my market.\nAllow me to present my latest release: Only Footnotes, a handsome hardcover-only compilation of decades of footnotes. From the back cover:\n-----\nOnly Footnotes. Because that’s why you read his books.\nAcademics hate footnotes. Michael W Lucas loves them. What he does with them wouldn’t pass academic muster, but that doesn’t mean the reader should skip them. The footnotes are the best part! Why not read only the footnotes, and skip all that other junk?\nAfter literal minutes of effort, Only Footnotes collects every single footnote from all of Lucas’ books to date.* Recycle those cumbersome treatises stuffed with irrelevant facts! No more flipping through pages and pages of actual technical knowledge looking for the offhand movie reference or half-formed joke. This slender, elegant volume contains everything the man ever passed off as his dubious, malformed “wisdom.”\nSmart books have footnotes. Smarter books are only footnotes.\n*plus additional annotations from the author. Because sometimes even a footnote needs a footnote.\n----\nWith interior illustrations by OpenBSD’s akoshibe, this distinguished tome would make fine inspirational reading for a system administrator, network engineer, or anyone sentenced to a life in information technology. Available at all fine bookstores, and many mediocre ones!\n</code></pre>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>\n</blockquote><p>Special Guest: Tom Jones.</p>","summary":"Description: FreeBSD Network Troubleshooting, The State of FreeBSD, dhcpleased, bhyve for Calamares Development, EFS automount and ebsnvme-id, Old Usenix pictures, and more.","date_published":"2021-04-01T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/db1ced31-e2bc-41f2-baca-041c750229f4.mp3","mime_type":"audio/mpeg","size_in_bytes":30506976,"duration_in_seconds":3207}]},{"id":"9e4b924f-7f9c-49b4-81b7-b28ade7904b3","title":"395: Tracing ARM’s history","url":"https://www.bsdnow.tv/395","content_text":"Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nTracing the History of ARM and FreeBSD\n\n\nWhen we think of computers, we generally think of laptops and desktops. Each one of these systems is powered by an Intel or AMD chip based on the x86 architecture. It might feel like you spend all day interacting with these kinds of systems, but you would be wrong.\n\n\n\nUnix Tip: Make ‘less’ more friendly\n\nYou probably know about less: it is a standard tool that allows scrolling up and down in documents that do not fit on a single screen. Less has a very handy feature, which can be turned on by invoking it with the -i flag. This causes less to ignore case when searching. For example, ‘udf’ will find ‘udf’, ‘UDF’, ‘UdF’, and any other combination of upper-case and lower-case. If you’re used to searching in a web browser, this is probably what you want. But less is even more clever than that. If your search pattern contains upper-case letters, the ignore-case feature will be disabled. So if you’re looking for ‘QXml’, you will not be bothered by matches for the lower-case ‘qxml’. (This is equivalent to ignorecase + smartcase in vim.)\n\n\n\n\nNews Roundup\n\nNomadBSD 1.4 Release\n\n\nVersion 1.4 of NomadBSD, a persistent live system for USB flash drives based on FreeBSD and featuring a graphical user interface built around Openbox, has been released: “We are pleased to present the release of NomadBSD 1.4.\n\n\n\nCreate an Ubuntu Linux jail on FreeBSD 12.2\n\n\n\nOPNsense 21.1.2 released\n\nWork has so far been focused on the firmware update process to ensure its safety around edge cases and recovery methods for the worst case. To that end 21.1.3 will likely receive the full revamp including API and GUI changes for a swift transition after thorough testing of the changes now available in the development package of this release.\n\n\n\nMidnight BSD and BastilleBSD\n\nWe recently added a new port, mports/sysutils/bastille that allows you to manage containers. This is a port of a project that originally targetted FreeBSD, but also works on HardenedBSD. \n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nBrad - monitoring with Grafana\nDennis - a few questions\nPaul - FreeBSD 13\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/tracing-the-history-of-arm-and-freebsd/\" rel=\"nofollow\">Tracing the History of ARM and FreeBSD</a></h3>\n\n<blockquote>\n<p>When we think of computers, we generally think of laptops and desktops. Each one of these systems is powered by an Intel or AMD chip based on the x86 architecture. It might feel like you spend all day interacting with these kinds of systems, but you would be wrong.</p>\n\n<hr>\n\n<h3><a href=\"https://ascending.wordpress.com/2011/02/11/unix-tip-make-less-more-friendly/\" rel=\"nofollow\">Unix Tip: Make ‘less’ more friendly</a></h3>\n\n<p>You probably know about less: it is a standard tool that allows scrolling up and down in documents that do not fit on a single screen. Less has a very handy feature, which can be turned on by invoking it with the -i flag. This causes less to ignore case when searching. For example, ‘udf’ will find ‘udf’, ‘UDF’, ‘UdF’, and any other combination of upper-case and lower-case. If you’re used to searching in a web browser, this is probably what you want. But less is even more clever than that. If your search pattern contains upper-case letters, the ignore-case feature will be disabled. So if you’re looking for ‘QXml’, you will not be bothered by matches for the lower-case ‘qxml’. (This is equivalent to ignorecase + smartcase in vim.)</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.itsfoss.net/nomadbsd-1-4-release/\" rel=\"nofollow\">NomadBSD 1.4 Release</a></h3>\n\n<blockquote>\n<p>Version 1.4 of NomadBSD, a persistent live system for USB flash drives based on FreeBSD and featuring a graphical user interface built around Openbox, has been released: “We are pleased to present the release of NomadBSD 1.4.</p>\n\n<hr>\n\n<h3><a href=\"https://hackacad.net/post/2021-01-23-create-a-ubuntu-linux-jail-on-freebsd/\" rel=\"nofollow\">Create an Ubuntu Linux jail on FreeBSD 12.2</a></h3>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-1-2-released/\" rel=\"nofollow\">OPNsense 21.1.2 released</a></h3>\n\n<p>Work has so far been focused on the firmware update process to ensure its safety around edge cases and recovery methods for the worst case. To that end 21.1.3 will likely receive the full revamp including API and GUI changes for a swift transition after thorough testing of the changes now available in the development package of this release.</p>\n\n<hr>\n\n<h3><a href=\"https://www.justjournal.com/users/mbsd/entry/33869\" rel=\"nofollow\">Midnight BSD and BastilleBSD</a></h3>\n\n<p>We recently added a new port, mports/sysutils/bastille that allows you to manage containers. This is a port of a project that originally targetted FreeBSD, but also works on HardenedBSD. </p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Brad%20-%20monitoring%20with%20Grafana\" rel=\"nofollow\">Brad - monitoring with Grafana</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Dennis%20-%20a%20few%20questions\" rel=\"nofollow\">Dennis - a few questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/395/feedback/Paul%20-%20FreeBSD%2013\" rel=\"nofollow\">Paul - FreeBSD 13</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Tracing the History of ARM and FreeBSD, Make ‘less’ more friendly, NomadBSD 1.4 Release, Create an Ubuntu Linux jail on FreeBSD 12.2, OPNsense 21.1.2 released, Midnight BSD and BastilleBSD, and more.","date_published":"2021-03-25T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e4b924f-7f9c-49b4-81b7-b28ade7904b3.mp3","mime_type":"audio/mpeg","size_in_bytes":23944248,"duration_in_seconds":2279}]},{"id":"65a9a52b-9058-4d08-8c38-8a1bffad6c86","title":"394: FreeBSD on Mars","url":"https://www.bsdnow.tv/394","content_text":"Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nPrototyping an Onboard Scheduler for the Mars 2020 Rover\n\n\nThe mars rover runs VxWorks, which is based on BSD, and uses the FreeBSD networking stack. While there has been a lot of type about the little helicopter that was inside the rover running Linux, the rover itself runs BSD.\n***\n### Practical Guide to Storage of Large Amounts of Microscopy Data\n&gt; Biological imaging tools continue to increase in speed, scale, and resolution, often resulting in the collection of gigabytes or even terabytes of data in a single experiment. In comparison, the ability of research laboratories to store and manage this data is lagging greatly. This leads to limits on the collection of valuable data and slows data analysis and research progress. Here we review common ways researchers store data and outline the drawbacks and benefits of each method. We also offer a blueprint and budget estimation for a currently deployed data server used to store large datasets from zebrafish brain activity experiments using light-sheet microscopy. Data storage strategy should be carefully considered and different options compared when designing imaging experiments.\n***\n## News Roundup\n### OpenBSD guest with bhyve - OmniOS\n&gt; Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.\n&gt; This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.\n***\n### NextCloud on OpenBSD\n&gt; NextCloud and OpenBSD are complimentary to one another. NextCloud is an awesome, secure and private alternative for propietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.\n\n\n\n\nMySQL Transactions - the physical side\n\n\nSo you talk to a database, doing transactions. What happens actually, behind the scenes? Let’s have a look.\n\n\n\nTrueNAS 12.0-U2.1 is released\n\n\n\nHardenedBSD 2021 State of the Hardened Union - NYCBUG - 2021-04-07\n\n\n\n\nBeastie Bits\n\n\nFreeBSD Journal: Case Studies\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nAl - BusyNAS\nJeff - ZFS and NFS on FreeBSD\nMichael - remote unlock for encrypted systems\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://ai.jpl.nasa.gov/public/documents/papers/rabideau_iwpss2017_prototyping.pdf\" rel=\"nofollow\">Prototyping an Onboard Scheduler for the Mars 2020 Rover</a></h3>\n\n<ul>\n<li>The mars rover runs VxWorks, which is based on BSD, and uses the FreeBSD networking stack. While there has been a lot of type about the little helicopter that was inside the rover running Linux, the rover itself runs BSD.\n***\n### <a href=\"https://www.cambridge.org/core/journals/microscopy-today/article/practical-guide-to-storage-of-large-amounts-of-microscopy-data/D3CE39447BFF5BBF9B3ED8A0C35C6F36\" rel=\"nofollow\">Practical Guide to Storage of Large Amounts of Microscopy Data</a>\n&gt; Biological imaging tools continue to increase in speed, scale, and resolution, often resulting in the collection of gigabytes or even terabytes of data in a single experiment. In comparison, the ability of research laboratories to store and manage this data is lagging greatly. This leads to limits on the collection of valuable data and slows data analysis and research progress. Here we review common ways researchers store data and outline the drawbacks and benefits of each method. We also offer a blueprint and budget estimation for a currently deployed data server used to store large datasets from zebrafish brain activity experiments using light-sheet microscopy. Data storage strategy should be carefully considered and different options compared when designing imaging experiments.\n***\n## News Roundup\n### <a href=\"https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html\" rel=\"nofollow\">OpenBSD guest with bhyve - OmniOS</a>\n&gt; Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.\n&gt; This post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.\n***\n### <a href=\"https://h3artbl33d.nl/blog/nextcloud-on-openbsd\" rel=\"nofollow\">NextCloud on OpenBSD</a>\n&gt; NextCloud and OpenBSD are complimentary to one another. NextCloud is an awesome, secure and private alternative for propietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://blog.koehntopp.info/2020/07/27/mysql-transactions.html\" rel=\"nofollow\">MySQL Transactions - the physical side</a></h3>\n\n<blockquote>\n<p>So you talk to a database, doing transactions. What happens actually, behind the scenes? Let’s have a look.</p>\n\n<hr>\n\n<h3><a href=\"https://www.truenas.com/docs/hub/intro/release-notes/12.0u2.1/\" rel=\"nofollow\">TrueNAS 12.0-U2.1 is released</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.nycbug.org/index?action=view&id=10682\" rel=\"nofollow\">HardenedBSD 2021 State of the Hardened Union - NYCBUG - 2021-04-07</a></h3>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://freebsdfoundation.org/our-work/journal/\" rel=\"nofollow\">FreeBSD Journal: Case Studies</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Al%20-%20BusyNAS\" rel=\"nofollow\">Al - BusyNAS</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Jeff%20-%20ZFS%20and%20NFS%20on%20FreeBSD\" rel=\"nofollow\">Jeff - ZFS and NFS on FreeBSD</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/394/feedback/Michael%20-%20remote%20unlock%20for%20encrypted%20systems\" rel=\"nofollow\">Michael - remote unlock for encrypted systems</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Onboard Scheduler for the Mars 2020 Rover, Practical Guide to Storage of Large Amounts of Microscopy Data, OpenBSD guest with bhyve - OmniOS, NextCloud on OpenBSD, MySQL Transactions - the physical side, TrueNAS 12.0-U2.1 is released, HardenedBSD 2021 State of the Hardened Union, and more","date_published":"2021-03-18T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/65a9a52b-9058-4d08-8c38-8a1bffad6c86.mp3","mime_type":"audio/mpeg","size_in_bytes":45911352,"duration_in_seconds":2611}]},{"id":"edab60b8-425f-45a4-9547-73ca2ca7e341","title":"393: ZFS dRAID","url":"https://www.bsdnow.tv/393","content_text":"Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nLessons learned from a 27 years old UNIX book\n\n\nOne of the Amazon reviewers of \"Sun Performance and Tuning: Java and the Internet\" gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago...\n\n\n\ndRAID, Finally!\n\nAdmins will often use wide RAID stripes to maximize usable storage given a number of spindles. RAID-Z deployments with large stripe widths, ten or larger, are subject to poor resilver performance for a number of reasons. Resilvering a full vdev means reading from every healthy disk and continuously writing to the new spare. This will saturate the replacement disk with writes while scattering seeks over the rest of the vdev. For 14 wide RAID-Z2 vdevs using 12TB spindles, rebuilds can take weeks. Resilver I/O activity is deprioritized when the system has not been idle for a minimum period. Full zpools get fragmented and require additional I/O’s to recalculate data during reslivering. A pool can degenerate into a never ending cycle of rebuilds or loss of the pool Aka: the Death Spiral.\n\n\n\nNews Roundup\n\nSetting up a Signal Proxy using FreeBSD\n\nWith the events that the private messaging app Signal has been blocked in Iran, Signal has come up with an “proxy” solution akin to Tor’s Bridges, and have given instructions on how to do it.\nFor people who prefer FreeBSD over Linux like myself, we obviously can’t run Docker, which is what Signal’s instructions focus on.\nFortunately, the Docker image is just a fancy wrapper around nginx, and the configs can be ported to any OS. Here, I’ll show you how to set up a Signal Proxy on FreeBSD.\n\n\n\n\nAnnotate your PDF files on OpenBSD\n\n\nOn my journey to leave macOS, I regularly look to mimic some of the features I use. Namely, annotating (or signing) PDF files is a really simple task using Preview. I couldn’t do it on OpenBSD using Zathura, Xpdf etc. But there is a software in the ports that can achieve this: Xournal.\nXournal is “an application for notetaking, sketching, keeping a journal using a stylus“. And now that my touchscreen is calibrated, highlighting can even be done with the fingers :)\n\n\n\n\nThings You Should Do Now\n\n\nDescribes things you should do now when building software, because the cost to do them increases over time and eventually becomes prohibitive or impossible.\n\n\n\nJust: A command runner. More unixy than Make because it does even less.\n\nI think it's in the do-one-thing-well spirit of Unix, because it's just a command runner, no build system at all. Just has a bunch of nice features:\n\n\n\nCan be invoked from any subdirectory\nArguments can be passed from the command line\nStatic error checking that catches syntax errors and typos\nExcellent error messages with source context\nThe ability to list recipes from the command line\nRecipes can be written in any language\nWorks on Linux, macOS, and Windows\nAnd much more!\n\n\n\nJust doesn't replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMarc - Confused about Snapshots\nDan’s gist: https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085\nPete - A Question\nRick - ZFS Idea\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Dan Langille.","content_html":"<p>Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.linux.it/%7Eema/posts/porsche-book/\" rel=\"nofollow\">Lessons learned from a 27 years old UNIX book</a></h3>\n\n<blockquote>\n<p>One of the Amazon reviewers of &quot;Sun Performance and Tuning: Java and the Internet&quot; gave it 3/5 stars. While still a nice introduction, the book by Adrian Cockcroft has become dated — claimed Roland in 2003, which believe it or not was 18 years ago...</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-draid-finally/\" rel=\"nofollow\">dRAID, Finally!</a></h3>\n\n<p>Admins will often use wide RAID stripes to maximize usable storage given a number of spindles. RAID-Z deployments with large stripe widths, ten or larger, are subject to poor resilver performance for a number of reasons. Resilvering a full vdev means reading from every healthy disk and continuously writing to the new spare. This will saturate the replacement disk with writes while scattering seeks over the rest of the vdev. For 14 wide RAID-Z2 vdevs using 12TB spindles, rebuilds can take weeks. Resilver I/O activity is deprioritized when the system has not been idle for a minimum period. Full zpools get fragmented and require additional I/O’s to recalculate data during reslivering. A pool can degenerate into a never ending cycle of rebuilds or loss of the pool Aka: the Death Spiral.</p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.neelc.org/posts/freebsd-signal-proxy/\" rel=\"nofollow\">Setting up a Signal Proxy using FreeBSD</a></h3>\n\n<p>With the events that the private messaging app Signal has been blocked in Iran, Signal has come up with an “proxy” solution akin to Tor’s Bridges, and have given instructions on how to do it.<br>\nFor people who prefer FreeBSD over Linux like myself, we obviously can’t run Docker, which is what Signal’s instructions focus on.<br>\nFortunately, the Docker image is just a fancy wrapper around nginx, and the configs can be ported to any OS. Here, I’ll show you how to set up a Signal Proxy on FreeBSD.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.tumfatig.net/20210126/annotate-your-pdf-files-on-openbsd\" rel=\"nofollow\">Annotate your PDF files on OpenBSD</a></h3>\n\n<blockquote>\n<p>On my journey to leave macOS, I regularly look to mimic some of the features I use. Namely, annotating (or signing) PDF files is a really simple task using Preview. I couldn’t do it on OpenBSD using Zathura, Xpdf etc. But there is a software in the ports that can achieve this: Xournal.<br>\nXournal is “an application for notetaking, sketching, keeping a journal using a stylus“. And now that my touchscreen is calibrated, highlighting can even be done with the fingers :)</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://secure.phabricator.com/book/phabflavor/article/things_you_should_do_now/\" rel=\"nofollow\">Things You Should Do Now</a></h3>\n\n<blockquote>\n<p>Describes things you should do now when building software, because the cost to do them increases over time and eventually becomes prohibitive or impossible.</p>\n\n<hr>\n\n<h3><a href=\"https://github.com/casey/just/\" rel=\"nofollow\">Just: A command runner. More unixy than Make because it does even less.</a></h3>\n\n<p>I think it&#39;s in the do-one-thing-well spirit of Unix, because it&#39;s just a command runner, no build system at all. Just has a bunch of nice features:</p>\n</blockquote>\n\n<ul>\n<li>Can be invoked from any subdirectory</li>\n<li>Arguments can be passed from the command line</li>\n<li>Static error checking that catches syntax errors and typos</li>\n<li>Excellent error messages with source context</li>\n<li>The ability to list recipes from the command line</li>\n<li>Recipes can be written in any language</li>\n<li>Works on Linux, macOS, and Windows</li>\n<li>And much more!</li>\n</ul>\n\n<blockquote>\n<p>Just doesn&#39;t replace Make, or any other build system, but it does replace reverse-searching your command history, telling colleagues the weird flags they need to pass to do the thing, and forgetting how to run old projects.</p>\n</blockquote>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Marc%20-%20Confused%20about%20Snapshots\" rel=\"nofollow\">Marc - Confused about Snapshots</a>\nDan’s gist: <a href=\"https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085\" rel=\"nofollow\">https://gist.github.com/dlangille/3140e60a816226ed75365ba8af185085</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Pete%20-%20A%20Question\" rel=\"nofollow\">Pete - A Question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/393/feedback/Rick%20-%20ZFS%20Idea\" rel=\"nofollow\">Rick - ZFS Idea</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Dan Langille.</p>","summary":"Lessons learned from a 27 years old UNIX book, Finally dRAID, Setting up a Signal Proxy using FreeBSD, Annotate your PDF files on OpenBSD, Things You Should Do Now, Just: More unixy than Make, and more","date_published":"2021-03-11T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/edab60b8-425f-45a4-9547-73ca2ca7e341.mp3","mime_type":"audio/mpeg","size_in_bytes":50412600,"duration_in_seconds":3040}]},{"id":"614ca258-a6e1-4c49-ac79-9e37f3e6057c","title":"392: macOS inspired Desktop","url":"https://www.bsdnow.tv/392","content_text":"FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD 13 BETA Benchmarks - Performance Is Much Better\n\n\n\nFreeBSD Jails – Deep Dive into the Beginning of FreeBSD Containers\n\n\nIn recent years, containers and virtualization have become a buzzword in the Linux community, especially with the rise of Docker and Kubernetes. What many people probably don’t realize is that these ideas have been around for a very long time. Today, we will be looking at Jails and how they became part of FreeBSD.\n\n\n\n\n\n\nNews Roundup\n\nFreeBSD Jobs\n\n\nThe FreeBSD Foundation is looking for a Senior Arm Kernel Engineer\nThe FreeBSD Foundation is also looking for an Open Source Project Coordinator.\n***\n### helloSystem Releases New ISOs For This macOS-Inspired BSD Desktop OS\n&gt; The helloSystem motto is being a \"desktop system for creators with focus on simplicity, elegance, and usability. Based on FreeBSD. Less, but better!\" The desktop utilities are written with PyQt5.\n***\n### A Trip into FreeBSD\n&gt; I normally deal with Linux machines. Linux is what I know and it's what I've been using since I was in college. A friend of mine has been coaxing me into trying out FreeBSD, and I decided to try it out and see what it's like. Here's some details about my experience and what I've learned.\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nBeastie Bits\n\n\nTesting Linux Steam Proton on GhostBSD with BSD linuxulator - NO Audio\nNew Build of DragonFlyBSD 5.8\nInstall OpenBSD 6.8 on PINE64 ROCK64 Media Board\nFOSDEM BSD Track Videos are up\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Dan Langille.","content_html":"<p>FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer &amp; OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&item=freebsd-13-beta1&num=6\" rel=\"nofollow\">FreeBSD 13 BETA Benchmarks - Performance Is Much Better</a></h3>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/freebsd-jails-the-beginning-of-freebsd-containers/\" rel=\"nofollow\">FreeBSD Jails – Deep Dive into the Beginning of FreeBSD Containers</a></h3>\n\n<blockquote>\n<p>In recent years, containers and virtualization have become a buzzword in the Linux community, especially with the rise of Docker and Kubernetes. What many people probably don’t realize is that these ideas have been around for a very long time. Today, we will be looking at Jails and how they became part of FreeBSD.</p>\n\n<hr>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3>FreeBSD Jobs</h3>\n\n<ul>\n<li><a href=\"https://www.fossjobs.net/job/10369/senior-arm-kernel-engineer-at-the-freebsd-foundation/\" rel=\"nofollow\">The FreeBSD Foundation is looking for a Senior Arm Kernel Engineer</a></li>\n<li><a href=\"https://www.fossjobs.net/job/10367/freebsd-open-source-project-coordinator-at-freebsd/\" rel=\"nofollow\">The FreeBSD Foundation is also looking for an Open Source Project Coordinator.</a>\n***\n### <a href=\"https://www.phoronix.com/scan.php?page=news_item&px=helloSystem-New-12.1-Exp-ISOs\" rel=\"nofollow\">helloSystem Releases New ISOs For This macOS-Inspired BSD Desktop OS</a>\n&gt; The helloSystem motto is being a &quot;desktop system for creators with focus on simplicity, elegance, and usability. Based on FreeBSD. Less, but better!&quot; The desktop utilities are written with PyQt5.\n***\n### <a href=\"https://christine.website/blog/a-trip-into-freebsd-2021-02-13\" rel=\"nofollow\">A Trip into FreeBSD</a>\n&gt; I normally deal with Linux machines. Linux is what I know and it&#39;s what I&#39;ve been using since I was in college. A friend of mine has been coaxing me into trying out FreeBSD, and I decided to try it out and see what it&#39;s like. Here&#39;s some details about my experience and what I&#39;ve learned.\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=H8ihW0m3bRQ\" rel=\"nofollow\">Testing Linux Steam Proton on GhostBSD with BSD linuxulator - NO Audio</a></li>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/users/2021-February/381550.html\" rel=\"nofollow\">New Build of DragonFlyBSD 5.8</a></li>\n<li><a href=\"https://github.com/krjdev/rock64_openbsd\" rel=\"nofollow\">Install OpenBSD 6.8 on PINE64 ROCK64 Media Board</a></li>\n<li><a href=\"https://fosdem.org/2021/schedule/track/bsd/\" rel=\"nofollow\">FOSDEM BSD Track Videos are up</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Dan Langille.</p>","summary":"FreeBSD 13 BETA Benchmarks, FreeBSD Jails Deep Dive by Klara Systems, FreeBSD Foundation looking for a Senior Arm Kernel Engineer & OSS Project Coordinator, macOS-Inspired BSD Desktop OS by helloSystem, A Trip into FreeBSD and more.","date_published":"2021-03-04T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/614ca258-a6e1-4c49-ac79-9e37f3e6057c.mp3","mime_type":"audio/mpeg","size_in_bytes":46770312,"duration_in_seconds":2846}]},{"id":"3105d37c-fc28-49e0-983d-1ac767b72f76","title":"391:  i386 tear shedding","url":"https://www.bsdnow.tv/391","content_text":"Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn't need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFollow-up about FreeBSD jail advantages\n\n\nI’ll admit I ran a lot of justifications together into a single paragraph because I wanted to get to configuring the jails themselves. They’re also, by and large, not specific to FreeBSD’s flavour of containerisation, though I still think it’s easily the most elegant implementation. Sometimes the simplest solution really is the best one.\n\n\n\nHistory of FreeBSD part 4: TCP/IP\n\n\nHow TCP/IP evolved and BSDs special contribution to the history of the Internet\n***\n\n\n\nFreeBSD: Install Prometheus, Node Exporter and Grafana\n\n\nFreeBSD comes out of the box with three great tools for monitoring. If you need more info about how these tools work, please read the official documentation. I’ll explain the installation only and creating a simple dashboard.\n\n\n\n\nNews Roundup\n\nCalibrate your touch-screen on OpenBSD\n\n\nI didn’t expected it but my refurbished T460s came with a touch-screen. It is recognized by default on OpenBSD and not well calibrated as-is. But that’s really simple to solve.\n\n\n\nLets all shed a Tear for 386\n\nFreeBSD is designating i386 as a Tier 2 architecture starting with FreeBSD 13.0.  The Project will continue to provide release images, binary updates, and pre-built packages for the 13.x branch.  However, i386-specific issues (including SAs) may not be addressed in 13.x. The i386 platform will remain Tier 1 on FreeBSD 11.x and 12.x.\n\n\n\n\nOPNsense 21.1 Marvelous Meerkat Released\n\n\nFor more than 6 years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.\n\n\n\nNomadBSD 1.4-RC1\n\nWe are pleased to present the first release candidate of NomadBSD 1.4.\n\n\n\n\nfind mostly doesn't need xargs today on modern Unixes\n\n\nI've been using Unix for long enough that 'find | xargs' is a reflex. When I started and for a long time afterward, xargs was your only choice for efficiently executing a command over a bunch of find results.\n\n\n\nOpenBSD KDE Status Report\n\nOpenBSD has managed to drop KDE3 and KDE4 in the 6.8 -&gt; 6.9 release cycle. That makes me very happy because it was a big piece of work and long discussions. This of course brings questions: Kde Plasma 5 package missing.\nAfter half a year of work, I managed to successfully update the Qt5 stack to the last LTS version 5.15.2. On the whole, the most work was updating QtWebengine. What a monster! With my CPU power at home, I can build it 1-2 times a day which makes testing a little bit annoying and time intensive.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKarl - Firefox webcam audio solution\nMichal - openzfs\nDave - bufferbloat\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn&#39;t need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://rubenerd.com/follow-up-about-freebsd-jail-advantages/\" rel=\"nofollow\">Follow-up about FreeBSD jail advantages</a></h3>\n\n<blockquote>\n<p>I’ll admit I ran a lot of justifications together into a single paragraph because I wanted to get to configuring the jails themselves. They’re also, by and large, not specific to FreeBSD’s flavour of containerisation, though I still think it’s easily the most elegant implementation. Sometimes the simplest solution really is the best one.</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/history-of-freebsd-part-4-bsd-and-tcp-ip/\" rel=\"nofollow\">History of FreeBSD part 4: TCP/IP</a></h3>\n\n<ul>\n<li>How TCP/IP evolved and BSDs special contribution to the history of the Internet\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://blog.andreev.it/?p=5289\" rel=\"nofollow\">FreeBSD: Install Prometheus, Node Exporter and Grafana</a></h3>\n\n<blockquote>\n<p>FreeBSD comes out of the box with three great tools for monitoring. If you need more info about how these tools work, please read the official documentation. I’ll explain the installation only and creating a simple dashboard.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.tumfatig.net/20210122/calibrate-your-touch-screen-on-openbsd/\" rel=\"nofollow\">Calibrate your touch-screen on OpenBSD</a></h3>\n\n<blockquote>\n<p>I didn’t expected it but my refurbished T460s came with a touch-screen. It is recognized by default on OpenBSD and not well calibrated as-is. But that’s really simple to solve.</p>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2021-January/002006.html\" rel=\"nofollow\">Lets all shed a Tear for 386</a></h3>\n\n<p>FreeBSD is designating i386 as a Tier 2 architecture starting with FreeBSD 13.0.  The Project will continue to provide release images, binary updates, and pre-built packages for the 13.x branch.  However, i386-specific issues (including SAs) may not be addressed in 13.x. The i386 platform will remain Tier 1 on FreeBSD 11.x and 12.x.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://opnsense.org/opnsense-21-1-marvelous-meerkat-released/\" rel=\"nofollow\">OPNsense 21.1 Marvelous Meerkat Released</a></h3>\n\n<blockquote>\n<p>For more than 6 years, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>\n\n<hr>\n\n<h3><a href=\"https://nomadbsd.org/index.html#1.4-RC1\" rel=\"nofollow\">NomadBSD 1.4-RC1</a></h3>\n\n<p>We are pleased to present the first release candidate of NomadBSD 1.4.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/FindWithoutXargsToday\" rel=\"nofollow\">find mostly doesn&#39;t need xargs today on modern Unixes</a></h3>\n\n<blockquote>\n<p>I&#39;ve been using Unix for long enough that &#39;find | xargs&#39; is a reflex. When I started and for a long time afterward, xargs was your only choice for efficiently executing a command over a bunch of find results.</p>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210124113220\" rel=\"nofollow\">OpenBSD KDE Status Report</a></h3>\n\n<p>OpenBSD has managed to drop KDE3 and KDE4 in the 6.8 -&gt; 6.9 release cycle. That makes me very happy because it was a big piece of work and long discussions. This of course brings questions: Kde Plasma 5 package missing.<br>\nAfter half a year of work, I managed to successfully update the Qt5 stack to the last LTS version 5.15.2. On the whole, the most work was updating QtWebengine. What a monster! With my CPU power at home, I can build it 1-2 times a day which makes testing a little bit annoying and time intensive.</p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Karl%20-%20Firefox%20webcam%20audio%20solution.md\" rel=\"nofollow\">Karl - Firefox webcam audio solution</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Michal%20-%20openzfs.md\" rel=\"nofollow\">Michal - openzfs</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/391/feedback/Dave%20-%20bufferbloat.md\" rel=\"nofollow\">Dave - bufferbloat</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Follow-up about FreeBSD jail advantages, Install Prometheus, Node Exporter and Grafana, Calibrate your touch-screen on OpenBSD, OPNsense 21.1 Marvelous Meerkat Released, NomadBSD 1.4-RC1, Lets all shed a Tear for 386, find mostly doesn't need xargs today on modern Unixes, OpenBSD KDE Status Report, and more.","date_published":"2021-02-25T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3105d37c-fc28-49e0-983d-1ac767b72f76.mp3","mime_type":"audio/mpeg","size_in_bytes":39165456,"duration_in_seconds":2335}]},{"id":"a77e0ca4-6c57-4cd9-ad09-1fbf8292e5d8","title":"390: Commercial Unix Killer","url":"https://www.bsdnow.tv/390","content_text":"Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nDid Linux Kill Commercial Unix?\n\n\nSales of commercial Unix have fallen off a cliff. There has to be something behind this dramatic decline. Has Linux killed its ancestor by becoming a perfectly viable replacement, like an operating system version of Invasion of the Body Snatchers?\n\n\n\nWireguard: Simple and Secure VPN in FreeBSD\n\n\nA great article by Tom Jones about setting up Wireguard on FreeBSD\n***\n\n\n\nSetup a Three Node Replicated GlusterFS Cluster on FreeBSD\n\n\nGlusterFS (GFS) is the open source equivalent to Microsoft's Distributed Filesystem (DFS). It's a service that replicates the contents of a filesystem in real time from one server to another. Clients connect to any server and changes made to a file will replicate automatically. It's similar to something like rsync or syncthing, but much more automatic and transparent. A FreeBSD port has been available since v3.4, and (as of this post) is currently at version 8.0 with 9.0 being released soon.\n\n\n\nNews Roundup\n\nOpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen)\n\nLenovo has finally made a smaller version of its X1 Carbon, something I’ve been looking forward to for years.\n\n\n\nNetBSD on the EdgeRouter Lite\n\nNetBSD-current now has pre-built octeon bootable images (which will appear in NetBSD 10.0) for the evbmips port, so I decided to finally give it a try. I've been happily running OpenBSD/octeon on my EdgeRouter Lite for a few years now, and have previously published some notes including more detail about the CPU.\n\n\n\n“TLS Mastery” first draft done!\n\n\n\n\nBeastie Bits\n\n\nA Thread on a FreeBSD Desktop for PineBook Pro\nFOSSASIA Conference - March 2021(Virtual)\nWireGuard for pfSense Software\nNetBSD logo to going Moon\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n### Producer's Note\n&gt; Hey everybody, it’s JT here.  After our AMA episode where I mentioned I was looking for older BSD Retail Copies, I was contacted by Andrew who hooked me up with a bunch of OpenBSD disks from the 4.x era.  So shout out to him, and since that worked so well, I figured I'd give it another shot and ask that if anyone has any old Unixes that will run on an 8088, 8086, or 286 and you're willing to send me copies of the disks. I've recently dug out an old 286 system and I’d love to get a Unix OS on it.  I know of Minix, Xenix and Microport, but I haven’t been able to find many versions of them.  I've found Microport 1.3.3, and SCO Xenix... but that's about it.  Let me know if you happen to have any other versions, or know where I can get them.\n\n\nFeedback/Questions\n\n\nChristian - ZFS replication and verification\nIain - progress\nPaul - APU2 device\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.howtogeek.com/440147/did-linux-kill-commercial-unix/\" rel=\"nofollow\">Did Linux Kill Commercial Unix?</a></h3>\n\n<blockquote>\n<p>Sales of commercial Unix have fallen off a cliff. There has to be something behind this dramatic decline. Has Linux killed its ancestor by becoming a perfectly viable replacement, like an operating system version of Invasion of the Body Snatchers?</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/simple-and-secure-vpn-in-freebsd/\" rel=\"nofollow\">Wireguard: Simple and Secure VPN in FreeBSD</a></h3>\n\n<ul>\n<li>A great article by Tom Jones about setting up Wireguard on FreeBSD\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"http://www.unibia.com/unibianet/freebsd/setup-three-node-replicated-glusterfs-cluster-freebsd\" rel=\"nofollow\">Setup a Three Node Replicated GlusterFS Cluster on FreeBSD</a></h3>\n\n<blockquote>\n<p>GlusterFS (GFS) is the open source equivalent to Microsoft&#39;s Distributed Filesystem (DFS). It&#39;s a service that replicates the contents of a filesystem in real time from one server to another. Clients connect to any server and changes made to a file will replicate automatically. It&#39;s similar to something like rsync or syncthing, but much more automatic and transparent. A FreeBSD port has been available since v3.4, and (as of this post) is currently at version 8.0 with 9.0 being released soon.</p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jcs.org/2021/01/27/x1nano\" rel=\"nofollow\">OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen)</a></h3>\n\n<p>Lenovo has finally made a smaller version of its X1 Carbon, something I’ve been looking forward to for years.</p>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/netbsd-on-the-edgerouter-lite/\" rel=\"nofollow\">NetBSD on the EdgeRouter Lite</a></h3>\n\n<p>NetBSD-current now has pre-built octeon bootable images (which will appear in NetBSD 10.0) for the evbmips port, so I decided to finally give it a try. I&#39;ve been happily running OpenBSD/octeon on my EdgeRouter Lite for a few years now, and have previously published some notes including more detail about the CPU.</p>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/9938\" rel=\"nofollow\">“TLS Mastery” first draft done!</a></h3>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://forums.freebsd.org/threads/freebsd-desktop-for-pinebook-pro.78269/\" rel=\"nofollow\">A Thread on a FreeBSD Desktop for PineBook Pro</a></li>\n<li><a href=\"https://eventyay.com/e/fa96ae2c\" rel=\"nofollow\">FOSSASIA Conference - March 2021(Virtual)</a></li>\n<li><a href=\"https://www.netgate.com/blog/wireguard-for-pfsense-software.html\" rel=\"nofollow\">WireGuard for pfSense Software</a></li>\n<li><a href=\"https://mail-index.netbsd.org/netbsd-advocacy/2021/02/07/msg000849.html\" rel=\"nofollow\">NetBSD logo to going Moon</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n### Producer&#39;s Note\n&gt; Hey everybody, it’s JT here.  After our AMA episode where I mentioned I was looking for older BSD Retail Copies, I was contacted by Andrew who hooked me up with a bunch of OpenBSD disks from the 4.x era.  So shout out to him, and since that worked so well, I figured I&#39;d give it another shot and ask that if anyone has any old Unixes that will run on an 8088, 8086, or 286 and you&#39;re willing to send me copies of the disks. I&#39;ve recently dug out an old 286 system and I’d love to get a Unix OS on it.  I know of Minix, Xenix and Microport, but I haven’t been able to find many versions of them.  I&#39;ve found Microport 1.3.3, and SCO Xenix... but that&#39;s about it.  Let me know if you happen to have any other versions, or know where I can get them.<br></li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Christian%20-%20ZFS%20replication%20and%20verification\" rel=\"nofollow\">Christian - ZFS replication and verification</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Iain%20-%20progress\" rel=\"nofollow\">Iain - progress</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/390/feedback/Paul%20-%20APU2%20device\" rel=\"nofollow\">Paul - APU2 device</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Did Linux kill Commercial Unix, three node GlusterFS setup on FreeBSD, OpenBSD on the Lenovo ThinkPad X1 Nano (1st Gen), NetBSD on EdgeRouter Lite, TLS Mastery first draft done","date_published":"2021-02-18T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a77e0ca4-6c57-4cd9-ad09-1fbf8292e5d8.mp3","mime_type":"audio/mpeg","size_in_bytes":55003992,"duration_in_seconds":3336}]},{"id":"e9e941f3-5d28-4978-9398-058673590033","title":"389: Comfy FreeBSD Jails","url":"https://www.bsdnow.tv/389","content_text":"A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nA Week With Plan 9\n\n\nI spent the first week of 2021 learning an OS called Plan 9 from Bell Labs. This is a fringe Operating System, long abandoned by it’s original authors. It's also responsible for a great deal of inspiration elsewhere. If you’ve used the Go language, /proc, UTF-8 or Docker, you’ve used Plan 9-designed features. This issue dives into Operating System internals and some moderately hard computer science topics. If that sort of thing isn’t your bag you might want to skip ahead. Normal service will resume shortly.\n\n\n\nExploring Swap on FreeBSD\n\nOn modern Unix-like systems such as FreeBSD, “swapping” refers to the activity of paging out the contents of memory to a disk and then paging it back in on demand. The page-out activity occurs in response to a lack of free memory in the system: the kernel tries to identify pages of memory that probably will not be accessed in the near future, and copies their contents to a disk for safekeeping until they are needed again. When an application attempts to access memory that has been swapped out, it blocks while the kernel fetches that saved memory from the swap disk, and then resumes execution as if nothing had happened.\n\n\n\n\nNews Roundup\n\nHow to create a FreeBSD pkg mirror using bastille and poudriere\n\n\nThis a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.\n\n\n\nHow to set up FreeBSD 12 VNET jail with ZFS\n\nHow do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?\nFreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFZ on FreeBSD 12.x.\n\n\n\nCreating Comfy FreeBSD Jails Using Standard Tools\n\nDocker has stormed into software development in recent years. While the concepts behind it are powerful and useful, similar tools have been used in systems for decades. FreeBSD’s jails in one of those tools which build upon even older chroot(2) To put it shortly, with these tools, you can make a safe environment separated from the rest of the system.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChris - USB BSD variant\nJacob - host wifi through a jail\nJordan - new tool vs updating existing tool\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://thedorkweb.substack.com/p/a-week-with-plan-9\" rel=\"nofollow\">A Week With Plan 9</a></h3>\n\n<blockquote>\n<p>I spent the first week of 2021 learning an OS called Plan 9 from Bell Labs. This is a fringe Operating System, long abandoned by it’s original authors. It&#39;s also responsible for a great deal of inspiration elsewhere. If you’ve used the Go language, /proc, UTF-8 or Docker, you’ve used Plan 9-designed features. This issue dives into Operating System internals and some moderately hard computer science topics. If that sort of thing isn’t your bag you might want to skip ahead. Normal service will resume shortly.</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/articles/exploring-swap-on-freebsd/\" rel=\"nofollow\">Exploring Swap on FreeBSD</a></h3>\n\n<p>On modern Unix-like systems such as FreeBSD, “swapping” refers to the activity of paging out the contents of memory to a disk and then paging it back in on demand. The page-out activity occurs in response to a lack of free memory in the system: the kernel tries to identify pages of memory that probably will not be accessed in the near future, and copies their contents to a disk for safekeeping until they are needed again. When an application attempts to access memory that has been swapped out, it blocks while the kernel fetches that saved memory from the swap disk, and then resumes execution as if nothing had happened.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://hackacad.net/post/2021-01-13-build-a-freebsd-pkg-mirror-with-bastille-poudriere/\" rel=\"nofollow\">How to create a FreeBSD pkg mirror using bastille and poudriere</a></h3>\n\n<blockquote>\n<p>This a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.</p>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/\" rel=\"nofollow\">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>\n\n<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>\nFreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFZ on FreeBSD 12.x.</p>\n\n<hr>\n\n<h3><a href=\"https://kettunen.io/post/standard-freebsd-jails/\" rel=\"nofollow\">Creating Comfy FreeBSD Jails Using Standard Tools</a></h3>\n\n<p>Docker has stormed into software development in recent years. While the concepts behind it are powerful and useful, similar tools have been used in systems for decades. FreeBSD’s jails in one of those tools which build upon even older chroot(2) To put it shortly, with these tools, you can make a safe environment separated from the rest of the system.</p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Chris%20-%20USB%20BSD%20variant\" rel=\"nofollow\">Chris - USB BSD variant</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jacob%20-%20host%20wifi%20through%20a%20jail\" rel=\"nofollow\">Jacob - host wifi through a jail</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/389/feedback/Jordan%20-%20new%20too%20vs%20updating%20existing%20tool\" rel=\"nofollow\">Jordan - new tool vs updating existing tool</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"A week with Plan 9, Exploring Swap on FreeBSD, how to create a FreeBSD pkg mirror using bastille and poudriere, How to set up FreeBSD 12 VNET jail with ZFS, Creating Comfy FreeBSD Jails Using Standard Tools, and more.","date_published":"2021-02-10T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e9e941f3-5d28-4978-9398-058673590033.mp3","mime_type":"audio/mpeg","size_in_bytes":42044472,"duration_in_seconds":2476}]},{"id":"df800c64-9bac-467b-be5c-088a4cd94882","title":"388: Must-have security tool","url":"https://www.bsdnow.tv/388","content_text":"FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD quarterly status report for Q4 2020\n\n\n\nBlock spammers/abusive IPs with Pf-badhost in OpenBSD. A 'must have' security tool!\n\n\nPf-badhost is a very practical, robust, stable and lightweight security script for network servers.\nIt's compatible with BSD based operating systems such as {Open,Free,Net,Dragonfly}BSD and MacOS. It prevents potentially-bad IP addresses that could possibly attack your servers (and waste your bandwidth and fill your logfiles), by blocking all those IPs contacting your server, and therefore it makes your server network/resources lighter and the logs of important services running on your server become simpler, more readable and efficient.\n\n\n\n\n\n\nNews Roundup\n\nBastille Port Redirection and Persistence\n\n\nBastille supports redirecting (rdr) ports from the host system into target containers. This port redirection is commonly used when running Internet services such as web servers, dns servers, email and many others. Any service you want to make public outside of your cluster will likely require port redirection (with some exceptions, see below).\n\n\n\nFreeBSD Wall Display Computer\n\nI've recently added a wall mounted 30\" monitor for Grafana in my home. I can highly recommend doing the same, especially in a world where more work from home is becoming the norm.\n\n\n\nThe etymology of command-line tools\n\n\n\nGhostBSD 21.01.15 Release Notes\n\nI am happy to announce the availability of the new ISO 21.01.15. This new ISO comes with a clean-up of packages that include removing LibreOffice and Telegram from the default selection. We did this to bring the zfs RW live file systems to run without problem on 4GB of ram machine. We also removed the UFS full disk option from the installer. Users can still use custom partitions to setup UFS partition, but we discourage it. We also fixed the Next button's restriction in the custom partition related to some bug that people reported. We also fix the missing default locale setup and added the default setup for Linux Steam, not to forget this ISO includes kernel, userland and numerous application updates.\n\n\n\n\nBeastie Bits\n\n\nInterview with Brian Kernighan\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2020-10-2020-12/\" rel=\"nofollow\">FreeBSD quarterly status report for Q4 2020</a></h3>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210119113425\" rel=\"nofollow\">Block spammers/abusive IPs with Pf-badhost in OpenBSD. A &#39;must have&#39; security tool!</a></h3>\n\n<blockquote>\n<p>Pf-badhost is a very practical, robust, stable and lightweight security script for network servers.<br>\nIt&#39;s compatible with BSD based operating systems such as {Open,Free,Net,Dragonfly}BSD and MacOS. It prevents potentially-bad IP addresses that could possibly attack your servers (and waste your bandwidth and fill your logfiles), by blocking all those IPs contacting your server, and therefore it makes your server network/resources lighter and the logs of important services running on your server become simpler, more readable and efficient.</p>\n\n<hr>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://bastillebsd.org/blog/2021/01/13/bastille-port-redirection-and-persistence/\" rel=\"nofollow\">Bastille Port Redirection and Persistence</a></h3>\n\n<blockquote>\n<p>Bastille supports redirecting (rdr) ports from the host system into target containers. This port redirection is commonly used when running Internet services such as web servers, dns servers, email and many others. Any service you want to make public outside of your cluster will likely require port redirection (with some exceptions, see below).</p>\n\n<hr>\n\n<h3><a href=\"https://blog.tyk.nu/blog/freebsd-wall-display-computer/\" rel=\"nofollow\">FreeBSD Wall Display Computer</a></h3>\n\n<p>I&#39;ve recently added a wall mounted 30&quot; monitor for Grafana in my home. I can highly recommend doing the same, especially in a world where more work from home is becoming the norm.</p>\n\n<hr>\n\n<h3><a href=\"https://i.redd.it/sni9gaxfj2d61.png\" rel=\"nofollow\">The etymology of command-line tools</a></h3>\n\n<hr>\n\n<h3><a href=\"https://ghostbsd.org/21.01.15_release_notes\" rel=\"nofollow\">GhostBSD 21.01.15 Release Notes</a></h3>\n\n<p>I am happy to announce the availability of the new ISO 21.01.15. This new ISO comes with a clean-up of packages that include removing LibreOffice and Telegram from the default selection. We did this to bring the zfs RW live file systems to run without problem on 4GB of ram machine. We also removed the UFS full disk option from the installer. Users can still use custom partitions to setup UFS partition, but we discourage it. We also fixed the Next button&#39;s restriction in the custom partition related to some bug that people reported. We also fix the missing default locale setup and added the default setup for Linux Steam, not to forget this ISO includes kernel, userland and numerous application updates.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://corecursive.com/brian-kernighan-unix-bell-labs1/\" rel=\"nofollow\">Interview with Brian Kernighan</a>\n***\n###Tarsnap</li>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"FreeBSD Q4 2020 Status report, a must-have security tool from OpenBSD, Bastille Port Redirection and Persistence, FreeBSD Wall Display Computer, etymology of command-line tools, GhostBSD 21.01.15 Release Notes, and more.","date_published":"2021-02-04T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/df800c64-9bac-467b-be5c-088a4cd94882.mp3","mime_type":"audio/mpeg","size_in_bytes":51435504,"duration_in_seconds":2981}]},{"id":"352cdfe3-fbba-46ef-8982-4b4c37d3da22","title":"387: OpenBSD Broadcast Studio","url":"https://www.bsdnow.tv/387","content_text":"GNN's tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan's CURL tip of the Day, List of some Shell goodies for OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nGNN's tips for surviving Cabin Fever and Coding from Home\n\n\nForgive me if this seems off topic, but I was wondering if you had any advice for the majority of us who are now KFH (koding from home). I don't know how KV works day to day, but it seems pretty clear that the status quo has changed at most workplaces in the last several months, and it's hard to know if there are things we could be doing to stay productive while we're all at home, ordering delivery, and microwaving our mail. Does KV have any good guidance?\n\n\n\n\nSelf-host a password manager on OpenBSD\n\n\nI’ve been using Rubywarden to store and access my passwords from OpenBSD workstations and iOS toys. But recent redondant failures from the iOS App and rubywarden not being maintained anymore led to the need for a new solution.\nI was investing on pass+pgp+git but it was quite complex.\n\n\nNews Roundup\n\nPreliminary OpenBSD Support added to OBS\n\n\n\nDan's CURL tip of the Day\n\n\n\nList of some Shell goodies for OpenBSD\n\n\nI'm sharing here some practices I'm following and some small tips/tools which facilitate my usage of OpenBSD in my day to day.\nSome are really specific to my usage, others could be re-used.\n\n\n\n\nBeastie Bits\n\n• [Traditional text mode games from BSD](https://github.com/msharov/bsd-games)\n• [FreeBSD Easter Eggs](https://twitter.com/freebsdfrau/status/972893680473317377)\n• [A prehistory and history of Unix Slide Deck](https://docs.google.com/presentation/d/1BxnFiP_Hv3HJbbYRfSxpTym7GzqxJPQlTE6Ur5h1Al8/edit#slide=id.g951f86c343_0_95)\n• [How to use Android USB Tethering to get Internet on FreeBSD](https://www.youtube.com/watch?v=cAEmtrEZlV8)\n• [VPN'Othon #2 for CharmBUG](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/charmbug_event.md)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n• [Kev - Ramdisk](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/kev%20-%20ramdisk.md)\n• [John - new to freebsd](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/John%20-%20new%20to%20freebsd)\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>GNN&#39;s tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan&#39;s CURL tip of the Day, List of some Shell goodies for OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://queue.acm.org/detail.cfm?id=3437846\" rel=\"nofollow\">GNN&#39;s tips for surviving Cabin Fever and Coding from Home</a></h3>\n\n<blockquote>\n<p>Forgive me if this seems off topic, but I was wondering if you had any advice for the majority of us who are now KFH (koding from home). I don&#39;t know how KV works day to day, but it seems pretty clear that the status quo has changed at most workplaces in the last several months, and it&#39;s hard to know if there are things we could be doing to stay productive while we&#39;re all at home, ordering delivery, and microwaving our mail. Does KV have any good guidance?</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/20210105/self-host-a-password-manager-on-openbsd/\" rel=\"nofollow\">Self-host a password manager on OpenBSD</a></h3>\n\n<blockquote>\n<p>I’ve been using Rubywarden to store and access my passwords from OpenBSD workstations and iOS toys. But recent redondant failures from the iOS App and rubywarden not being maintained anymore led to the need for a new solution.<br>\nI was investing on pass+pgp+git but it was quite complex.</p>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20210113072623\" rel=\"nofollow\">Preliminary OpenBSD Support added to OBS</a></h3>\n\n<hr>\n\n<h3><a href=\"https://mobile.twitter.com/DLangille/status/1323963716153626626\" rel=\"nofollow\">Dan&#39;s CURL tip of the Day</a></h3>\n\n<hr>\n\n<h3><a href=\"https://www.vincentdelft.be/post/post_20210102\" rel=\"nofollow\">List of some Shell goodies for OpenBSD</a></h3>\n\n<blockquote>\n<p>I&#39;m sharing here some practices I&#39;m following and some small tips/tools which facilitate my usage of OpenBSD in my day to day.<br>\nSome are really specific to my usage, others could be re-used.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [Traditional text mode games from BSD](https://github.com/msharov/bsd-games)\n• [FreeBSD Easter Eggs](https://twitter.com/freebsdfrau/status/972893680473317377)\n• [A prehistory and history of Unix Slide Deck](https://docs.google.com/presentation/d/1BxnFiP_Hv3HJbbYRfSxpTym7GzqxJPQlTE6Ur5h1Al8/edit#slide=id.g951f86c343_0_95)\n• [How to use Android USB Tethering to get Internet on FreeBSD](https://www.youtube.com/watch?v=cAEmtrEZlV8)\n• [VPN&#39;Othon #2 for CharmBUG](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/charmbug_event.md)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<pre><code>• [Kev - Ramdisk](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/kev%20-%20ramdisk.md)\n• [John - new to freebsd](https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/387/feedback/John%20-%20new%20to%20freebsd)\n</code></pre>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"GNN's tips for surviving Cabin Fever and Coding from Home, Self-host a password manager on OpenBSD, Preliminary OpenBSD Support added to OBS, Dan's CURL tip of the Day, List of some Shell goodies for OpenBSD, and more","date_published":"2021-01-28T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/352cdfe3-fbba-46ef-8982-4b4c37d3da22.mp3","mime_type":"audio/mpeg","size_in_bytes":43820232,"duration_in_seconds":2591}]},{"id":"d5e42030-e15b-444f-b823-a40e34bea5a8","title":"386: Aye, 386!","url":"https://www.bsdnow.tv/386","content_text":"Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nRouting and Firewalling VLANS with FreeBSD\n\n\nIn this article we are going to look at and integrate two network isolation technologies, VLANs and VNET. VLANs are common place, and if you have done some network management or design then you are likely to have interacted with them. The second are FreeBSDs VNET virtual network stacks, a powerful network stack isolation technology that gives FreeBSD jails super powers.\nEthernet VLAN (standardised by IEEE 802.1Q) are an extension to Ethernet and provide an essential method for scaling network deployments. They are used in all environments to enable reuse of common infrastructure by isolating portions of networks from each other. VLANs allow the reuse of common cables, switches and routers to carry completely different networks. It is common to have data that must be separated from different networks carried on common cables until their VLAN tags are finally stripped at a gateway switch or router.\n\n\n\n\nHow to set up FreeBSD 12 VNET jail with ZFS\n\n\nHow do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?\nFreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFS on FreeBSD 12.x.\n\n\n\n\nNews Roundup\n\npkgsrc-2020Q4 released\n\n\nThe pkgsrc developers are proud to announce the 69th quarterly release\nof pkgsrc, the cross-platform packaging system.  pkgsrc is available\nwith more than 24,000 packages, running on 23 separate platforms; more\ninformation on pkgsrc itself is available at https://www.pkgsrc.org/\n\n\n\n\nFreeBSD ON A Raspberry PI 4 With 4GB of RAM\n\n\nThis is the story of how I managed to get FreeBSD running on a Raspberry Pi 4 with 4GB of RAM, though I think the setup story is pretty similar for those with 2GB and 8GB.1\n\n\n\n\nHardenedBSD December 2020 Status Report\n\n\nHappy New Year! On this the last day of 2020, I submit December's status report.\n\n\n\n\nBeastie Bits\n\n\nChristmas Cards The Unix Way - with pic and  troff\nFast RPI3 upgrade from source (cross compile) \n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nRobert - zfs question\nNeb - AMA episode.md\nJoe - puppet\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/routing-and-firewalling-vlans-with-freebsd/\" rel=\"nofollow\">Routing and Firewalling VLANS with FreeBSD</a></h3>\n\n<blockquote>\n<p>In this article we are going to look at and integrate two network isolation technologies, VLANs and VNET. VLANs are common place, and if you have done some network management or design then you are likely to have interacted with them. The second are FreeBSDs VNET virtual network stacks, a powerful network stack isolation technology that gives FreeBSD jails super powers.<br>\nEthernet VLAN (standardised by IEEE 802.1Q) are an extension to Ethernet and provide an essential method for scaling network deployments. They are used in all environments to enable reuse of common infrastructure by isolating portions of networks from each other. VLANs allow the reuse of common cables, switches and routers to carry completely different networks. It is common to have data that must be separated from different networks carried on common cables until their VLAN tags are finally stripped at a gateway switch or router.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/faq/configuring-freebsd-12-vnet-jail-using-bridgeepair-zfs/\" rel=\"nofollow\">How to set up FreeBSD 12 VNET jail with ZFS</a></h3>\n\n<blockquote>\n<p>How do I install, set up and configure a FreeBSD 12 jail with VNET on ZFS? How can I create FreeBSD 12 VNET jail with /etc/jail.conf to run OpenVPN, Apache, Wireguard and other Internet-facing services securely on my BSD box?<br>\nFreeBSD jail is nothing but operating system-level virtualization that allows partitioning a FreeBSD based Unix server. Such systems have their root user and access rights. Jails can use network subsystem virtualization infrastructure or share an existing network. FreeBSD jails are a powerful way to increase security. Usually, you create jail per services such as an Nginx/Apache webserver with PHP/Perl/Python app, WireGuard/OpeNVPN server, MariaDB/PgSQL server, and more. This page shows how to configure a FreeBSD Jail with vnet and ZFS on FreeBSD 12.x.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mail-index.netbsd.org/netbsd-announce/2021/01/08/msg000322.html\" rel=\"nofollow\">pkgsrc-2020Q4 released</a></h3>\n\n<blockquote>\n<p>The pkgsrc developers are proud to announce the 69th quarterly release<br>\nof pkgsrc, the cross-platform packaging system.  pkgsrc is available<br>\nwith more than 24,000 packages, running on 23 separate platforms; more<br>\ninformation on pkgsrc itself is available at <a href=\"https://www.pkgsrc.org/\" rel=\"nofollow\">https://www.pkgsrc.org/</a></p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lambdaland.org/posts/2020-12-23_freebsd_rpi4/\" rel=\"nofollow\">FreeBSD ON A Raspberry PI 4 With 4GB of RAM</a></h3>\n\n<blockquote>\n<p>This is the story of how I managed to get FreeBSD running on a Raspberry Pi 4 with 4GB of RAM, though I think the setup story is pretty similar for those with 2GB and 8GB.1</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-12-31/hardenedbsd-december-2020-status-report\" rel=\"nofollow\">HardenedBSD December 2020 Status Report</a></h3>\n\n<blockquote>\n<p>Happy New Year! On this the last day of 2020, I submit December&#39;s status report.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=xMijdTWSUEE&feature=youtu.be\" rel=\"nofollow\">Christmas Cards The Unix Way - with pic and  troff</a></li>\n<li><a href=\"https://forums.freebsd.org/threads/fast-upgrade-raspberry-pi3-from-source.78169/\" rel=\"nofollow\">Fast RPI3 upgrade from source (cross compile)</a> \n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/robert%20-%20zfs%20question.md\" rel=\"nofollow\">Robert - zfs question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/neb%20-%20AMA%20episode.md\" rel=\"nofollow\">Neb - AMA episode.md</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/386/feedback/joe%20-%20puppet.md\" rel=\"nofollow\">Joe - puppet</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Routing and Firewalling VLANS with FreeBSD, FreeBSD 12 VNET jail with ZFS howto, pkgsrc-2020Q4 released, FreeBSD on Raspberry Pi 4 With 4GB of RAM, HardenedBSD December 2020 Status Report, and more","date_published":"2021-01-21T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d5e42030-e15b-444f-b823-a40e34bea5a8.mp3","mime_type":"audio/mpeg","size_in_bytes":38533008,"duration_in_seconds":2220}]},{"id":"ec8dd4e8-e1f9-41bd-822b-d1a68799470c","title":"385: Wireguard VPN mesh","url":"https://www.bsdnow.tv/385","content_text":"Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nHistory of FreeBSD - Part 3: Early Days of FreeBSD\n\n\nIn this third part of our series on the history of FreeBSD, we start tracing the early days of FreeBSD and the events that would eventually shape the project and the future of open source software. \n\n\n\n\nA mesh VPN using OpenBSD and WireGuard\n\n\nWireGuard is a new coming to OpenBSD 6.8 and it looks like a simple and efficient way to connect computers.\nI own a few VPS (hello Vultr, hello OpenBSD.amsterdam) that tend to be connected through filtered public services and/or SSH tunnels. And that’s neither efficient nor easy to manage. Here comes the wg(4) era where all those peers will communicate with a bit more privacy and ease of management.\n\n\n\n\nNews Roundup\n\nFoundation Sponsors FreeBSD LLDB Improvements\n\n\nWith FreeBSD Foundation grant, Moritz Systems improved LLDB support for FreeBSD\nThe LLDB project builds on libraries provided by LLVM and Clang to provide a great modern debugger. It uses the Clang ASTs and the expression parser, LLVM JIT, LLVM disassembler, etc so that it provides an experience that “just works”. It is also blazing fast and more permissively licensed than GDB, the GNU Debugger.\nLLDB is the default debugger in Xcode on macOS and supports debugging C, Objective-C, and C++ on the desktop and iOS devices and the simulator.\n\n\n\n\nHost your Cryptpad web office suite with OpenBSD\n\n\nIn this article I will explain how to deploy your own Cryptpad instance with OpenBSD. Cryptpad is a web office suite featuring easy real time collaboration on documents. Cryptpad is written in JavaScript and the daemon acts as a web server.\n\n\n\n\nBeastie Bits\n\n\nOPNsense 20.7.7 Released\nIntroducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. \nBSD In Die Hard\nManaging jails with Ansible: a showcase for building a container infrastructure on FreeBSD\nBSD Hardware\nNew WINE chapter in FreeBSD handbook\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\n\n\nFeedback/Questions\n\n\nscott- zfs question\nBruce - copy paste on esxi\nJulian - an apology for Allan\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/history-of-freebsd-part-3-early-days-of-freebsd/?utm_source=bsdnow\" rel=\"nofollow\">History of FreeBSD - Part 3: Early Days of FreeBSD</a></h3>\n\n<blockquote>\n<p>In this third part of our series on the history of FreeBSD, we start tracing the early days of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.tumfatig.net/20201202/a-mesh-vpn-using-openbsd-and-wireguard/?utm_source=bsdnow\" rel=\"nofollow\">A mesh VPN using OpenBSD and WireGuard</a></h3>\n\n<blockquote>\n<p>WireGuard is a new coming to OpenBSD 6.8 and it looks like a simple and efficient way to connect computers.<br>\nI own a few VPS (hello Vultr, hello OpenBSD.amsterdam) that tend to be connected through filtered public services and/or SSH tunnels. And that’s neither efficient nor easy to manage. Here comes the wg(4) era where all those peers will communicate with a bit more privacy and ease of management.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://freebsdfoundation.org/blog/guest-blog-foundation-sponsors-freebsd-lldb-improvements/?utm_source=bsdnow\" rel=\"nofollow\">Foundation Sponsors FreeBSD LLDB Improvements</a></h3>\n\n<blockquote>\n<p>With FreeBSD Foundation grant, Moritz Systems improved LLDB support for FreeBSD<br>\nThe LLDB project builds on libraries provided by LLVM and Clang to provide a great modern debugger. It uses the Clang ASTs and the expression parser, LLVM JIT, LLVM disassembler, etc so that it provides an experience that “just works”. It is also blazing fast and more permissively licensed than GDB, the GNU Debugger.<br>\nLLDB is the default debugger in Xcode on macOS and supports debugging C, Objective-C, and C++ on the desktop and iOS devices and the simulator.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-12-14-cryptpad-openbsd.html\" rel=\"nofollow\">Host your Cryptpad web office suite with OpenBSD</a></h3>\n\n<blockquote>\n<p>In this article I will explain how to deploy your own Cryptpad instance with OpenBSD. Cryptpad is a web office suite featuring easy real time collaboration on documents. Cryptpad is written in JavaScript and the daemon acts as a web server.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://opnsense.org/opnsense-20-7-7-released/?utm_source=bsdnow\" rel=\"nofollow\">OPNsense 20.7.7 Released</a></li>\n<li><a href=\"https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow\" rel=\"nofollow\">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a></li>\n<li><a href=\"https://www.reddit.com/r/BSD/comments/kk3c6y/merry_xmas/\" rel=\"nofollow\">BSD In Die Hard</a></li>\n<li><a href=\"https://papers.freebsd.org/2019/bsdcan/dengg-managing_jails_with_ansible/\" rel=\"nofollow\">Managing jails with Ansible: a showcase for building a container infrastructure on FreeBSD</a></li>\n<li><a href=\"https://bsd-hardware.info\" rel=\"nofollow\">BSD Hardware</a></li>\n<li><a href=\"https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/wine.html\" rel=\"nofollow\">New WINE chapter in FreeBSD handbook</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/scott-%20zfs%20question\" rel=\"nofollow\">scott- zfs question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Bruce%20-%20copy%20paste%20on%20esxi\" rel=\"nofollow\">Bruce - copy paste on esxi</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/385/feedback/Julian%20-%20an%20apology%20for%20Allan\" rel=\"nofollow\">Julian - an apology for Allan</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Description: History of FreeBSD: Early Days of FreeBSD, mesh VPN using OpenBSD and WireGuard, FreeBSD Foundation Sponsors LLDB Improvements, Host your Cryptpad web office suite with OpenBSD, and more.","date_published":"2021-01-14T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ec8dd4e8-e1f9-41bd-822b-d1a68799470c.mp3","mime_type":"audio/mpeg","size_in_bytes":31123128,"duration_in_seconds":2068}]},{"id":"d48d2da1-bf8e-4f78-bfa3-48eaf73fe14a","title":"384: In memoriam","url":"https://www.bsdnow.tv/384","content_text":"Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nAllen K. Briggs Memorial Scholarship\n\n\nAllen Briggs was one of the earliest members of the NetBSD community, pursuing his interest in macBSD, and moving to become a NetBSD developer when the two projects merged. Allen was known for his quiet and relaxed manner, and always brought a keen wisdom with him; allied with his acute technical expertise, he was one of the most valued members of the NetBSD community.\nThe Allen K. Briggs Memorial Scholarship is an endowment to provide scholarships in perpetuity for summer programs at the North Carolina School of Science &amp; Math, which Allen considered to be a place that fundamentally shaped him as a person. We would love to invite Allen's friends and colleagues from the BSD community to donate to this cause so that we can provide more scholarships to students with financial need each year. We are approximately halfway to our goal of $50K with aspirations to exceed that target and fund additional scholarships.\n\n\n\n\nToward an automated tracking of OpenBSD ports contributions\n\n\nA first step for the CI service would be to create a database of diffs sent to ports. This would allow people to track what has been sent and not yet committed and what the state of the contribution is (build/don’t build, apply/don’t apply).\n\n\n\n\nNews Roundup\n\nTrying OpenZFS 2 on FreeBSD 12.2-RELEASE\n\n\nOpenZFS 2 is a huge achievement, and makes me bullish about the long term prospects for the world’s most trustworthy and nicest to use storage system. You can even use try it today on FreeBSD 12.2-RELEASE, though I recommend tracking -CURRENT for these sorts of features.\n\n\n\n\nOpenBSD on TECLAST F7 Plus\n\n\nI got myself a TECLAST F7 Plus laptop. It comes preinstalled with Windows 10 but I planned to use it as my daily driver. So I installed OpenBSD 6.8 on it.\n\n\n\n\nMulti-volume support in HAMMER2\n\n\ncommit\n&gt; This commit adds initial multi-volumes support for HAMMER2. Maximum supported volumes is 64. The feature and implementation is similar to multi-volumes support in HAMMER1.\n***\n\n\nBeastie Bits\n\n\nFreeBSD Last SVN Commit\nFreeBSD First git Commit\nIntroducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. \n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***\n\n\nFeedback/Questions\n\n\njay - feedback for ian\nIebluefire - concerns about freebsd\nmike - zfs cluster aware\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/allen_k_briggs_memorial_scholarship\" rel=\"nofollow\">Allen K. Briggs Memorial Scholarship</a></h3>\n\n<blockquote>\n<p>Allen Briggs was one of the earliest members of the NetBSD community, pursuing his interest in macBSD, and moving to become a NetBSD developer when the two projects merged. Allen was known for his quiet and relaxed manner, and always brought a keen wisdom with him; allied with his acute technical expertise, he was one of the most valued members of the NetBSD community.<br>\nThe Allen K. Briggs Memorial Scholarship is an endowment to provide scholarships in perpetuity for summer programs at the North Carolina School of Science &amp; Math, which Allen considered to be a place that fundamentally shaped him as a person. We would love to invite Allen&#39;s friends and colleagues from the BSD community to donate to this cause so that we can provide more scholarships to students with financial need each year. We are approximately halfway to our goal of $50K with aspirations to exceed that target and fund additional scholarships.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-11-15-openbsd-ports-ci.html\" rel=\"nofollow\">Toward an automated tracking of OpenBSD ports contributions</a></h3>\n\n<blockquote>\n<p>A first step for the CI service would be to create a database of diffs sent to ports. This would allow people to track what has been sent and not yet committed and what the state of the contribution is (build/don’t build, apply/don’t apply).</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rubenerd.com/trying-openzfs-on-freebsd-12-release/?utm_source=bsdnow\" rel=\"nofollow\">Trying OpenZFS 2 on FreeBSD 12.2-RELEASE</a></h3>\n\n<blockquote>\n<p>OpenZFS 2 is a huge achievement, and makes me bullish about the long term prospects for the world’s most trustworthy and nicest to use storage system. You can even use try it today on FreeBSD 12.2-RELEASE, though I recommend tracking -CURRENT for these sorts of features.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.tumfatig.net/20201215/openbsd-on-teclast-f7-plus/?utm_source=bsdnow\" rel=\"nofollow\">OpenBSD on TECLAST F7 Plus</a></h3>\n\n<blockquote>\n<p>I got myself a TECLAST F7 Plus laptop. It comes preinstalled with Windows 10 but I planned to use it as my daily driver. So I installed OpenBSD 6.8 on it.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.dragonflydigest.com/2020/12/28/25287.html\" rel=\"nofollow\">Multi-volume support in HAMMER2</a></h3>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2020-December/770072.html\" rel=\"nofollow\">commit</a>\n&gt; This commit adds initial multi-volumes support for HAMMER2. Maximum supported volumes is 64. The feature and implementation is similar to multi-volumes support in HAMMER1.\n***</li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://svnweb.freebsd.org/base/head/README?view=markup&pathrev=368820\" rel=\"nofollow\">FreeBSD Last SVN Commit</a></li>\n<li><a href=\"https://cgit.freebsd.org/src/commit/?id=5ef5f51d2bef80b0ede9b10ad5b0e9440b60518c\" rel=\"nofollow\">FreeBSD First git Commit</a></li>\n<li><a href=\"https://klarasystems.com/learning/webinars/webinar-introducing-openzfs-2-0/?utm_source=bsdnow\" rel=\"nofollow\">Introducing OpenZFS 2.0 Webinar - Jan 20th @ noon Eastern  / 17:00 UTC. </a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/jay%20-%20feedback%20for%20ian\" rel=\"nofollow\">jay - feedback for ian</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/Iebluefire%20-%20concerns%20about%20freebsd\" rel=\"nofollow\">Iebluefire - concerns about freebsd</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/384/feedback/mike%20-%20zfs%20cluster%20aware\" rel=\"nofollow\">mike - zfs cluster aware</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Allen K. Briggs Memorial Scholarship, Toward an automated tracking of OpenBSD ports contributions, Trying OpenZFS 2 on FreeBSD 12.2-RELEASE, OpenBSD on TECLAST F7 Plus, Multi-volume support in HAMMER2, and more. ","date_published":"2021-01-07T03:45:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d48d2da1-bf8e-4f78-bfa3-48eaf73fe14a.mp3","mime_type":"audio/mpeg","size_in_bytes":32114304,"duration_in_seconds":2100}]},{"id":"b40c441d-f217-4771-b172-a1ce68803431","title":"383: Scale the tail","url":"https://www.bsdnow.tv/383","content_text":"FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD Remote Process Plugin: Final Milestone Achieved\n\n\nMoritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are working on a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.\n\n\n\nTailscale on OpenBSD\n\nI spent some time setting this up today evening and thought I’d post the steps here. Nothing fancy, just putting together various pieces actually.\nI assume you know what Tailscale is; if not check out their website. Basically it is a mesh network built on top of Wireguard. Using it you can have all your devices both within your LAN(s) and outside be on one overlay network as if they are all on the same LAN and can talk to each other. It’s my new favourite thing!\n\n\n\n\nNews Roundup\n\nmacOS to FreeBSD migration a.k.a why I left macOS\n\n\nThis is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.\nNot so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.\n\n\n\nOur monitoring of our OpenBSD machines, such as it is (as of November 2020\n\nWe have a number of OpenBSD firewalls in service (along with some other OpenBSD servers for things like VPN endpoints), and I was recently asked how we monitor PF and overall network traffic on them. I had to disappoint the person who asked with my answer, because right now we mostly don't (although this is starting to change).\n\n\n\nOPNsense 20.7.6 released\n\nThis update brings the usual mix of reliability fixes, plugin and third party software updates: FreeBSD, HardenedBSD, PHP, OpenSSH, StrongSwan, Suricata and Syslog-ng amongst others.\nPlease note that Let's Encrypt users need to reissue their certificates manually after upgrading to this version to fix the embedded certificate chain issue with the current signing CA switch going on.\n\n\n\nNYC Bug Jan 2021 with Michael W. Lucas\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nFeedback/Questions\n\n\ncy - .so files\nben - mixer volume\nprobono - live cds\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.moritz.systems/blog/freebsd-remote-plugin-final-milestone-achieved/\" rel=\"nofollow\">FreeBSD Remote Process Plugin: Final Milestone Achieved</a></h3>\n\n<blockquote>\n<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are working on a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>\n\n<hr>\n\n<h3><a href=\"https://rakhesh.com/linux-bsd/tailscale-on-openbsd/\" rel=\"nofollow\">Tailscale on OpenBSD</a></h3>\n\n<p>I spent some time setting this up today evening and thought I’d post the steps here. Nothing fancy, just putting together various pieces actually.<br>\nI assume you know what Tailscale is; if not check out their website. Basically it is a mesh network built on top of Wireguard. Using it you can have all your devices both within your LAN(s) and outside be on one overlay network as if they are all on the same LAN and can talk to each other. It’s my new favourite thing!</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://antranigv.am/weblog_en/posts/macos_to_freebsd/\" rel=\"nofollow\">macOS to FreeBSD migration a.k.a why I left macOS</a></h3>\n\n<blockquote>\n<p>This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.<br>\nNot so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.</p>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OurOpenBSDMonitoring\" rel=\"nofollow\">Our monitoring of our OpenBSD machines, such as it is (as of November 2020</a></h3>\n\n<p>We have a number of OpenBSD firewalls in service (along with some other OpenBSD servers for things like VPN endpoints), and I was recently asked how we monitor PF and overall network traffic on them. I had to disappoint the person who asked with my answer, because right now we mostly don&#39;t (although this is starting to change).</p>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-7-6-released/\" rel=\"nofollow\">OPNsense 20.7.6 released</a></h3>\n\n<p>This update brings the usual mix of reliability fixes, plugin and third party software updates: FreeBSD, HardenedBSD, PHP, OpenSSH, StrongSwan, Suricata and Syslog-ng amongst others.<br>\nPlease note that Let&#39;s Encrypt users need to reissue their certificates manually after upgrading to this version to fix the embedded certificate chain issue with the current signing CA switch going on.</p>\n\n<hr>\n\n<h3><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/nycbug\" rel=\"nofollow\">NYC Bug Jan 2021 with Michael W. Lucas</a></h3>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n</blockquote>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/cy%20-%20.so%20files\" rel=\"nofollow\">cy - .so files</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/ben%20-%20mixer%20volume\" rel=\"nofollow\">ben - mixer volume</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/383/feedback/probono%20-%20live%20cds\" rel=\"nofollow\">probono - live cds</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Remote Process Plugin Final Milestone achieved, Tailscale for OpenBSD, macOS to FreeBSD migration, monitoring of our OpenBSD machines, OPNsense 20.7.6 released, and more","date_published":"2020-12-31T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b40c441d-f217-4771-b172-a1ce68803431.mp3","mime_type":"audio/mpeg","size_in_bytes":43810032,"duration_in_seconds":2592}]},{"id":"34202bd5-f96c-4d8a-9e18-5a8eb3c26e56","title":"382: BSDNow Q&A 2020","url":"https://www.bsdnow.tv/382","content_text":"We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nInterview - Allan Jude - [Allan.jude@gmail.com](Allan.jude@gmail.com) / @allanjude\n\nInterview - Benedict Reuschling - bcr@freebsd.org / @bsdbcr\n\nInterview - JT Pennington - jt@obs-sec.com / @q5sys\n\nAMA questions\n\nBenedict:  You work at a university right?  Were you already into tech before you started working there?  What do you do there?\nYes, I do work at the University of Applied Sciences, Darmstadt, Germany. I’m a lab engineer there (without a lab, but with a big data cluster). I teach in the winter semester an undergraduate, elective course called “Unix for Developers”. Yes, I was already in tech by that time. Did some previous work at companies before (selling hardware at the call-in hotline and later in the store) and during my CS studies.\nAllan:  What’s the next big FreeBSD Project you plan on doing?\n\nJT:  How did you get involved in BSD?  Weren't you a Linux guy?\n\nAll: Is there any way you can create an entire episode of BSDnow on hardware that runs OpenBSD and FreeBSD?  We see you audacity, etc on a mac.\nBenedict: Not sure about OpenBSD (don’t use it), but FreeBSD should be doable for my part. If we switch from Skype to a different video chat tool, the rest is already there. Production side may be more difficult, but not impossible.\n\nAll: if you could finish up one project right now... what would it be?\nBenedict: Updated ZFS chapter in the FreeBSD handbook.\n\nAll: How did all of you guys meet?\n\nAll: My question is, do you guys use FreeBSD as your main desktop OS?  If not, what do you use?\nBenedict: No, but Mac OS is close enough. Doing a lot of SSHing into FreeBSD from there.\nAll: Can you all give us the best shot of outside of their windows?\nJT’s answer: https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg\n    Allan: https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA\n    Benedict: No, it’s dark outside anyway. ;-)\n\nAll: How old were you when you got your first computer and what was that computer?\nAllan: 12 or 13, a 486DX2/66hz with an insane 32mb of RAM, 400 and 500 MB SCSI HDDs, 14400 baud model, and a 1.7x CD rom drive\nBenedict: Around 13 or so. 386DX2, 4 MB RAM, IDE disk drive (no idea how big, but it wasn’t much), 3.5” floppy, DOS, and a lot of games.\nJT: Technically the first was a Atari 1200XL with a 6502 CPU running at 1.79 MHz 64KB RAM.  It had it's own OS and you could load programs off of either cartridges, floppy disks, or cassette tapes. First PC Clone was a Packard Bell with a 386 and 1mb ram which later was upgraded to 4mb and a Dual speed CD-ROM.  My dad got me a Compaq 286 laptop... this one (show)... a year or so later because he got tired of fighting me for the computer.\n\nAll: Can we have a peek at your bookcase and what books are there?\nAllan: No picture handy, but my shelf is pretty small, mostly a collection of autographed FreeBSD books. I have D&amp;I with all 3 autographs (took some travel to acquire), and a copy of my first book (FreeBSD Mastery: ZFS) autographed by Jeff Bonwick and Matt Ahrens, the creators of ZFS, plus a bunch of other big names in ZFS like George Wilson.\nJT’s answer: So... my library is packed away... but here’s about half of it... the rest is still in storage. https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg\nSoftware Collection: https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg\nBenedict: A mix of FreeBSD books (by MWL), the graveyard book, 4 hour work week, the once and future king (took me a long time to finish that one), Total Immersion swimming (still learning to swim) and some books in german language, fiction and tech. Groff lives in there while the pandemic lasts.\n\nAll: What desktop/Window Manager/shell do each of you primarily use?\nBenedict: Mainly Mac OS, when on FreeBSD it’s i3. Zsh with zsh-autosuggestions currently.\nJT: Lumina/zsh\nAllan: Lumina and tcsh, want to learn zsh but never gotten time to change\n\nAll: What spoken languages do you speak?\n    Benedict: German and English (obviously), learning a bit of Spanish via Duolingo at the moment\n    JT: English, Bad English, and some French.\nAll: Do you have Non-Computer hobbies if so what are those?\n    Benedict: Tai Chi Chuan (Yang Style)\nJT: I'd say photography, but that's a job for me.  I have a lot of varied interests, Krav Maga, working on my VW Corrado, working on the old Victorian house I bought, and camping/backpacking. Ive done the northern half of the AT (Appalachian Trail, I want to finish it up and then do the PCT and CDT. (Pacific Crest Trail and Continental Divide Trail).\n\nAll: When COVID passes, when are either of you are coming to BSD pizza night in Portland, OR, USA so I can buy you a beer/wine/whisky or pizza/coffee/tea (or six)\n\nRapid Fire:\n\nAll: What was the first car you ever owned?\n\nAll: Do you own a vehicle and if so what is the make/model?\n\nAll: Favorite Star franchise? Star Wars, Star Trek, Stargate, Battlestar, etc.\n\nJT:  Will you ever host any more BSDNow episodes?\n\nAll: Favorite superhero? Marvel and/or DC.\n\nAll: Favorite game(s) of all time?\n\nAll: Pants or no pants on virtual meetings/presentations?\n\nAll: Do you or have you used alternative operating systems that are not \"main stream or is considered retro\" if so what are those?\n\nAll: Who has more animals at home?\n\nAllan: Does Allan have any batteries for his tetris cubes? Can we see that thing light up?\n\nAllan and Benedict:  Are you guys going to go on JT's new show?\n\nIf you’re wondering what show this is, here are the two shows Im a host of:\n\nhttps://www.opensourcevoices.org &amp; https://www.theopiniondominion.org\n\nAllan and Benedict: Have Allan or Benedict lost anything on the way to and from a conference?\n\nBenedict: Is Benedict going to do his NOEL blocks again?\n\nBenedict: Does Benedict make his bed every Wednesday morning?  It always looks great!\nNot just Wednesdays, but pretty much every day. Here, watch this: https://www.youtube.com/watch?v=GKZRFDCbGTA Nuff said. ;-)\nJT: Are you batman because the episodes are always awesome sir so thank you\nJT’s answer: Can you ever admit to being batman?  If I were batman wouldn't I have to deny it?\n\nAll: What's your Daily Driver Hardware?\n\nAll: Who has more servers or VMs at home?\nBenedict: Allan, easily\nJT: Allan definitely beats me with VMs, but I think I might give him a run on servers.  4x 4u HP DL580s, one HP DL980, three HP C3000 8 bay bladecenters, three HP C7000 16 bay Bladecenters, 2x Sun 280R, bunch of Dell and IBM 1Us… but all my stuff is old.  Allan has all the new and shiny stuff.\nThe Pile in the Kitchen: https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg\nThe other pile: https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg\n\nAll: What book(s) are you currently reading?\nBenedict: Antifragile by Nassim Taleb\nJT: Douglas Hofstader - Gödel, Escher, Bach: An Eternal Golden Braid. Douglas Rushkoff - program or be programmed. Also a 4 part book series on the American civil war written in the 1880s, by people in the civil war.\n\nAll: Favorite mechanical keyboard switch? Cherry MX, Kalih, Gateron, etc.\nBenedict: Cherry MX brown currently\n    Allan: Cherry MX Blue (Coolermaster Master Keys Pro-L)\n    JT: I prefer scissor switches, so I use a Logitech K740.\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Interview - Allan Jude - [<a href=\"mailto:Allan.jude@gmail.com\" rel=\"nofollow\">Allan.jude@gmail.com</a>](<a href=\"mailto:Allan.jude@gmail.com\" rel=\"nofollow\">Allan.jude@gmail.com</a>) / <a href=\"https://twitter.com/allanjude\" rel=\"nofollow\">@allanjude</a></h2>\n\n<h2>Interview - Benedict Reuschling - <a href=\"mailto:bcr@freebsd.org\" rel=\"nofollow\">bcr@freebsd.org</a> / <a href=\"https://twitter.com/bsdbcr\" rel=\"nofollow\">@bsdbcr</a></h2>\n\n<h2>Interview - JT Pennington - <a href=\"mailto:jt@obs-sec.com\" rel=\"nofollow\">jt@obs-sec.com</a> / <a href=\"https://twitter.com/q5sys\" rel=\"nofollow\">@q5sys</a></h2>\n\n<h3>AMA questions</h3>\n\n<p>Benedict:  You work at a university right?  Were you already into tech before you started working there?  What do you do there?<br>\nYes, I do work at the University of Applied Sciences, Darmstadt, Germany. I’m a lab engineer there (without a lab, but with a big data cluster). I teach in the winter semester an undergraduate, elective course called “Unix for Developers”. Yes, I was already in tech by that time. Did some previous work at companies before (selling hardware at the call-in hotline and later in the store) and during my CS studies.<br>\nAllan:  What’s the next big FreeBSD Project you plan on doing?</p>\n\n<p>JT:  How did you get involved in BSD?  Weren&#39;t you a Linux guy?</p>\n\n<p>All: Is there any way you can create an entire episode of BSDnow on hardware that runs OpenBSD and FreeBSD?  We see you audacity, etc on a mac.<br>\nBenedict: Not sure about OpenBSD (don’t use it), but FreeBSD should be doable for my part. If we switch from Skype to a different video chat tool, the rest is already there. Production side may be more difficult, but not impossible.</p>\n\n<p>All: if you could finish up one project right now... what would it be?<br>\nBenedict: Updated ZFS chapter in the FreeBSD handbook.</p>\n\n<p>All: How did all of you guys meet?</p>\n\n<p>All: My question is, do you guys use FreeBSD as your main <em>desktop</em> OS?  If not, what do you use?<br>\nBenedict: No, but Mac OS is close enough. Doing a lot of SSHing into FreeBSD from there.<br>\nAll: Can you all give us the best shot of outside of their windows?<br>\nJT’s answer: <a href=\"https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-2LSbspL/0/69437dbb/5K/i-2LSbspL-5K.jpg</a><br>\n    Allan: <a href=\"https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA\" rel=\"nofollow\">https://photos.app.goo.gl/UnKXnKMt6cn8FDhNA</a><br>\n    Benedict: No, it’s dark outside anyway. ;-)</p>\n\n<p>All: How old were you when you got your first computer and what was that computer?<br>\nAllan: 12 or 13, a 486DX2/66hz with an insane 32mb of RAM, 400 and 500 MB SCSI HDDs, 14400 baud model, and a 1.7x CD rom drive<br>\nBenedict: Around 13 or so. 386DX2, 4 MB RAM, IDE disk drive (no idea how big, but it wasn’t much), 3.5” floppy, DOS, and a lot of games.<br>\nJT: Technically the first was a Atari 1200XL with a 6502 CPU running at 1.79 MHz 64KB RAM.  It had it&#39;s own OS and you could load programs off of either cartridges, floppy disks, or cassette tapes. First PC Clone was a Packard Bell with a 386 and 1mb ram which later was upgraded to 4mb and a Dual speed CD-ROM.  My dad got me a Compaq 286 laptop... this one (show)... a year or so later because he got tired of fighting me for the computer.</p>\n\n<p>All: Can we have a peek at your bookcase and what books are there?<br>\nAllan: No picture handy, but my shelf is pretty small, mostly a collection of autographed FreeBSD books. I have D&amp;I with all 3 autographs (took some travel to acquire), and a copy of my first book (FreeBSD Mastery: ZFS) autographed by Jeff Bonwick and Matt Ahrens, the creators of ZFS, plus a bunch of other big names in ZFS like George Wilson.<br>\nJT’s answer: So... my library is packed away... but here’s about half of it... the rest is still in storage. <a href=\"https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-SBG2KDv/0/0b9856b8/4K/i-SBG2KDv-4K.jpg</a><br>\nSoftware Collection: <a href=\"https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-HfTVPN9/0/ad610dd4/O/i-HfTVPN9.jpg</a><br>\nBenedict: A mix of FreeBSD books (by MWL), the graveyard book, 4 hour work week, the once and future king (took me a long time to finish that one), Total Immersion swimming (still learning to swim) and some books in german language, fiction and tech. Groff lives in there while the pandemic lasts.</p>\n\n<p>All: What desktop/Window Manager/shell do each of you primarily use?<br>\nBenedict: Mainly Mac OS, when on FreeBSD it’s i3. Zsh with zsh-autosuggestions currently.<br>\nJT: Lumina/zsh<br>\nAllan: Lumina and tcsh, want to learn zsh but never gotten time to change</p>\n\n<p>All: What spoken languages do you speak?<br>\n    Benedict: German and English (obviously), learning a bit of Spanish via Duolingo at the moment<br>\n    JT: English, Bad English, and some French.<br>\nAll: Do you have Non-Computer hobbies if so what are those?<br>\n    Benedict: Tai Chi Chuan (Yang Style)<br>\nJT: I&#39;d say photography, but that&#39;s a job for me.  I have a lot of varied interests, Krav Maga, working on my VW Corrado, working on the old Victorian house I bought, and camping/backpacking. Ive done the northern half of the AT (Appalachian Trail, I want to finish it up and then do the PCT and CDT. (Pacific Crest Trail and Continental Divide Trail).</p>\n\n<p>All: When COVID passes, when are either of you are coming to BSD pizza night in Portland, OR, USA so I can buy you a beer/wine/whisky or pizza/coffee/tea (or six)</p>\n\n<h3>Rapid Fire:</h3>\n\n<p>All: What was the first car you ever owned?</p>\n\n<p>All: Do you own a vehicle and if so what is the make/model?</p>\n\n<p>All: Favorite Star franchise? Star Wars, Star Trek, Stargate, Battlestar, etc.</p>\n\n<p>JT:  Will you ever host any more BSDNow episodes?</p>\n\n<p>All: Favorite superhero? Marvel and/or DC.</p>\n\n<p>All: Favorite game(s) of all time?</p>\n\n<p>All: Pants or no pants on virtual meetings/presentations?</p>\n\n<p>All: Do you or have you used alternative operating systems that are not &quot;main stream or is considered retro&quot; if so what are those?</p>\n\n<p>All: Who has more animals at home?</p>\n\n<p>Allan: Does Allan have any batteries for his tetris cubes? Can we see that thing light up?</p>\n\n<p>Allan and Benedict:  Are you guys going to go on JT&#39;s new show?</p>\n\n<p>If you’re wondering what show this is, here are the two shows Im a host of:</p>\n\n<p><a href=\"https://www.opensourcevoices.org\" rel=\"nofollow\">https://www.opensourcevoices.org</a> &amp; <a href=\"https://www.theopiniondominion.org\" rel=\"nofollow\">https://www.theopiniondominion.org</a></p>\n\n<p>Allan and Benedict: Have Allan or Benedict lost anything on the way to and from a conference?</p>\n\n<p>Benedict: Is Benedict going to do his NOEL blocks again?</p>\n\n<p>Benedict: Does Benedict make his bed every Wednesday morning?  It always looks great!<br>\nNot just Wednesdays, but pretty much every day. Here, watch this: <a href=\"https://www.youtube.com/watch?v=GKZRFDCbGTA\" rel=\"nofollow\">https://www.youtube.com/watch?v=GKZRFDCbGTA</a> Nuff said. ;-)<br>\nJT: Are you batman because the episodes are always awesome sir so thank you<br>\nJT’s answer: Can you ever admit to being batman?  If I were batman wouldn&#39;t I have to deny it?</p>\n\n<p>All: What&#39;s your Daily Driver Hardware?</p>\n\n<p>All: Who has more servers or VMs at home?<br>\nBenedict: Allan, easily<br>\nJT: Allan definitely beats me with VMs, but I think I might give him a run on servers.  4x 4u HP DL580s, one HP DL980, three HP C3000 8 bay bladecenters, three HP C7000 16 bay Bladecenters, 2x Sun 280R, bunch of Dell and IBM 1Us… but all my stuff is old.  Allan has all the new and shiny stuff.<br>\nThe Pile in the Kitchen: <a href=\"https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-HBScrpk/0/4b058cc5/X2/i-HBScrpk-X2.jpg</a><br>\nThe other pile: <a href=\"https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-wNxFszV/0/e7a4b2d6/X2/i-wNxFszV-X2.jpg</a></p>\n\n<p>All: What book(s) are you currently reading?<br>\nBenedict: Antifragile by Nassim Taleb<br>\nJT: Douglas Hofstader - Gödel, Escher, Bach: An Eternal Golden Braid. Douglas Rushkoff - program or be programmed. Also a 4 part book series on the American civil war written in the 1880s, by people in the civil war.</p>\n\n<p>All: Favorite mechanical keyboard switch? Cherry MX, Kalih, Gateron, etc.<br>\nBenedict: Cherry MX brown currently<br>\n    Allan: Cherry MX Blue (Coolermaster Master Keys Pro-L)<br>\n    JT: I prefer scissor switches, so I use a Logitech K740.</p>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"We asked for it, you answered our call. This episode features you interviewing us with questions that you sent in. JT, Allan, and Benedict answer everything that you ever wanted to know in this week’s special episode of BSDNow.","date_published":"2020-12-24T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34202bd5-f96c-4d8a-9e18-5a8eb3c26e56.mp3","mime_type":"audio/mpeg","size_in_bytes":63242832,"duration_in_seconds":4011}]},{"id":"51b9f9e5-6af6-41d0-9e2a-01b51b1c6399","title":"381: Shell origins","url":"https://www.bsdnow.tv/381","content_text":"The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nThe Origin of the Shell\n\n\nCTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote \"RUNCOM\", a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.\n\n\n\n\nReturn to Plan 9\n\n\nPlan 9 from Bell Labs has held the same charm after my last visit that took a few days. This time I'll keep this operating system in an emulator where I can explore into it when I am distracted.\n\n\n\n\nNews Roundup\n\nWhy a new BSD?\n\n\nThis article is to explain some decisions and plans made by the ArisbluBSD team, why we are making our own thing, and what the plan is for the OS. We mainly want to talk about five things: desktop, package management, software availability, custom software, and the future of the OS. We mostly want to explain what the goal of the OS is, and how we plan to expand in the near future. Without further ado, let's explain ArisbluBSD's plan.\n\n\n\n\nOPNsense 20.7.5 released\n\n\nWe return briefly for a small patch set and plan to pin the 20.1 upgrade path to this particular version to avoid unnecessary stepping stones. We wish you all a healthy Friday. And of course: patch responsibly!\n\n\n\nMidnight BSD 2.0 Release Status\n\nWe identified some issues with the 2.0 ISOs slated for release with the ZFS bootloader not working. \nUntil this issue is resolved, we are unable to build release ISOs. We've left the old ones up as they work fine for anyone using UFS.\n\n\n\nHardenedBSD November 2020 Status Report\n\nWe're getting close to the end of November. My wife and I have plans this weekend, so I thought I'd take the time to write November's status report today.\n\n\n\n\nBeastie Bits\n\n• [rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.](https://phiresky.github.io/blog/2019/rga--ripgrep-for-zip-targz-docx-odt-epub-jpg/)\n• [exa - A modern replacement for ls](https://the.exa.website/)\n• [The myriad meanings of pwd in Unix systems](https://qmacro.org/2020/11/08/the-meaning-of-pwd-in-unix-systems/)\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKarl - Camera Help\nAlejandro - domain registrar\nJohnny - thoughts on 372\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://multicians.org/shell.html\" rel=\"nofollow\">The Origin of the Shell</a></h3>\n\n<blockquote>\n<p>CTSS was developed during 1963 and 64. I was at MIT on the computer center staff at that time. After having written dozens of commands for CTSS, I reached the stage where I felt that commands should be usable as building blocks for writing more commands, just like subroutine libraries. Hence, I wrote &quot;RUNCOM&quot;, a sort of shell driving the execution of command scripts, with argument substitution. The tool became instantly most popular, as it became possible to go home in the evening while leaving behind long runcoms executing overnight. It was quite neat for boring and repetitive tasks such as renaming, moving, updating, compiling, etc. whole directories of files for system and application maintenance and monitoring.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://boxbase.org/entries/2020/nov/1/return-to-plan9/\" rel=\"nofollow\">Return to Plan 9</a></h3>\n\n<blockquote>\n<p>Plan 9 from Bell Labs has held the same charm after my last visit that took a few days. This time I&#39;ll keep this operating system in an emulator where I can explore into it when I am distracted.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.fivnex.co/2020/11/arisblubsd-why-new-bsd.html\" rel=\"nofollow\">Why a new BSD?</a></h3>\n\n<blockquote>\n<p>This article is to explain some decisions and plans made by the ArisbluBSD team, why we are making our own thing, and what the plan is for the OS. We mainly want to talk about five things: desktop, package management, software availability, custom software, and the future of the OS. We mostly want to explain what the goal of the OS is, and how we plan to expand in the near future. Without further ado, let&#39;s explain ArisbluBSD&#39;s plan.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-7-5-released/\" rel=\"nofollow\">OPNsense 20.7.5 released</a></h3>\n\n<blockquote>\n<p>We return briefly for a small patch set and plan to pin the 20.1 upgrade path to this particular version to avoid unnecessary stepping stones. We wish you all a healthy Friday. And of course: patch responsibly!</p>\n\n<hr>\n\n<h3><a href=\"https://www.justjournal.com/users/mbsd/entry/33841\" rel=\"nofollow\">Midnight BSD 2.0 Release Status</a></h3>\n\n<p>We identified some issues with the 2.0 ISOs slated for release with the ZFS bootloader not working. <br>\nUntil this issue is resolved, we are unable to build release ISOs. We&#39;ve left the old ones up as they work fine for anyone using UFS.</p>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-11-25/hardenedbsd-november-2020-status-report\" rel=\"nofollow\">HardenedBSD November 2020 Status Report</a></h3>\n\n<p>We&#39;re getting close to the end of November. My wife and I have plans this weekend, so I thought I&#39;d take the time to write November&#39;s status report today.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<pre><code>• [rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.](https://phiresky.github.io/blog/2019/rga--ripgrep-for-zip-targz-docx-odt-epub-jpg/)\n• [exa - A modern replacement for ls](https://the.exa.website/)\n• [The myriad meanings of pwd in Unix systems](https://qmacro.org/2020/11/08/the-meaning-of-pwd-in-unix-systems/)\n</code></pre>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Karl%20-%20camera%20help.md\" rel=\"nofollow\">Karl - Camera Help</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/alejandro%20-%20domain%20registrar.md\" rel=\"nofollow\">Alejandro - domain registrar</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/381/feedback/Johnny%20-%20thoughts%20on%20372\" rel=\"nofollow\">Johnny - thoughts on 372</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"The Origin of the Shell, Return to Plan 9, ArisbluBSD: Why a new BSD?, OPNsense 20.7.5 released, Midnight BSD 2.0 Release Status, HardenedBSD November 2020 Status Report, and more.","date_published":"2020-12-17T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/51b9f9e5-6af6-41d0-9e2a-01b51b1c6399.mp3","mime_type":"audio/mpeg","size_in_bytes":39764064,"duration_in_seconds":2517}]},{"id":"ee24cdc7-bb47-400d-8be0-968efefa4e15","title":"380: Early ZFS-mas","url":"https://www.bsdnow.tv/380","content_text":"We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\n3rd Quarter FreeBSD Report\n\n\nThe call for submissions for the 4th Quarter is out\n\n\n\n\nOpenZFS 2.0\n\n\nThis Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between \"ZFS on Linux\" and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.\n\n\n\n\nNews Roundup\n\nRevision 367034\n\n\nVarious new check-hash checks have been added to the UFS filesystem\nover various major releases. Superblock check hashes were added for\nthe 12 release and cylinder-group and inode check hashes will appear\nin the 13 release.\n\n\n\nOpenSSL 3.0 /dev/crypto issues on FreeBSD\n\nSo, just learned that the OpenSSL devs decided to break /dev/crypto on FreeBSD.\n\n\n\n\nOS108-9.1 XFCE amd64 released\n\n\nOS108 is a fast, open and Secure Desktop Operating System built on top of NetBSD.\n&gt; Installing OS108 to your hard drive is done by using the sysinst utility, the process is basically the same as installing NetBSD itself.  Please refer to the NetBSD guide for installation details, http://www.netbsd.org/docs/guide/en/part-install.html\nInstallation Video\n***\n\n\nBeastie Bits\n\n\nOpenBGPD 6.8p1 portable: released Nov 5th, 2020\nIRC Awk Bot\nDocker on FreeBSD using bhyve and sshfs\nThe UNIX Command Language (1976)\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nsanti - openrc\ntrond - python2 and mailman\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2020-07-2020-09.html\" rel=\"nofollow\">3rd Quarter FreeBSD Report</a></h3>\n\n<blockquote>\n<p><a href=\"https://lists.freebsd.org/pipermail/freebsd-quarterly-calls/2020/000007.html\" rel=\"nofollow\">The call for submissions for the 4th Quarter is out</a></p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://arstechnica.com/gadgets/2020/12/openzfs-2-0-release-unifies-linux-bsd-and-adds-tons-of-new-features/\" rel=\"nofollow\">OpenZFS 2.0</a></h3>\n\n<blockquote>\n<p>This Monday, ZFS on Linux lead developer Brian Behlendorf published the OpenZFS 2.0.0 release to GitHub. Along with quite a lot of new features, the announcement brings an end to the former distinction between &quot;ZFS on Linux&quot; and ZFS elsewhere (for example, on FreeBSD). This move has been a long time coming—the FreeBSD community laid out its side of the roadmap two years ago—but this is the release that makes it official.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://svnweb.freebsd.org/changeset/base/367034\" rel=\"nofollow\">Revision 367034</a></h3>\n\n<blockquote>\n<p>Various new check-hash checks have been added to the UFS filesystem<br>\nover various major releases. Superblock check hashes were added for<br>\nthe 12 release and cylinder-group and inode check hashes will appear<br>\nin the 13 release.</p>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/openssl-3-written-to-break-on-freebsd/\" rel=\"nofollow\">OpenSSL 3.0 /dev/crypto issues on FreeBSD</a></h3>\n\n<p>So, just learned that the OpenSSL devs decided to break /dev/crypto on FreeBSD.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://forums.os108.org/d/32-os108-91-xfce-amd64-released\" rel=\"nofollow\">OS108-9.1 XFCE amd64 released</a></h3>\n\n<ul>\n<li>OS108 is a fast, open and Secure Desktop Operating System built on top of NetBSD.\n&gt; Installing OS108 to your hard drive is done by using the sysinst utility, the process is basically the same as installing NetBSD itself.  Please refer to the NetBSD guide for installation details, <a href=\"http://www.netbsd.org/docs/guide/en/part-install.html\" rel=\"nofollow\">http://www.netbsd.org/docs/guide/en/part-install.html</a></li>\n<li><a href=\"https://youtu.be/cgAeY21gXR4\" rel=\"nofollow\">Installation Video</a>\n***</li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://www.openbgpd.org/ftp.html\" rel=\"nofollow\">OpenBGPD 6.8p1 portable: released Nov 5th, 2020</a></li>\n<li><a href=\"http://kflu.github.io/2020/08/15/2020-08-15-awk-irc-bot/\" rel=\"nofollow\">IRC Awk Bot</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=ZVkJZJEdZNY\" rel=\"nofollow\">Docker on FreeBSD using bhyve and sshfs</a></li>\n<li><a href=\"https://github.com/susam/tucl\" rel=\"nofollow\">The UNIX Command Language (1976)</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/santi%20-%20openrc.md\" rel=\"nofollow\">santi - openrc</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/380/feedback/trond%20-%20python2%20and%20mailmane%20and%20sshfs\" rel=\"nofollow\">trond - python2 and mailman</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"We read FreeBSD’s 3rd quarter status report, OpenZFS 2.0, adding check-hash checks in UFS filesystem, OpenSSL 3.0 /dev/crypto issues on FreeBSD, and more.","date_published":"2020-12-10T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ee24cdc7-bb47-400d-8be0-968efefa4e15.mp3","mime_type":"audio/mpeg","size_in_bytes":43761336,"duration_in_seconds":2639}]},{"id":"4957b8e6-e7da-4f6d-8bbb-3b52c33c959f","title":"379: bhyve my guest","url":"https://www.bsdnow.tv/379","content_text":"Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nAdventures in Freebernetes: bhyve My Guest\n\n\nPart 2 of experiments in FreeBSD and Kubernetes: Creating your first guest\n\n\n\n\nTracing Kernel Functions: FBT stack() and arg\n\n\nIn my previous post I described how FBT intercepts function calls and vectors them into the DTrace framework. That laid the foundation for what I want to discuss in this post: the implementation of the stack() action and built-in arg variables. These features rely on the precise layout of the stack, the details of which I touched on previously. In this post I hope to illuminate those details a bit more with the help of some visuals, and then guide you through the implementation of these two DTrace features as they relate to the FBT provider.\n\n\n\n\nNews Roundup\n\nDummynet: The Better Way of Building FreeBSD Networks\n\n\nDummynet is the FreeBSD traffic shaper, packet scheduler, and network emulator. Dummynet allows you to emulate a whole set of network environments in a straight-forward way. It has the ability to model delay, packet loss, and can act as a traffic shaper and policer. Dummynet is roughly equivalent to netem in Linux, but we have found that dummynet is easier to integrate and provides much more consistent results.  \n\n\n\n\nNew beginnings: CDBUG virtual meetings\n\n\nI had overwhelmingly positive responses from the broader *BSD community about restarting CDBUG meetings as virtual, at least for now. Hopefully this works well and even when we're back to in-person meetings we can still find a way to bring in virtual attendees.\n\n\n\n\nLibreSSL update in DragonFly\n\n\nDragonFly has a new version of libressl,  noting cause it has a newer TLS1.3 implementation – something that may be necessary for you.\n\n\n\n\nSignal-cli with scli on FreeBSD\n\n\nSo couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.\n\n\n\n\nBeastie Bits\n\n\nFirefox is not paxctl safe for NetBSD\nFreeBSD 12.2-RELEASE on Microsoft Azure Marketplace\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\ncarlos - BSD Now around the world\npaulo - freebsd on a Bananapi\n\n\npaulo - followup\n\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://productionwithscissors.run/2020/10/29/adventures-in-freebernetes-bhyve-my-guest/\" rel=\"nofollow\">Adventures in Freebernetes: bhyve My Guest</a></h3>\n\n<blockquote>\n<p>Part 2 of experiments in FreeBSD and Kubernetes: Creating your first guest</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://zinascii.com/2020/fbt-args-and-stack.html?s=03\" rel=\"nofollow\">Tracing Kernel Functions: FBT stack() and arg</a></h3>\n\n<blockquote>\n<p>In my previous post I described how FBT intercepts function calls and vectors them into the DTrace framework. That laid the foundation for what I want to discuss in this post: the implementation of the stack() action and built-in arg variables. These features rely on the precise layout of the stack, the details of which I touched on previously. In this post I hope to illuminate those details a bit more with the help of some visuals, and then guide you through the implementation of these two DTrace features as they relate to the FBT provider.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/dummynet-the-better-way-of-building-freebsd-networks/\" rel=\"nofollow\">Dummynet: The Better Way of Building FreeBSD Networks</a></h3>\n\n<blockquote>\n<p>Dummynet is the FreeBSD traffic shaper, packet scheduler, and network emulator. Dummynet allows you to emulate a whole set of network environments in a straight-forward way. It has the ability to model delay, packet loss, and can act as a traffic shaper and policer. Dummynet is roughly equivalent to netem in Linux, but we have found that dummynet is easier to integrate and provides much more consistent results.  </p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"http://lists.nycbug.org/pipermail/cdbug-talk/2020-October/000901.html\" rel=\"nofollow\">New beginnings: CDBUG virtual meetings</a></h3>\n\n<blockquote>\n<p>I had overwhelmingly positive responses from the broader *BSD community about restarting CDBUG meetings as virtual, at least for now. Hopefully this works well and even when we&#39;re back to in-person meetings we can still find a way to bring in virtual attendees.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.dragonflydigest.com/2020/11/10/25143.html\" rel=\"nofollow\">LibreSSL update in DragonFly</a></h3>\n\n<blockquote>\n<p>DragonFly has a new version of libressl,  noting cause it has a newer TLS1.3 implementation – something that may be necessary for you.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://antranigv.am/weblog_en/posts/freebsd-signal-cli-scli/\" rel=\"nofollow\">Signal-cli with scli on FreeBSD</a></h3>\n\n<blockquote>\n<p>So couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://anonhg.netbsd.org/pkgsrc/rev/9386adbd052e\" rel=\"nofollow\">Firefox is not paxctl safe for NetBSD</a></li>\n<li><a href=\"https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_2?tab=Overview\" rel=\"nofollow\">FreeBSD 12.2-RELEASE on Microsoft Azure Marketplace</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/carlos%20-%20BSD%20Now%20around%20the%20world.md\" rel=\"nofollow\">carlos - BSD Now around the world</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20freebsd%20on%20a%20Bananapi.md\" rel=\"nofollow\">paulo - freebsd on a Bananapi</a>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/379/feedback/paulo%20-%20followup.md\" rel=\"nofollow\">paulo - followup</a></li>\n</ul></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Adventures in Freebernetes, tracing kernel functions, The better way of building FreeBSD networks, New beginnings: CDBUG virtual meetings, LibreSSL update in DragonFly, Signal-cli with scli on FreeBSD, and more.","date_published":"2020-12-03T06:45:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4957b8e6-e7da-4f6d-8bbb-3b52c33c959f.mp3","mime_type":"audio/mpeg","size_in_bytes":37714488,"duration_in_seconds":2239}]},{"id":"5d96e357-c800-4037-bc9d-3251ca0b1cd0","title":"378: Networknomicon","url":"https://www.bsdnow.tv/378","content_text":"Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nInterview with Michael W. Lucas\n\n\nSNMP Book\nThe Networknomicon\nSponsor the TLS Book\nCashflow for creators\nBook sale\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Michael W Lucas.","content_html":"<p>Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3>Interview with Michael W. Lucas</h3>\n\n<blockquote>\n<p><a href=\"https://mwl.io/nonfiction/networking#snmp\" rel=\"nofollow\">SNMP Book</a><br>\n<a href=\"https://mwl.io/nonfiction/networking#networknomicon\" rel=\"nofollow\">The Networknomicon</a><br>\n<a href=\"https://www.tiltedwindmillpress.com/product-category/sponsor/\" rel=\"nofollow\">Sponsor the TLS Book</a><br>\n<a href=\"https://mwl.io/nonfiction/biz-craft\" rel=\"nofollow\">Cashflow for creators</a><br>\n<a href=\"https://mwl.io/blog/9313\" rel=\"nofollow\">Book sale</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n</blockquote>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Michael W Lucas.</p>","summary":"Interview with Michael W. Lucas: SNMP and TLS book, cashflow for creators, book sale and more. ","date_published":"2020-11-26T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5d96e357-c800-4037-bc9d-3251ca0b1cd0.mp3","mime_type":"audio/mpeg","size_in_bytes":55682424,"duration_in_seconds":3380}]},{"id":"610cb191-462b-4968-a1ae-01d1aebf93ba","title":"377: Firewall ban-sharing","url":"https://www.bsdnow.tv/377","content_text":"History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nHistory of FreeBSD : Part 2 : BSDi and USL Lawsuits\n\n\nIn this second part of our series on the history of FreeBSD, we continue to trace the pre-history of FreeBSD and the events that would eventually shape the project and the future of open source software. \n\n\n\n\nBuilding a Web Site on Google Compute Engine\n\n\nHere's how I deployed a web site to the Google Cloud Platform. I used FreeBSD for good performance, stability, and minimal complexity. I set up HTTPS with free Let's Encrypt TLS certificates for both RSA and ECC. Then I adjusted the Apache configuration for a good score from the authoritative Qualys server analysis.\n\n\n\n\nNews Roundup\n\nFirewall ban-sharing across machines\n\n\nAs described in My infrastructure as of 2019, my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won't get to try one machine after another.\n\n\n\nOpenVPN as default gateway on OpenBSD\n\nIf you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the egress group, and use tun0 in your pf.conf which is loaded before OpenVPN starts?\nHere are the few tips I use to solve the problems.\n\n\n\nSorting out what the Single Unix Specification is and covers\n\nSorting out what the Single Unix Specification is and covers\nOctober 8, 2020\nI've linked to the Single Unix Specification any number of times, for various versions of it (when I first linked to it, it was at issue 6, in 2006; it's now up to a 2018 edition). But I've never been quite clear what it covered and didn't cover, and how it related to POSIX and similar things. After yesterday's entry got me looking at the SuS site again, I decided to try to sort this out once and for all.\n\n\n\nBye-bye, Apple\n\nThe days of Apple products are behind me. I had been developing on a Macbook for over twelve years, but now, I’ve switched to an ever trending setup: OpenBSD on a Thinkpad.\nThe new platform is a winner. Everything is clean, quick, and configurable. When I ps uaxww, I’m not hogging ‘gigs’ of RAM just to have things up and running. There’s no black magic that derails me at every turn. In short, my sanity has been long restored.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChris - small projects\nJens - ZFS Question\n\n\nOne pool to rule them all\n\nShroyer - Dotnet on FreeBSD for Jellyfin\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/history-of-freebsd-part-2-bsdi-and-usl-lawsuits/\" rel=\"nofollow\">History of FreeBSD : Part 2 : BSDi and USL Lawsuits</a></h3>\n\n<blockquote>\n<p>In this second part of our series on the history of FreeBSD, we continue to trace the pre-history of FreeBSD and the events that would eventually shape the project and the future of open source software. </p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://cromwell-intl.com/open-source/google-freebsd-tls/\" rel=\"nofollow\">Building a Web Site on Google Compute Engine</a></h3>\n\n<blockquote>\n<p>Here&#39;s how I deployed a web site to the Google Cloud Platform. I used FreeBSD for good performance, stability, and minimal complexity. I set up HTTPS with free Let&#39;s Encrypt TLS certificates for both RSA and ECC. Then I adjusted the Apache configuration for a good score from the authoritative Qualys server analysis.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://chown.me/blog/acacia\" rel=\"nofollow\">Firewall ban-sharing across machines</a></h3>\n\n<blockquote>\n<p>As described in My infrastructure as of 2019, my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won&#39;t get to try one machine after another.</p>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-10-27-openbsd-openvpn.html\" rel=\"nofollow\">OpenVPN as default gateway on OpenBSD</a></h3>\n\n<p>If you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the egress group, and use tun0 in your pf.conf which is loaded before OpenVPN starts?<br>\nHere are the few tips I use to solve the problems.</p>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/SingleUnixSpecificationWhat\" rel=\"nofollow\">Sorting out what the Single Unix Specification is and covers</a></h3>\n\n<p>Sorting out what the Single Unix Specification is and covers<br>\nOctober 8, 2020<br>\nI&#39;ve linked to the Single Unix Specification any number of times, for various versions of it (when I first linked to it, it was at issue 6, in 2006; it&#39;s now up to a 2018 edition). But I&#39;ve never been quite clear what it covered and didn&#39;t cover, and how it related to POSIX and similar things. After yesterday&#39;s entry got me looking at the SuS site again, I decided to try to sort this out once and for all.</p>\n\n<hr>\n\n<h3><a href=\"http://blog.cretaria.com/posts/bye-bye-apple.html\" rel=\"nofollow\">Bye-bye, Apple</a></h3>\n\n<p>The days of Apple products are behind me. I had been developing on a Macbook for over twelve years, but now, I’ve switched to an ever trending setup: OpenBSD on a Thinkpad.<br>\nThe new platform is a winner. Everything is clean, quick, and configurable. When I ps uaxww, I’m not hogging ‘gigs’ of RAM just to have things up and running. There’s no black magic that derails me at every turn. In short, my sanity has been long restored.</p>\n</blockquote>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Chris%20-%20small%20projects.md\" rel=\"nofollow\">Chris - small projects</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Jens%20-%20ZFS%20Question.md\" rel=\"nofollow\">Jens - ZFS Question</a>\n\n<ul>\n<li><a href=\"https://ftfl.ca/blog/2016-09-17-zfs-fde-one-pool-conversion.html\" rel=\"nofollow\">One pool to rule them all</a></li>\n</ul></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/377/feedback/Shroyer%20-%20Dotnet%20on%20FreeBSD%20for%20Jellyfin.md\" rel=\"nofollow\">Shroyer - Dotnet on FreeBSD for Jellyfin</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"History of FreeBD: BSDi and USL Lawsuits, Building a Website on Google Compute Engine, Firewall ban-sharing across machines, OpenVPN as default gateway on OpenBSD, Sorting out what the Single Unix Specification is, Switching from Apple to a Thinkpad for development, and more","date_published":"2020-11-19T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/610cb191-462b-4968-a1ae-01d1aebf93ba.mp3","mime_type":"audio/mpeg","size_in_bytes":46483632,"duration_in_seconds":2887}]},{"id":"f32e4d71-13e3-4cfa-a98d-c3806ac0c665","title":"376: Build stable packages","url":"https://www.bsdnow.tv/376","content_text":"FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD 12.2 Release\n\n\nThe release notes for FreeBSD 12.2-RELEASE contain a summary of the changes made to the FreeBSD base system on the 12-STABLE development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented.\n\n\n\nZFS Webinar: November 18th\n\nJoin us on November 18th for a live discussion with Allan Jude (VP of Engineering at Klara Inc) in this webinar centred on “best practices of ZFS”\nBuilding Your Storage Array – Everything from picking the best hardware to RAID-Z and using mirrors.\nKeeping up with Data Growth – Expanding and growing your pool, and of course, shrinking with device evacuation.\nDatasets and Properties – Controlling settings with properties and many other tricks!\n\n\n\n\nNews Roundup\n\nGoogle Summer of Code 2020: [Final Report] Enhancing Syzkaller support for NetBSD\n\n\nSys2syz would give an extra edge to Syzkaller for NetBSD. It has a potential of efficiently automating the conversion of syscall definitions to syzkaller’s grammar. This can aid in increasing the number of syscalls covered by Syzkaller significantly with the minimum possibility of manual errors. Let’s delve into its internals.\n\n\n\n\nHow the OpenBSD -stable packages are built\n\n\nIn this long blog post, I will write about the technical details of the OpenBSD stable packages building infrastructure. I have setup the infrastructure with the help of Theo De Raadt who provided me the hardware in summer 2019, since then, OpenBSD users can upgrade their packages using pkg_add -u for critical updates that has been backported by the contributors. Many thanks to them, without their work there would be no packages to build. Thanks to pea@ who is my backup for operating this infrastructure in case something happens to me.\n\n\n\n\nOPNsense 20.7.4 released\n\n\nThis release finally wraps up the recent Netmap kernel changes and tests.\nThe Realtek vendor driver was updated as well as third party software cURL,\nlibxml2, OpenSSL, PHP, Suricata, Syslog-ng and Unbound just to name a couple\nof them.\n\n\n\n\nBeastie Bits\n\n\nBinutils and linker changes\n28 Years of NetBSD contributions\nBluetooth Audio on OpenBSD\nK8s Bhyve\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nSean - C Flags\nThierry - RPI ZFS question\n\n\nThierry's script\n***\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/12.2R/relnotes.html\" rel=\"nofollow\">FreeBSD 12.2 Release</a></h3>\n\n<blockquote>\n<p>The release notes for FreeBSD 12.2-RELEASE contain a summary of the changes made to the FreeBSD base system on the 12-STABLE development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the FreeBSD kernel and userland. Some brief remarks on upgrading are also presented.</p>\n\n<hr>\n\n<h3><a href=\"https://klarasystems.com/learning/best-practices-for-optimizing-zfs1/\" rel=\"nofollow\">ZFS Webinar: November 18th</a></h3>\n\n<p>Join us on November 18th for a live discussion with Allan Jude (VP of Engineering at Klara Inc) in this webinar centred on “best practices of ZFS”<br>\nBuilding Your Storage Array – Everything from picking the best hardware to RAID-Z and using mirrors.<br>\nKeeping up with Data Growth – Expanding and growing your pool, and of course, shrinking with device evacuation.<br>\nDatasets and Properties – Controlling settings with properties and many other tricks!</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/google_summer_of_code_20202\" rel=\"nofollow\">Google Summer of Code 2020: [Final Report] Enhancing Syzkaller support for NetBSD</a></h3>\n\n<blockquote>\n<p>Sys2syz would give an extra edge to Syzkaller for NetBSD. It has a potential of efficiently automating the conversion of syscall definitions to syzkaller’s grammar. This can aid in increasing the number of syscalls covered by Syzkaller significantly with the minimum possibility of manual errors. Let’s delve into its internals.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-10-29-official-openbsd-stable-architecture.html\" rel=\"nofollow\">How the OpenBSD -stable packages are built</a></h3>\n\n<blockquote>\n<p>In this long blog post, I will write about the technical details of the OpenBSD stable packages building infrastructure. I have setup the infrastructure with the help of Theo De Raadt who provided me the hardware in summer 2019, since then, OpenBSD users can upgrade their packages using pkg_add -u for critical updates that has been backported by the contributors. Many thanks to them, without their work there would be no packages to build. Thanks to pea@ who is my backup for operating this infrastructure in case something happens to me.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-7-4-released/\" rel=\"nofollow\">OPNsense 20.7.4 released</a></h3>\n\n<blockquote>\n<p>This release finally wraps up the recent Netmap kernel changes and tests.<br>\nThe Realtek vendor driver was updated as well as third party software cURL,<br>\nlibxml2, OpenSSL, PHP, Suricata, Syslog-ng and Unbound just to name a couple<br>\nof them.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/11/03/25120.html\" rel=\"nofollow\">Binutils and linker changes</a></li>\n<li><a href=\"https://github.com/NetBSD/src/graphs/contributors\" rel=\"nofollow\">28 Years of NetBSD contributions</a></li>\n<li><a href=\"https://ifconfig.se/bluetooth-audio-openbsd.html\" rel=\"nofollow\">Bluetooth Audio on OpenBSD</a></li>\n<li><a href=\"https://k8s-bhyve.convectix.com\" rel=\"nofollow\">K8s Bhyve</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Sean%20-%20C%20Flags.md\" rel=\"nofollow\">Sean - C Flags</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/Thierry%20-%20RPI%20ZFS%20question.md\" rel=\"nofollow\">Thierry - RPI ZFS question</a>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/376/feedback/script.md\" rel=\"nofollow\">Thierry&#39;s script</a>\n***</li>\n</ul></li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD 12.2 is available, ZFS Webinar, Enhancing Syzkaller support for NetBSD, how the OpenBSD -stable packages are built, OPNsense 20.7.4 released, and more","date_published":"2020-11-12T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f32e4d71-13e3-4cfa-a98d-c3806ac0c665.mp3","mime_type":"audio/mpeg","size_in_bytes":45514920,"duration_in_seconds":2780}]},{"id":"66a4f529-c2fb-4a8e-83db-9f6cd6ff0809","title":"375: Virtually everything","url":"https://www.bsdnow.tv/375","content_text":"bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nbhyve - The FreeBSD Hypervisor\n\n\nFreeBSD has had varying degrees of support as a hypervisor host throughout its history. For a time during the mid-2000s, VMWare Workstation 3.x could be made to run under FreeBSD’s Linux Emulation, and Qemu was ported in 2004, and later the kQemu accelerator in 2005. Then in 2009 a port for VirtualBox was introduced. All of these solutions suffered from being a solution designed for a different operating system and then ported to FreeBSD, requiring constant maintenance.\n\n\n\nZFS and FreeBSD Support\n\nKlara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure. Get a world class team of experts to back you up. Check it out on our website!\n\n\nudf info leak\n\n\nFreeBSD UDF driver info leak\nAnalysis done on FreeBSD release 11.0 because that's what I had around.\n\n\nFix committed to FreeBSD\n***\n\n\n\nNews Roundup\n\nI'm now a user of Vim, not classical Vi (partly because of windows)\n\n\nIn the past I've written entries (such as this one) where I said that I was pretty much a Vi user, not really a Vim user, because I almost entirely stuck to Vi features. In a comment on my entry on not using and exploring Vim features, rjc reinforced this, saying that I seemed to be using vi instead of vim (and that there was nothing wrong with this). For a long time I thought this way myself, but these days this is not true any more. These days I really want Vim, not classical Vi.\n\n\n\nFreeBSD on ESXi ARM Fling: Fixing Virtual Hardware\n\nWith the current state of FreeBSD on ARM in general, a number of hardware drivers are either set to not auto-load on boot, or are entirely missing altogether. This page is to document my findings with various bits of hardware, and if possible, list fixes.\n\n\n\nIntroduction of a new FreeBSD Remote Process Plugin in LLDB\n\nMoritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are writing a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.\n\n\n\n\nOpenBSD Laptop\n\n\nHi, I know it’s been a while. I recently had to nuke and re-pave my personal laptop and I thought it would be a nice thing to share with the community how I set up OpenBSD on it so that I have a useful, modern, secure environment for getting work done. I’m not going to say I’m the expert on this or that this is the BEST way to set up OpenBSD, but I thought it would be worthwhile for folks doing Google searches to at least get my opinion on this. So, given that, let’s go…\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nEthan - Linux user wanting to try out OpenBSD\niian - Learning IT\njohnny - bsd swag\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/bhyve-the-freebsd-hypervisor/\" rel=\"nofollow\">bhyve - The FreeBSD Hypervisor</a></h3>\n\n<blockquote>\n<p>FreeBSD has had varying degrees of support as a hypervisor host throughout its history. For a time during the mid-2000s, VMWare Workstation 3.x could be made to run under FreeBSD’s Linux Emulation, and Qemu was ported in 2004, and later the kQemu accelerator in 2005. Then in 2009 a port for VirtualBox was introduced. All of these solutions suffered from being a solution designed for a different operating system and then ported to FreeBSD, requiring constant maintenance.</p>\n\n<hr>\n\n<h3>ZFS and FreeBSD Support</h3>\n\n<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure. Get a world class team of experts to back you up. <a href=\"https://klarasystems.com/support/\" rel=\"nofollow\">Check it out on our website!</a></p>\n</blockquote>\n\n<h3><a href=\"https://gist.github.com/CTurt/a00fb4164e13342567830b052aaed94b\" rel=\"nofollow\">udf info leak</a></h3>\n\n<blockquote>\n<p>FreeBSD UDF driver info leak<br>\nAnalysis done on FreeBSD release 11.0 because that&#39;s what I had around.</p>\n\n<ul>\n<li><a href=\"https://svnweb.freebsd.org/changeset/base/366005\" rel=\"nofollow\">Fix committed to FreeBSD</a>\n***</li>\n</ul>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/VimNowAUser\" rel=\"nofollow\">I&#39;m now a user of Vim, not classical Vi (partly because of windows)</a></h3>\n\n<blockquote>\n<p>In the past I&#39;ve written entries (such as this one) where I said that I was pretty much a Vi user, not really a Vim user, because I almost entirely stuck to Vi features. In a comment on my entry on not using and exploring Vim features, rjc reinforced this, saying that I seemed to be using vi instead of vim (and that there was nothing wrong with this). For a long time I thought this way myself, but these days this is not true any more. These days I really want Vim, not classical Vi.</p>\n\n<hr>\n\n<h3><a href=\"https://vincerants.com/freebsd-on-esxi-arm-fling-fixing-virtual-hardware/\" rel=\"nofollow\">FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware</a></h3>\n\n<p>With the current state of FreeBSD on ARM in general, a number of hardware drivers are either set to not auto-load on boot, or are entirely missing altogether. This page is to document my findings with various bits of hardware, and if possible, list fixes.</p>\n\n<hr>\n\n<h3><a href=\"https://www.moritz.systems/blog/introduction-of-a-new-freebsd-remote-process-plugin-in-lldb/\" rel=\"nofollow\">Introduction of a new FreeBSD Remote Process Plugin in LLDB</a></h3>\n\n<p>Moritz Systems have been contracted by the FreeBSD Foundation to modernize the LLDB debugger’s support for FreeBSD. We are writing a new plugin utilizing the more modern client-server layout that is already used by Darwin, Linux, NetBSD and (unofficially) OpenBSD. The new plugin is going to gradually replace the legacy one.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://functionallyparanoid.com/2020/10/14/openbsd-laptop/\" rel=\"nofollow\">OpenBSD Laptop</a></h3>\n\n<blockquote>\n<p>Hi, I know it’s been a while. I recently had to nuke and re-pave my personal laptop and I thought it would be a nice thing to share with the community how I set up OpenBSD on it so that I have a useful, modern, secure environment for getting work done. I’m not going to say I’m the expert on this or that this is the BEST way to set up OpenBSD, but I thought it would be worthwhile for folks doing Google searches to at least get my opinion on this. So, given that, let’s go…</p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/Ethan%20-%20Linux%20user%20wanting%20to%20try%20out%20OpenBSD.md\" rel=\"nofollow\">Ethan - Linux user wanting to try out OpenBSD</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/iian%20-%20Learning%20IT.md\" rel=\"nofollow\">iian - Learning IT</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/375/feedback/johnny%20-%20bsd%20swag.md\" rel=\"nofollow\">johnny - bsd swag</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":" bhyve - The FreeBSD Hypervisor, udf information leak, being a vim user instead of classic vi, FreeBSD on ESXi ARM Fling: Fixing Virtual Hardware, new FreeBSD Remote Process Plugin in LLDB, OpenBSD Laptop, and more.","date_published":"2020-11-05T06:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/66a4f529-c2fb-4a8e-83db-9f6cd6ff0809.mp3","mime_type":"audio/mpeg","size_in_bytes":43394088,"duration_in_seconds":2688}]},{"id":"4e2796a1-1895-47bd-81ca-fc3c80f043e6","title":"374: OpenBSD’s 25th anniversary","url":"https://www.bsdnow.tv/374","content_text":"OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nOpenBSD 6.8\n\n\nReleased Oct 18, 2020. (OpenBSD's 25th anniversary)\n\n\n\nNetBSD 9.1 Released\n\nThe NetBSD Project is pleased to announce NetBSD 9.1, the first update of the NetBSD 9 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.\n\n\n\n\nOpenZFS Developer Summit 2020\n\n\nAs with most other conferences in the last six months, this year’s OpenZFS Developer’s Summit was a bit different than usual. Held via Zoom to accommodate for 2020’s new normal in terms of social engagements, the conference featured a mix of talks delivered live via webinars, and breakout sessions held as regular meetings. This helped recapture some of the “hallway track” that would be lost in an online conference.\n    • After attending the conference, I wrote up some of my notes from each of the talks\n    • Part 2\n\n\n\n\nZFS and FreeBSD Support\n\nKlara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure, simply sign up for our monthly subscription! What's even better is that for the month of October we are giving away 3 months for free, for every yearly subscription, and one month free when you sign up for a 6-months subscription! Check it out on our website!\n\nNews Roundup\n\nBastilleBSD - native container management for FreeBSD\n\n\nSome time ago, I had the requirement to use FreeBSD in a project, and soon the question came up if Docker and Kubernetes can be used.\nOn FreeBSD, Docker is not very well supported, and even if you can get it running, Linux is used in a Docker container. My experience with Docker on FreeBSD is awful, and so I started looking for alternatives.\nA quick search on one of the most significant online search engines led me to Jails and then to BastilleBSD.\n\n\n\n\nTarsnap – cleaning up old backups\n\n\nI use Tarsnap for my critical data. Case in point, I use it to backup my Bacula database dump. I use Bacula to backup my hosts. The database in question keeps track of what was backed up, from what host, the file size, checksum, where that backup is now, and many other items. Losing this data is annoying but not a disaster. It can be recreated from the backup volumes, but that is time consuming. As it is, the file is dumped daily, and rsynced to multiple locations.\n\n\n\n\nMWL - BookSale\n\n\nFor those interested in such things, I recently posted my 60,000th tweet. This prodded me to try an experiment I’ve been pondering for a while.\nOver at my ebookstore, two of my books are now on a “Name Your Own Price” sale. You can get git commit murder and PAM Mastery for any price you wish, with a minimum of $1.\n\n\n\n\nBeastie Bits\n\n\nBrian Kernighan: UNIX, C, AWK, AMPL, and Go Programming | Lex Fridman Podcast #109\nThe UNIX Time-Sharing System - Dennis M. Ritchie and Ken Thompson -  July 1974\nUsing a 1930 Teletype as a Linux Terminal\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nlars - infosec handbook\nscott - zfs import\nzhong - first episode\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openbsd.org/68.html\" rel=\"nofollow\">OpenBSD 6.8</a></h3>\n\n<blockquote>\n<p>Released Oct 18, 2020. (OpenBSD&#39;s 25th anniversary)</p>\n\n<hr>\n\n<h3><a href=\"https://www.netbsd.org/releases/formal-9/NetBSD-9.1.html\" rel=\"nofollow\">NetBSD 9.1 Released</a></h3>\n\n<p>The NetBSD Project is pleased to announce NetBSD 9.1, the first update of the NetBSD 9 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://klarasystems.com/articles/openzfs-developer-summit-part-1/\" rel=\"nofollow\">OpenZFS Developer Summit 2020</a></h3>\n\n<blockquote>\n<p>As with most other conferences in the last six months, this year’s OpenZFS Developer’s Summit was a bit different than usual. Held via Zoom to accommodate for 2020’s new normal in terms of social engagements, the conference featured a mix of talks delivered live via webinars, and breakout sessions held as regular meetings. This helped recapture some of the “hallway track” that would be lost in an online conference.<br>\n    • After attending the conference, I wrote up some of my notes from each of the talks<br>\n    • <a href=\"https://klarasystems.com/articles/openzfs-developer-summit-part-2/\" rel=\"nofollow\">Part 2</a></p>\n\n<hr>\n</blockquote>\n\n<h3>ZFS and FreeBSD Support</h3>\n\n<p>Klara offers flexible Support Subscriptions for your ZFS and FreeBSD infrastructure, simply sign up for our monthly subscription! What&#39;s even better is that for the month of October we are giving away 3 months for free, for every yearly subscription, and one month free when you sign up for a 6-months subscription! <a href=\"https://klarasystems.com/support/\" rel=\"nofollow\">Check it out on our website!</a></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://fibric.hashnode.dev/bastillebsd-native-container-management-for-freebsd\" rel=\"nofollow\">BastilleBSD - native container management for FreeBSD</a></h3>\n\n<blockquote>\n<p>Some time ago, I had the requirement to use FreeBSD in a project, and soon the question came up if Docker and Kubernetes can be used.<br>\nOn FreeBSD, Docker is not very well supported, and even if you can get it running, Linux is used in a Docker container. My experience with Docker on FreeBSD is awful, and so I started looking for alternatives.<br>\nA quick search on one of the most significant online search engines led me to Jails and then to BastilleBSD.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2020/09/10/tarsnap-cleaning-up-old-backups/\" rel=\"nofollow\">Tarsnap – cleaning up old backups</a></h3>\n\n<blockquote>\n<p>I use Tarsnap for my critical data. Case in point, I use it to backup my Bacula database dump. I use Bacula to backup my hosts. The database in question keeps track of what was backed up, from what host, the file size, checksum, where that backup is now, and many other items. Losing this data is annoying but not a disaster. It can be recreated from the backup volumes, but that is time consuming. As it is, the file is dumped daily, and rsynced to multiple locations.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/8009\" rel=\"nofollow\">MWL - BookSale</a></h3>\n\n<blockquote>\n<p>For those interested in such things, I recently posted my 60,000th tweet. This prodded me to try an experiment I’ve been pondering for a while.<br>\nOver at my ebookstore, two of my books are now on a “Name Your Own Price” sale. You can get git commit murder and PAM Mastery for any price you wish, with a minimum of $1.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=O9upVbGSBFo\" rel=\"nofollow\">Brian Kernighan: UNIX, C, AWK, AMPL, and Go Programming | Lex Fridman Podcast #109</a></li>\n<li><a href=\"https://chsasank.github.io/classic_papers/unix-time-sharing-system.html#\" rel=\"nofollow\">The UNIX Time-Sharing System - Dennis M. Ritchie and Ken Thompson -  July 1974</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=2XLZ4Z8LpEE\" rel=\"nofollow\">Using a 1930 Teletype as a Linux Terminal</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/lars%20-%20infosec%20handbook.md\" rel=\"nofollow\">lars - infosec handbook</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/scott%20-%20zfs%20import.md\" rel=\"nofollow\">scott - zfs import</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/374/feedback/zhong%20-%20first%20episode.md\" rel=\"nofollow\">zhong - first episode</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD 6.8 has been released, NetBSD 9.1 is out, OpenZFS devsummit report, BastilleBSD’s native container management for FreeBSD, cleaning up old tarsnap backups, Michael W. Lucas’ book sale, and more.","date_published":"2020-10-29T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4e2796a1-1895-47bd-81ca-fc3c80f043e6.mp3","mime_type":"audio/mpeg","size_in_bytes":52402776,"duration_in_seconds":3280}]},{"id":"acdecc6a-f7b7-4d64-b64d-f7be713b78e2","title":"373: Kyle Evans Interview","url":"https://www.bsdnow.tv/373","content_text":"We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nInterview - Kyle Evans - kevans@freebsd.org / @kaevans91\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Interview - Kyle Evans - <a href=\"mailto:kevans@freebsd.org\" rel=\"nofollow\">kevans@freebsd.org</a> / <a href=\"https://twitter.com/kaevans91\" rel=\"nofollow\">@kaevans91</a></h2>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"We have an interview with Kyle Evans for you this week. We talk about his grep project, lua and flua in base, as well as bectl, being on the core team and a whole lot of other stuff.","date_published":"2020-10-22T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/acdecc6a-f7b7-4d64-b64d-f7be713b78e2.mp3","mime_type":"audio/mpeg","size_in_bytes":34011936,"duration_in_seconds":2013}]},{"id":"30f77e86-34d4-4e1a-a1c7-32e62f393980","title":"372: Slow SSD scrubs","url":"https://www.bsdnow.tv/372","content_text":"Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nWayland on BSD\n\n\nAfter I posted about the new default window manager in NetBSD I got a few questions, including \"when is NetBSD switching from X11 to Wayland?\", Wayland being X11's \"new\" rival. In this blog post, hopefully I can explain why we aren't yet!\n\n\n\nMy BSD sucks less than yours\n\nThis paper will look at some of the differences between the FreeBSD and OpenBSD operating systems. It is not intended to be solely technical but will also show the different \"visions\" and design decisions that rule the way things are implemented. It is expected to be a subjective view from two BSD developers and does not pretend to represent these projects in any way.\n\nVideo\n\n\nEuroBSDCon 2017 Part 1\nEuroBSDCon 2017 Part 2\n\n\n\n\n\nNews Roundup\n\nEven on SSDs, ongoing activity can slow down ZFS scrubs drastically\n\n\nBack in the days of our OmniOS fileservers, which used HDs (spinning rust) across iSCSI, we wound up changing kernel tunables to speed up ZFS scrubs and saw a significant improvement. When we migrated to our current Linux fileservers with SSDs, I didn't bother including these tunables (or the Linux equivalent), because I expected that SSDs were fast enough that it didn't matter. Indeed, our SSD pools generally scrub like lightning.\n\n\n\nOpenBSD on the Desktop (Part I)\n\nLet's install OpenBSD on a Lenovo Thinkpad X270. I used this computer for my computer science studies. It has both Arch Linux and Windows 10 installed as dual boot. Now that I'm no longer required to run Windows, I can ditch the dual boot and install an operating system of my choice.\n\n\n\nA simple shell status bar for OpenBSD and cwm(1)\n\nThese days, I try to use simple and stock software as much as possible on my OpenBSD laptop. I’ve been playing with cwm(1) for weeks and I was missing a status bar. After trying things like Tint2, Polybar etc, I discovered @gonzalo’s termbar. Thanks a lot!\nAs I love scripting, I decided to build my own.\n\n\n\nBeastie Bits\n\nDragonFly v5.8.3 released to address to issues\nOpenSSH 8.4 released\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\nFeedback/Questions\n\n\nDane - FreeBSD vs Linux in Microservices and Containters\nMason - questions.md\nMichael - Tmux License.md\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/wayland_on_netbsd_trials_and\" rel=\"nofollow\">Wayland on BSD</a></h3>\n\n<blockquote>\n<p>After I posted about the new default window manager in NetBSD I got a few questions, including &quot;when is NetBSD switching from X11 to Wayland?&quot;, Wayland being X11&#39;s &quot;new&quot; rival. In this blog post, hopefully I can explain why we aren&#39;t yet!</p>\n\n<hr>\n\n<h3><a href=\"https://www.bsdfrog.org/pub/events/my_bsd_sucks_less_than_yours-full_paper.pdf\" rel=\"nofollow\">My BSD sucks less than yours</a></h3>\n\n<p>This paper will look at some of the differences between the FreeBSD and OpenBSD operating systems. It is not intended to be solely technical but will also show the different &quot;visions&quot; and design decisions that rule the way things are implemented. It is expected to be a subjective view from two BSD developers and does not pretend to represent these projects in any way.</p>\n\n<p>Video</p>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=ZhpaKuXKob4\" rel=\"nofollow\">EuroBSDCon 2017 Part 1</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=cYp70KWD824\" rel=\"nofollow\">EuroBSDCon 2017 Part 2</a></li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSSSDActivitySlowsScrubs\" rel=\"nofollow\">Even on SSDs, ongoing activity can slow down ZFS scrubs drastically</a></h3>\n\n<blockquote>\n<p>Back in the days of our OmniOS fileservers, which used HDs (spinning rust) across iSCSI, we wound up changing kernel tunables to speed up ZFS scrubs and saw a significant improvement. When we migrated to our current Linux fileservers with SSDs, I didn&#39;t bother including these tunables (or the Linux equivalent), because I expected that SSDs were fast enough that it didn&#39;t matter. Indeed, our SSD pools generally scrub like lightning.</p>\n\n<hr>\n\n<h3><a href=\"https://paedubucher.ch/articles/2020-09-05-openbsd-on-the-desktop-part-i.html\" rel=\"nofollow\">OpenBSD on the Desktop (Part I)</a></h3>\n\n<p>Let&#39;s install OpenBSD on a Lenovo Thinkpad X270. I used this computer for my computer science studies. It has both Arch Linux and Windows 10 installed as dual boot. Now that I&#39;m no longer required to run Windows, I can ditch the dual boot and install an operating system of my choice.</p>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/20200923/a-simple-shell-status-bar-for-cwm/\" rel=\"nofollow\">A simple shell status bar for OpenBSD and cwm(1)</a></h3>\n\n<p>These days, I try to use simple and stock software as much as possible on my OpenBSD laptop. I’ve been playing with cwm(1) for weeks and I was missing a status bar. After trying things like Tint2, Polybar etc, I discovered @gonzalo’s termbar. Thanks a lot!<br>\nAs I love scripting, I decided to build my own.</p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2020-September/769777.html\" rel=\"nofollow\">DragonFly v5.8.3 released to address to issues</a><br>\n<a href=\"http://www.openssh.com/txt/release-8.4\" rel=\"nofollow\">OpenSSH 8.4 released</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n</blockquote>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Dane%20-%20FreeBSD%20vs%20Linux%20in%20Microservices%20and%20Containters.md\" rel=\"nofollow\">Dane - FreeBSD vs Linux in Microservices and Containters</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Mason%20-%20questions.md\" rel=\"nofollow\">Mason - questions.md</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/372/feedback/Michael%20-%20Tmux%20License.md\" rel=\"nofollow\">Michael - Tmux License.md</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Wayland on BSD, My BSD sucks less than yours, Even on SSDs, ongoing activity can slow down ZFS scrubs drastically, OpenBSD on the Desktop, simple shell status bar for OpenBSD and cwm, and more.","date_published":"2020-10-15T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/30f77e86-34d4-4e1a-a1c7-32e62f393980.mp3","mime_type":"audio/mpeg","size_in_bytes":47975808,"duration_in_seconds":2884}]},{"id":"8f2644a5-d6f7-49ca-bcd6-1a6336110611","title":"371: Wildcards running wild","url":"https://www.bsdnow.tv/371","content_text":"New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nMy New Project: zedfs.com\n\n\nHave you ever had an idea that keeps coming back to you over and over again? For a week? For a month? I know that feeling. My new project was born from this feeling.\nOn this blog, I mix content a lot. I have written personal posts (not many of them, but still), FreeBSD development posts, development posts, security posts, and ZFS posts. This mixed content can be problematic sometimes. I share a lot of stuff here, and readers don’t know what to expect next. I am just excited by so many things, and I want to share that excitement with you!\n\n\n\n\nTrueNAS CORE is Ready for Deployment\n\n\nTrueNAS 12.0 RC1 was released yesterday and with it, TrueNAS CORE is ready for deployment. The merger of FreeNAS and TrueNAS into a unified software image can now begin its path into mainstream use. TrueNAS CORE is the new FreeNAS and is on schedule.\nThe TrueNAS 12.0 BETA process started in June and has been the most successful BETA release ever with more than 3,000 users and only minor issues. Ars Technica provided a detailed technical walkthrough of the original BETA. There is a long list of features and performance improvements. During the BETA process, TrueNAS 12.0 demonstrated over 1.2 Million IOPS and over 23GB/s on a TrueNAS M60.\n\n\n\n\nNews Roundup\n\nInterprocess Communication in FreeBSD 11: Performance Analysis\n\n\nInterprocess communication, IPC, is one of the most fundamental functions of a modern operating system, playing an essential role in the fabric of contemporary applications. This report conducts an investigation in FreeBSD of the real world performance considerations behind two of the most common IPC mechanisms; pipes and sockets. A simple benchmark provides a fair sense of effective bandwidth for each, and analysis using DTrace, hardware performance counters and the operating system’s source code is presented. We note that pipes outperform sockets by 63% on average across all configurations, and further that the size of userspace transmission buffers has a profound effect on performance — larger buffers are beneficial up to a point (∼ 32-64 KiB) after which performance collapses as a result of devastating cache exhaustion. A deep scrutiny of the probe effects at play is also presented, justifying the validity of conclusions drawn from these experiments.\n\n\n\n\nBack To The Future: Unix Wildcards Gone Wild\n\n\nFirst of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome's Chain-14-Different-Bugs-To-Get-There...  Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013.\n\n\n\n\nUnix Wars\n\n\nDozens of different operating systems have been developed over the years, but only Unix has grown in so many varieties. There are three main branches. Four factors have facilitated this growth...\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nChris - installing FreeBSD 13-current\nDane - FreeBSD History Lesson\nMarc - linux compat\nMason - apropos battery\nPaul - a topic idea\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.oshogbo.vexillium.org/blog/80/\" rel=\"nofollow\">My New Project: zedfs.com</a></h3>\n\n<blockquote>\n<p>Have you ever had an idea that keeps coming back to you over and over again? For a week? For a month? I know that feeling. My new project was born from this feeling.<br>\nOn this blog, I mix content a lot. I have written personal posts (not many of them, but still), FreeBSD development posts, development posts, security posts, and ZFS posts. This mixed content can be problematic sometimes. I share a lot of stuff here, and readers don’t know what to expect next. I am just excited by so many things, and I want to share that excitement with you!</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-12-rc-1/\" rel=\"nofollow\">TrueNAS CORE is Ready for Deployment</a></h3>\n\n<blockquote>\n<p>TrueNAS 12.0 RC1 was released yesterday and with it, TrueNAS CORE is ready for deployment. The merger of FreeNAS and TrueNAS into a unified software image can now begin its path into mainstream use. TrueNAS CORE is the new FreeNAS and is on schedule.<br>\nThe TrueNAS 12.0 BETA process started in June and has been the most successful BETA release ever with more than 3,000 users and only minor issues. Ars Technica provided a detailed technical walkthrough of the original BETA. There is a long list of features and performance improvements. During the BETA process, TrueNAS 12.0 demonstrated over 1.2 Million IOPS and over 23GB/s on a TrueNAS M60.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://arxiv.org/pdf/2008.02145.pdf\" rel=\"nofollow\">Interprocess Communication in FreeBSD 11: Performance Analysis</a></h3>\n\n<blockquote>\n<p>Interprocess communication, IPC, is one of the most fundamental functions of a modern operating system, playing an essential role in the fabric of contemporary applications. This report conducts an investigation in FreeBSD of the real world performance considerations behind two of the most common IPC mechanisms; pipes and sockets. A simple benchmark provides a fair sense of effective bandwidth for each, and analysis using DTrace, hardware performance counters and the operating system’s source code is presented. We note that pipes outperform sockets by 63% on average across all configurations, and further that the size of userspace transmission buffers has a profound effect on performance — larger buffers are beneficial up to a point (∼ 32-64 KiB) after which performance collapses as a result of devastating cache exhaustion. A deep scrutiny of the probe effects at play is also presented, justifying the validity of conclusions drawn from these experiments.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt\" rel=\"nofollow\">Back To The Future: Unix Wildcards Gone Wild</a></h3>\n\n<blockquote>\n<p>First of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome&#39;s Chain-14-Different-Bugs-To-Get-There...  Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.livinginternet.com/i/iw_unix_war.htm\" rel=\"nofollow\">Unix Wars</a></h3>\n\n<blockquote>\n<p>Dozens of different operating systems have been developed over the years, but only Unix has grown in so many varieties. There are three main branches. Four factors have facilitated this growth...</p>\n\n<hr>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Chris%20-%20installing%20FreeBSD%2013-current.md\" rel=\"nofollow\">Chris - installing FreeBSD 13-current</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Dane%20-%20FreeBSD%20History%20Lesson.md\" rel=\"nofollow\">Dane - FreeBSD History Lesson</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Marc%20-%20linux%20compat.md\" rel=\"nofollow\">Marc - linux compat</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Mason%20-%20apropos%20battery.md\" rel=\"nofollow\">Mason - apropos battery</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/371/feedback/Paul%20-%20a%20topic%20idea.md\" rel=\"nofollow\">Paul - a topic idea</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"New Project: zedfs.com, TrueNAS CORE Ready for Deployment, IPC in FreeBSD 11: Performance Analysis, Unix Wildcards Gone Wild, Unix Wars, and more","date_published":"2020-10-08T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f2644a5-d6f7-49ca-bcd6-1a6336110611.mp3","mime_type":"audio/mpeg","size_in_bytes":40775352,"duration_in_seconds":2477}]},{"id":"4bc93957-8853-4c7a-b016-604d770c5b71","title":"370: Testing shutdown","url":"https://www.bsdnow.tv/370","content_text":"The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFuryBSD 2020-Q3 The world’s first OpenZFS based live image\n\n\nFuryBSD is a tool to test drive stock FreeBSD desktop images in read write mode to see if it will work for you before installing.  In order to provide the most reliable experience possible while preserving the integrity of the system the LiveCD now leverages ZFS, compression, replication, a memory file system, and reroot (pivot root).\n\n\n\n\nFreeBSD Subversion to Git Migration: Pt 1 Why?\n\n\nFreeBSD moving to Git: Why?  With luck, I'll be writing a few blogs on FreeBSD's move to git later this year. Today, we'll start with \"why\"?\nVideo from Warner Losh\n\n\n\n\nNews Roundup\n\nFreeBSD Instant-workstation 2020\n\n\nA little over a year ago I published an instant-workstation script for FreeBSD. The idea is to have an installed FreeBSD system, then run a shell script that uses only base-system utilities and installs and configures a workstation setup for you.\n\n\n\n\nnut – testing the shutdown mechanism\n\n\nFollowing on from my recent nut setup, this is the second in a series of three posts.\nThe next post will deal with adjusting startup and shutdown times to be sure everything proceeds as required.\n\n\n\n\nlogin_ldap added to OpenBSD -current\n\n\nWith this commit, Martijn van Duren (martijn@) added login_ldap(8) to -current\n\n\nhttps://marc.info/?l=openbsd-cvs&amp;m=159992319027593&amp;w=2\n***\n\n\n\nBeastie Bits\n\n\nNetBSD current now has GCC 9.3.0 for x86/ARM\nMidnightBSD 1.2.8\nMidnightBSD 2.0-Current\nRetro UNIX 8086 v1 operating system has been developed by Erdogan Tan as a special purposed derivation of original UNIX v1\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nRick - rcorder\nDan - machiatto bin\nLuis - old episodes\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.furybsd.org/furybsd-2020-q3-the-worlds-first-openzfs-based-live-image/\" rel=\"nofollow\">FuryBSD 2020-Q3 The world’s first OpenZFS based live image</a></h3>\n\n<blockquote>\n<p>FuryBSD is a tool to test drive stock FreeBSD desktop images in read write mode to see if it will work for you before installing.  In order to provide the most reliable experience possible while preserving the integrity of the system the LiveCD now leverages ZFS, compression, replication, a memory file system, and reroot (pivot root).</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2020/09/freebsd-subversion-to-git-migration.html\" rel=\"nofollow\">FreeBSD Subversion to Git Migration: Pt 1 Why?</a></h3>\n\n<blockquote>\n<p>FreeBSD moving to Git: Why?  With luck, I&#39;ll be writing a few blogs on FreeBSD&#39;s move to git later this year. Today, we&#39;ll start with &quot;why&quot;?<br>\n<a href=\"https://www.youtube.com/watch?v=Lx9lKr_M-DI\" rel=\"nofollow\">Video from Warner Losh</a></p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://euroquis.nl/freebsd/2020/09/17/instant-workstation.html\" rel=\"nofollow\">FreeBSD Instant-workstation 2020</a></h3>\n\n<blockquote>\n<p>A little over a year ago I published an instant-workstation script for FreeBSD. The idea is to have an installed FreeBSD system, then run a shell script that uses only base-system utilities and installs and configures a workstation setup for you.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://dan.langille.org/2020/09/10/nut-testing-the-shutdown-mechanism/\" rel=\"nofollow\">nut – testing the shutdown mechanism</a></h3>\n\n<blockquote>\n<p>Following on from my recent nut setup, this is the second in a series of three posts.<br>\nThe next post will deal with adjusting startup and shutdown times to be sure everything proceeds as required.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20200913081040\" rel=\"nofollow\">login_ldap added to OpenBSD -current</a></h3>\n\n<blockquote>\n<p>With this commit, Martijn van Duren (martijn@) added login_ldap(8) to -current</p>\n\n<ul>\n<li><a href=\"https://marc.info/?l=openbsd-cvs&m=159992319027593&w=2\" rel=\"nofollow\">https://marc.info/?l=openbsd-cvs&amp;m=159992319027593&amp;w=2</a>\n***</li>\n</ul>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/netbsd/status/1305082782457245696\" rel=\"nofollow\">NetBSD current now has GCC 9.3.0 for x86/ARM</a></li>\n<li><a href=\"https://www.justjournal.com/users/mbsd/entry/33802\" rel=\"nofollow\">MidnightBSD 1.2.8</a></li>\n<li><a href=\"https://www.justjournal.com/users/mbsd/entry/33806\" rel=\"nofollow\">MidnightBSD 2.0-Current</a></li>\n<li><a href=\"https://www.singlix.com/runix/\" rel=\"nofollow\">Retro UNIX 8086 v1 operating system has been developed by Erdogan Tan as a special purposed derivation of original UNIX v1</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/Rick%20-%20rcorder.md\" rel=\"nofollow\">Rick - rcorder</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/dan%20-%20machiatto%20bin.md\" rel=\"nofollow\">Dan - machiatto bin</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/370/feedback/luis%20-%20old%20episodes.md\" rel=\"nofollow\">Luis - old episodes</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"The world’s first OpenZFS based live image, FreeBSD Subversion to Git Migration video, FreeBSD Instant-workstation 2020, testing the shutdown mechanism, login_ldap added to OpenBSD, and more","date_published":"2020-10-01T06:15:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4bc93957-8853-4c7a-b016-604d770c5b71.mp3","mime_type":"audio/mpeg","size_in_bytes":43353456,"duration_in_seconds":2712}]},{"id":"3594bb2c-b1c8-4f13-bcb9-6ad5094179a5","title":"369: Where rc.d belongs","url":"https://www.bsdnow.tv/369","content_text":"High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nHigh Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated\n\n\nI have been running OpenBSD on a Soekris net5501 for my router/firewall since early 2012. Because I run a multitude of services on this system (more on that later), the meager 500Mhz AMD Geode + 512MB SDRAM was starting to get a little sluggish while trying to do anything via the terminal. Despite the perceived performance hit during interactive SSH sessions, it still supported a full 100Mbit connection with NAT, so I wasn’t overly eager to change anything. Luckily though, my ISP increased the bandwidth available on my plan tier to 150Mbit+. Unfortunately, the Soekris only contained 4xVIA Rhine Fast Ethernet. So now, I was using a slow system and wasting money by not being able to fully utilize my connection.\n\n\n\n\nBuilding the Development Version of Emacs on NetBSD\n\n\nI hadn’t really planned on installing a NetBSD VM (after doing all the other two BSDs), but then a NetBSD-related Emacs bug report arrived.\n\n\n\n\nNews Roundup\n\nrc.d belongs in libexec, not etc\n\n\nLet’s open with the controversy: the scripts that live under /etc/rc.d/ in FreeBSD, NetBSD, and OpenBSD are in the wrong place. They all should live in /libexec/rc.d/ because they are code, not configuration.\nThis misplacement is something that has bugged me for ages but I never had the energy to open this can of worms back when I was very involved in NetBSD. I suspect it would have been a draining discussion and a very difficult thing to change.\n\n\n\n\nFreeBSD 11.3 EOL\n\n\nAs of September 30, 2020, FreeBSD 11.3 will reach end-of-life and will no longer\nbe supported by the FreeBSD Security Team.  Users of FreeBSD 11.3 are strongly\nencouraged to upgrade to a newer release as soon as possible.\n\n\n\n\nOPNsense 20.7.1 Released\n\n\nOverall, the jump to HardenedBSD 12.1 is looking promising from our end. From the reported issues we still have more logging quirks to investigate and especially Netmap support (used in IPS and Sensei) is lacking in some areas that were previously working. Patches are being worked on already so we shall get there soon enough.  Stay tuned.\n\n\n\n\nMidnightBSD 1.2.7 out\n\n\nMidnightBSD 1.2.7 is available via the FTP/HTTP and mirrors as well as github.\nIt includes several bug fixes and security updates over the last ISO release and is recommended for new installations.\nUsers who don't want to updatee the whole OS, should consider at least updating libmport as there are many package management fixes\n\n\n\n\nBeastie Bits\n\n\nTarsnap podcast\nNetBSD Tips and Tricks\nFreeBSD mini-git Primer\nGhostBSD Financial Reports\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nDaniel - Documentation Tooling\nFongaboo - Where did the ZFS tutorial Go?\nJohnny - Browser Cold Wars\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/bsdnow\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://dzone.com/articles/high-availability-routerfirewall-using-openbsd-car\" rel=\"nofollow\">High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated</a></h3>\n\n<blockquote>\n<p>I have been running OpenBSD on a Soekris net5501 for my router/firewall since early 2012. Because I run a multitude of services on this system (more on that later), the meager 500Mhz AMD Geode + 512MB SDRAM was starting to get a little sluggish while trying to do anything via the terminal. Despite the perceived performance hit during interactive SSH sessions, it still supported a full 100Mbit connection with NAT, so I wasn’t overly eager to change anything. Luckily though, my ISP increased the bandwidth available on my plan tier to 150Mbit+. Unfortunately, the Soekris only contained 4xVIA Rhine Fast Ethernet. So now, I was using a slow system and wasting money by not being able to fully utilize my connection.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lars.ingebrigtsen.no/2020/08/25/building-the-development-version-of-emacs-on-netbsd/\" rel=\"nofollow\">Building the Development Version of Emacs on NetBSD</a></h3>\n\n<blockquote>\n<p>I hadn’t really planned on installing a NetBSD VM (after doing all the other two BSDs), but then a NetBSD-related Emacs bug report arrived.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jmmv.dev/2020/08/rcd-libexec-etc.html\" rel=\"nofollow\">rc.d belongs in libexec, not etc</a></h3>\n\n<blockquote>\n<p>Let’s open with the controversy: the scripts that live under /etc/rc.d/ in FreeBSD, NetBSD, and OpenBSD are in the wrong place. They all should live in /libexec/rc.d/ because they are code, not configuration.<br>\nThis misplacement is something that has bugged me for ages but I never had the energy to open this can of worms back when I was very involved in NetBSD. I suspect it would have been a draining discussion and a very difficult thing to change.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2020-September/001982.html\" rel=\"nofollow\">FreeBSD 11.3 EOL</a></h3>\n\n<blockquote>\n<p>As of September 30, 2020, FreeBSD 11.3 will reach end-of-life and will no longer<br>\nbe supported by the FreeBSD Security Team.  Users of FreeBSD 11.3 are strongly<br>\nencouraged to upgrade to a newer release as soon as possible.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-7-1-released/\" rel=\"nofollow\">OPNsense 20.7.1 Released</a></h3>\n\n<blockquote>\n<p>Overall, the jump to HardenedBSD 12.1 is looking promising from our end. From the reported issues we still have more logging quirks to investigate and especially Netmap support (used in IPS and Sensei) is lacking in some areas that were previously working. Patches are being worked on already so we shall get there soon enough.  Stay tuned.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.justjournal.com/users/mbsd/entry/33801\" rel=\"nofollow\">MidnightBSD 1.2.7 out</a></h3>\n\n<blockquote>\n<p>MidnightBSD 1.2.7 is available via the FTP/HTTP and mirrors as well as github.<br><br>\nIt includes several bug fixes and security updates over the last ISO release and is recommended for new installations.<br><br>\nUsers who don&#39;t want to updatee the whole OS, should consider at least updating libmport as there are many package management fixes</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://blog.firosolutions.com/2020/08/tarsnap-podcast/\" rel=\"nofollow\">Tarsnap podcast</a></li>\n<li><a href=\"http://students.engr.scu.edu/%7Esschaeck/netbsd/index.html\" rel=\"nofollow\">NetBSD Tips and Tricks</a></li>\n<li><a href=\"https://hackmd.io/hJgnfzd5TMK-VHgUzshA2g\" rel=\"nofollow\">FreeBSD mini-git Primer</a></li>\n<li><a href=\"https://ghostbsd.org/financial_reports_from_January_to_June_2020\" rel=\"nofollow\">GhostBSD Financial Reports</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Daniel%20-%20Documentation%20Tooling.md\" rel=\"nofollow\">Daniel - Documentation Tooling</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Fongaboo%20-%20Where%20did%20the%20ZFS%20Tutorial%20Go.md\" rel=\"nofollow\">Fongaboo - Where did the ZFS tutorial Go?</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/369/feedback/Johnny%20-%20Browser%20Cold%20Wars.md\" rel=\"nofollow\">Johnny - Browser Cold Wars</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"High Availability Router/Firewall Using OpenBSD, CARP, pfsync, and ifstated, Building the Development Version of Emacs on NetBSD, rc.d belongs in libexec, not etc, FreeBSD 11.3 EOL, OPNsense 20.7.1 Released, MidnightBSD 1.2.7 out, and more.","date_published":"2020-09-24T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3594bb2c-b1c8-4f13-bcb9-6ad5094179a5.mp3","mime_type":"audio/mpeg","size_in_bytes":43421016,"duration_in_seconds":2649}]},{"id":"4d186dc4-b8ee-4824-bfcc-3bacf18ba5da","title":"368: Changing OS roles","url":"https://www.bsdnow.tv/368","content_text":"Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more. \n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nModernizing the OpenBSD Console\n\n\nAt the beginning were text mode consoles. Traditionally, *BSD and Linux on i386 and amd64 used text mode consoles which by default provided 25 rows of 80 columns, the \"80x25 mode\". This mode uses a 8x16 font stored in the VGA BIOS (which can be slightly different across vendors).\nOpenBSD uses the wscons(4) console framework, inherited from NetBSD\n\n\n\n\nOS roles have changed\n\n\nThough I do wonder sometimes, with just a slight tweak to history, how things might have been different. In another dimension somewhere, I’m using the latest BeOS-powered PowerPC laptop, and a shiny new Palm smartphone. Both of these represented the pinnacle of UI design in the 1990s, and still in the 2020s have yet to be surpassed. People call me an Apple fanboy, but I’d drop all of it in a second for that gear.\n\n\n\n\nNews Roundup\n\nFreeBSD Cluster with Pacemaker and Corosync\n\n\nI always missed ‘proper’ cluster software for FreeBSD systems. Recently I got to run several Pacemaker/Corosync based clusters on Linux systems. I thought how to make similar high availability solutions on FreeBSD and I was really shocked when I figured out that both Pacemaker and Corosync tools are available in the FreeBSD Ports and packages as net/pacemaker2 and net/corosync2 respectively.\n\n\n\n\nWine in a 32-bit sandbox on 64-bit NetBSD\n\n\n\"Mainline pkgsrc\" can't do strange multi-arch Wine builds yet, so a 32-bit sandbox seems like a reasonable way to use 32-bit Wine on amd64 without resorting to running real Windows in NVMM. We'll see if this was a viable alternative to re-reviewing the multi-arch support in pkgsrc-wip...\nWe're using sandboxctl, which is a neat tool for quickly shelling into a different NetBSD userspace. Maybe you also don't trust the Windows applications you're running too much - sandboxctl creates a chroot based on a fresh system image, and chroot on NetBSD is fairly bombproof.\n\n\n\n\nFind package which provides a file in OpenBSD\n\n\nThere is one very handy package on OpenBSD named pkglocatedb which provides the command pkglocate.\nIf you need to find a file or binary/program and you don’t know which package contains it, use pkglocate.\n\n\n\n\nBeastie Bits\n\n\nOpenBSD for 1.5 Years: Confessions of a Linux Heretic\nOpenBSD 6.8 Beta Tagged\nHammer2 and growth\nUnderstanding a FreeBSD kernel vulnerability\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nRob - 7 years\nKurt - Microserver\nRob - Interviews\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more. </p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.cambus.net/modernizing-the-openbsd-console/\" rel=\"nofollow\">Modernizing the OpenBSD Console</a></h3>\n\n<blockquote>\n<p>At the beginning were text mode consoles. Traditionally, *BSD and Linux on i386 and amd64 used text mode consoles which by default provided 25 rows of 80 columns, the &quot;80x25 mode&quot;. This mode uses a 8x16 font stored in the VGA BIOS (which can be slightly different across vendors).<br>\nOpenBSD uses the wscons(4) console framework, inherited from NetBSD</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://rubenerd.com/the-roles-of-oss-have-changed/\" rel=\"nofollow\">OS roles have changed</a></h3>\n\n<blockquote>\n<p>Though I do wonder sometimes, with just a slight tweak to history, how things might have been different. In another dimension somewhere, I’m using the latest BeOS-powered PowerPC laptop, and a shiny new Palm smartphone. Both of these represented the pinnacle of UI design in the 1990s, and still in the 2020s have yet to be surpassed. People call me an Apple fanboy, but I’d drop all of it in a second for that gear.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://vermaden.wordpress.com/2020/09/03/freebsd-cluster-with-pacemaker-and-corosync/\" rel=\"nofollow\">FreeBSD Cluster with Pacemaker and Corosync</a></h3>\n\n<blockquote>\n<p>I always missed ‘proper’ cluster software for FreeBSD systems. Recently I got to run several Pacemaker/Corosync based clusters on Linux systems. I thought how to make similar high availability solutions on FreeBSD and I was really shocked when I figured out that both Pacemaker and Corosync tools are available in the FreeBSD Ports and packages as net/pacemaker2 and net/corosync2 respectively.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://washbear.neocities.org/wine-sandbox.html\" rel=\"nofollow\">Wine in a 32-bit sandbox on 64-bit NetBSD</a></h3>\n\n<blockquote>\n<p>&quot;Mainline pkgsrc&quot; can&#39;t do strange multi-arch Wine builds yet, so a 32-bit sandbox seems like a reasonable way to use 32-bit Wine on amd64 without resorting to running real Windows in NVMM. We&#39;ll see if this was a viable alternative to re-reviewing the multi-arch support in pkgsrc-wip...<br>\nWe&#39;re using sandboxctl, which is a neat tool for quickly shelling into a different NetBSD userspace. Maybe you also don&#39;t trust the Windows applications you&#39;re running too much - sandboxctl creates a chroot based on a fresh system image, and chroot on NetBSD is fairly bombproof.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-09-04-pkglocate-openbsd.html\" rel=\"nofollow\">Find package which provides a file in OpenBSD</a></h3>\n\n<blockquote>\n<p>There is one very handy package on OpenBSD named pkglocatedb which provides the command pkglocate.<br>\nIf you need to find a file or binary/program and you don’t know which package contains it, use pkglocate.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=oTShQIXSdqM\" rel=\"nofollow\">OpenBSD for 1.5 Years: Confessions of a Linux Heretic</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20200831192811\" rel=\"nofollow\">OpenBSD 6.8 Beta Tagged</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2020/09/08/24933.html\" rel=\"nofollow\">Hammer2 and growth</a></li>\n<li><a href=\"https://www.thezdi.com/blog/2020/9/1/cve-2020-7460-freebsd-kernel-privilege-escalation\" rel=\"nofollow\">Understanding a FreeBSD kernel vulnerability</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Bruce%20-%207%20years.md\" rel=\"nofollow\">Rob - 7 years</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Kurt%20-%20Microserver.md\" rel=\"nofollow\">Kurt - Microserver</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/368/feedback/Rob%20-%20Interviews.md\" rel=\"nofollow\">Rob - Interviews</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Modernizing the OpenBSD Console, OS roles have changed, FreeBSD Cluster with Pacemaker and Corosync, Wine in a 32-bit sandbox on 64-bit NetBSD, Find package which provides a file in OpenBSD, and more.","date_published":"2020-09-17T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d186dc4-b8ee-4824-bfcc-3bacf18ba5da.mp3","mime_type":"audio/mpeg","size_in_bytes":48070680,"duration_in_seconds":2912}]},{"id":"056d15d3-4908-4073-955a-88e7700ba566","title":"367: Changing jail datasets","url":"https://www.bsdnow.tv/367","content_text":"A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nA 35 Year Old Bug in Patch\n\n\nLarry Wall posted patch 1.3 to mod.sources on May 8, 1985. A number of versions followed over the years. It's been a faithful alley for a long, long time. I've never had a problem with patch until I embarked on the 2.11BSD restoration project. In going over the logs very carefully, I've discovered a bug that bites this effort twice. It's quite interesting to use 27 year old patches to find this bug while restoring a 29 year old OS...\n\n\n\n\nSandbox for FreeBSD\n\n\nA sandbox is a software which artificially limits access to the specific resources on the target according to the assigned policy. The sandbox installs hooks to the kernel syscalls and other sub-systems in order to interrupt the events triggered by the application. From the application point of view, application working as usual, but when it wants to access, for instance, /dev/kmem the sandbox software decides against the assigned sandbox scheme whether to grant or deny access.\nIn our case, the sandbox is a kernel module which uses MAC (Mandatory Access Control) Framework developed by the TrustedBSD team. All necessary hooks were introduced to the FreeBSD kernel.\n\n\n\nSource Code\nDocumentation\n\n\n\n\nNews Roundup\n\nChanging from one dataset to another within a jail\n\n\nZFS has a the ability to share itself within a jail. That gives the jail some autonomy, and I like that.\nI’ve written briefly about that, specifically for iocage. More recently, I started using a zfs snapshot for caching clearing.\nThe purpose of this post is to document the existing configuration of the production FreshPorts webserver and outline the plan on how to modify it for more zfs-snapshot-based cache clearing.\n\n\n\n\nYou don’t need tmux or screen for ZFS\n\n\nBack in January I mentioned how to add redundancy to a ZFS pool by adding a mirrored drive. Someone with a private account on Twitter asked me why FreeBSD—and NetBSD!—doesn’t ship with a tmux or screen equivilent in base in order to daemonise the process and let them run in the background.\nZFS already does this for its internal commands.\n\n\n\n\nHardenedBSD August 2020 Status Report and Call for Donations\n\n\nThis last month has largely been a quiet one. I've restarted work on porting five-year-old work from the Code Pointer Integrity (CPI) project into HardenedBSD. Chiefly, I've started forward-porting the libc and rtld bits from the CPI project and now need to look at llvm compiler/linker enhancements. We need to be able to apply SafeStack to shared objects, not just application binaries. This forward-porting work I'm doing is to support that effort.\nThe infrastructure has settled and is now churning normally and happily. We're still working out bandwidth issues. We hope to have a new fiber line ran by the end of September.\nAs part of this status report, I'm issuing a formal call for donations. I'm aiming for $4,000.00 USD for a newer self-hosted Gitea server. I hope to purchase the new server before the end of 2020.\n\n\n\n\nImportant parts of Unix's history happened before readline support was common\n\n\nUnix and things that run on Unix have been around for a long time now. In particular, GNU Readline was first released in 1989 (as was Bash), which is long enough ago for it (or lookalikes) to become pretty much pervasive, especially in Unix shells. Today it's easy to think of readline support as something that's always been there. But of course this isn't the case. Unix in its modern form dates from V7 in 1979 and 4.2 BSD in 1983, so a lot of Unix was developed before readline and was to some degree shaped by the lack of it.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nMason - mailserver\ncasey - freebsd on decline\ndenis - postgres\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patch-found-in.html\" rel=\"nofollow\">A 35 Year Old Bug in Patch</a></h3>\n\n<blockquote>\n<p>Larry Wall posted patch 1.3 to mod.sources on May 8, 1985. A number of versions followed over the years. It&#39;s been a faithful alley for a long, long time. I&#39;ve never had a problem with patch until I embarked on the 2.11BSD restoration project. In going over the logs very carefully, I&#39;ve discovered a bug that bites this effort twice. It&#39;s quite interesting to use 27 year old patches to find this bug while restoring a 29 year old OS...</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.relkom.sk/en/fbsd_sandbox.shtml\" rel=\"nofollow\">Sandbox for FreeBSD</a></h3>\n\n<blockquote>\n<p>A sandbox is a software which artificially limits access to the specific resources on the target according to the assigned policy. The sandbox installs hooks to the kernel syscalls and other sub-systems in order to interrupt the events triggered by the application. From the application point of view, application working as usual, but when it wants to access, for instance, /dev/kmem the sandbox software decides against the assigned sandbox scheme whether to grant or deny access.<br>\nIn our case, the sandbox is a kernel module which uses MAC (Mandatory Access Control) Framework developed by the TrustedBSD team. All necessary hooks were introduced to the FreeBSD kernel.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://gitlab.com/relkom/sandbox\" rel=\"nofollow\">Source Code</a></li>\n<li><a href=\"https://www.relkom.sk/en/fbsd_sandbox_docs.shtml\" rel=\"nofollow\">Documentation</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dan.langille.org/2020/08/16/changing-from-one-dataset-to-another-within-a-freebsd-iocage-jail/\" rel=\"nofollow\">Changing from one dataset to another within a jail</a></h3>\n\n<blockquote>\n<p>ZFS has a the ability to share itself within a jail. That gives the jail some autonomy, and I like that.<br>\nI’ve written briefly about that, specifically for iocage. More recently, I started using a zfs snapshot for caching clearing.<br>\nThe purpose of this post is to document the existing configuration of the production FreshPorts webserver and outline the plan on how to modify it for more zfs-snapshot-based cache clearing.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/you-dont-need-tmux-or-screen-for-zfs/\" rel=\"nofollow\">You don’t need tmux or screen for ZFS</a></h3>\n\n<blockquote>\n<p>Back in January I mentioned how to add redundancy to a ZFS pool by adding a mirrored drive. Someone with a private account on Twitter asked me why FreeBSD—and NetBSD!—doesn’t ship with a tmux or screen equivilent in base in order to daemonise the process and let them run in the background.<br>\nZFS already does this for its internal commands.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-08-15/hardenedbsd-august-2020-status-report-and-call-donations\" rel=\"nofollow\">HardenedBSD August 2020 Status Report and Call for Donations</a></h3>\n\n<blockquote>\n<p>This last month has largely been a quiet one. I&#39;ve restarted work on porting five-year-old work from the Code Pointer Integrity (CPI) project into HardenedBSD. Chiefly, I&#39;ve started forward-porting the libc and rtld bits from the CPI project and now need to look at llvm compiler/linker enhancements. We need to be able to apply SafeStack to shared objects, not just application binaries. This forward-porting work I&#39;m doing is to support that effort.<br>\nThe infrastructure has settled and is now churning normally and happily. We&#39;re still working out bandwidth issues. We hope to have a new fiber line ran by the end of September.<br>\nAs part of this status report, I&#39;m issuing a formal call for donations. I&#39;m aiming for $4,000.00 USD for a newer self-hosted Gitea server. I hope to purchase the new server before the end of 2020.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/TimeBeforeReadline\" rel=\"nofollow\">Important parts of Unix&#39;s history happened before readline support was common</a></h3>\n\n<blockquote>\n<p>Unix and things that run on Unix have been around for a long time now. In particular, GNU Readline was first released in 1989 (as was Bash), which is long enough ago for it (or lookalikes) to become pretty much pervasive, especially in Unix shells. Today it&#39;s easy to think of readline support as something that&#39;s always been there. But of course this isn&#39;t the case. Unix in its modern form dates from V7 in 1979 and 4.2 BSD in 1983, so a lot of Unix was developed before readline and was to some degree shaped by the lack of it.</p>\n</blockquote>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/Mason%20-%20mailserver.md\" rel=\"nofollow\">Mason - mailserver</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/casey%20-%20freebsd%20on%20decline.md\" rel=\"nofollow\">casey - freebsd on decline</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/367/feedback/denis%20-%20postgres.md\" rel=\"nofollow\">denis - postgres</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"A 35 Year Old Bug in Patch, Sandbox for FreeBSD, Changing from one dataset to another within a jail, You don’t need tmux or screen for ZFS, HardenedBSD August 2020 Status Report and Call for Donations, and more.","date_published":"2020-09-10T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/056d15d3-4908-4073-955a-88e7700ba566.mp3","mime_type":"audio/mpeg","size_in_bytes":47196984,"duration_in_seconds":2728}]},{"id":"ac66cef0-02a8-44b9-b915-813b8e26c643","title":"366: Bootloader zpool checkpoints","url":"https://www.bsdnow.tv/366","content_text":"OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nOpenZFS with ZSTD land in FreeBSD 13\n\n\nZStandard Compression for OpenZFS\n&gt; The primary benefit is maintaining a completely shared code base with the community allowing FreeBSD to receive new features sooner and with less effort.\n&gt; I would advise against doing 'zpool upgrade' or creating indispensable pools using new features until this change has had a month+ to soak.\nRebasing FreeBSD’s OpenZFS on the new upstream was sponsored by iXsystems\nThe competition of ZSTD support for OpenZFS was sponsored by the FreeBSD Foundation\n***\n\n\nLibreSSL documentation status update\n\n\nMore than six years ago, LibreSSL was forked from OpenSSL, and almost two years ago, i explained the status of LibreSSL documentation during EuroBSDCon 2018 in Bucuresti. So it seems providing an update might be in order.\nNote that this is not an update regarding LibreSSL status in general because i'm not the right person to talk about the big picture of working on the LibreSSL code, my work has been quite focussed on documentation. All the same, it is fair to say that even though the number of developers working on it is somewhat limited, the LibreSSL project is quite alive, typically having a release every few months. Progress continues being made with respect to porting and adding new functionality (for example regarding TLSv1.3, CMS, RSA-PSS, RSA-OAEP, GOST, SM3, SM4, XChaCha20 during the last two years), OpenSSL compatibility improvements (including providing additional OpenSSL-1.1 APIs), and lots of bug fixes and code cleanup.\n\n\n\n\nFreeBSD on SPARC64 (is dead)\n\n\n’m coming pretty late to the party, because SPARC64 support in FreeBSD is apparently doomed: After the POWER platform made the switch to a LLVM/Clang-based toolchain, SPARC64 is one of the last ones that still uses the ancient GCC 4.2-based toolchain that the project wants to finally get rid off (it has already happened as I was writing this – looks like the firm plan was not so firm after all, since they killed it off early). And compared to the other platforms it has seen not too much love in recent times… SPARC64 being a great platform, I’d be quite sad to see it go. But before that happens let’s see what the current status is and what would need to be done if it were to survive, shall we?\n\n\n\n\nNews Roundup\n\nBringing zpool checkpoints to a FreeBSD bootloader\n\n\nAlmost two years ago I wrote a blog post about checkpoints in ZFS. I didn’t hide that I was a big fan of them. That said, after those two years, I still feel that there are underappreciated features in the ZFS world, so I decided to do something about that.\nCurrently, one of the best practices for upgrading your operating system is to use boot environments. They are a great feature for managing multiple kernels and userlands. They are based on juggling which ZFS datasets are mounted. Each dataset has its own version of the system. Unfortunately, boot environments have their limitations. If we, for example, upgrade our ZFS pool, we may not be able to use older versions of the system anymore. \nThe big advantage of boot environments is that they have very good tools. Two main tools are beadm (which was created by vermaden) and bectl (which currently is in the FreeBSD base system). These tools allow us to create and manage boot environments.\n\n\n\n\nBeastie Bits\n\n\nThe First Unix Port\nTLS Mastery updates, August 2020\nWhat is the Oldest BSD Distribution still around today\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nben - zfs send questions\nlars - zfs pool question\nneutron - bectl vs beadm\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=364746\" rel=\"nofollow\">OpenZFS with ZSTD land in FreeBSD 13</a></h3>\n\n<ul>\n<li><a href=\"https://github.com/openzfs/zfs/commit/10b3c7f5e424f54b3ba82dbf1600d866e64ec0a0\" rel=\"nofollow\">ZStandard Compression for OpenZFS</a>\n&gt; The primary benefit is maintaining a completely shared code base with the community allowing FreeBSD to receive new features sooner and with less effort.\n&gt; I would advise against doing &#39;zpool upgrade&#39; or creating indispensable pools using new features until this change has had a month+ to soak.</li>\n<li>Rebasing FreeBSD’s OpenZFS on the new upstream was sponsored by iXsystems</li>\n<li>The competition of ZSTD support for OpenZFS was sponsored by the FreeBSD Foundation\n***</li>\n</ul>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20200817063735\" rel=\"nofollow\">LibreSSL documentation status update</a></h3>\n\n<blockquote>\n<p>More than six years ago, LibreSSL was forked from OpenSSL, and almost two years ago, i explained the status of LibreSSL documentation during EuroBSDCon 2018 in Bucuresti. So it seems providing an update might be in order.<br>\nNote that this is not an update regarding LibreSSL status in general because i&#39;m not the right person to talk about the big picture of working on the LibreSSL code, my work has been quite focussed on documentation. All the same, it is fair to say that even though the number of developers working on it is somewhat limited, the LibreSSL project is quite alive, typically having a release every few months. Progress continues being made with respect to porting and adding new functionality (for example regarding TLSv1.3, CMS, RSA-PSS, RSA-OAEP, GOST, SM3, SM4, XChaCha20 during the last two years), OpenSSL compatibility improvements (including providing additional OpenSSL-1.1 APIs), and lots of bug fixes and code cleanup.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2020/02/15/freebsd-on-sparc64-is-dead/\" rel=\"nofollow\">FreeBSD on SPARC64 (is dead)</a></h3>\n\n<blockquote>\n<p>’m coming pretty late to the party, because SPARC64 support in FreeBSD is apparently doomed: After the POWER platform made the switch to a LLVM/Clang-based toolchain, SPARC64 is one of the last ones that still uses the ancient GCC 4.2-based toolchain that the project wants to finally get rid off (it has already happened as I was writing this – looks like the firm plan was not so firm after all, since they killed it off early). And compared to the other platforms it has seen not too much love in recent times… SPARC64 being a great platform, I’d be quite sad to see it go. But before that happens let’s see what the current status is and what would need to be done if it were to survive, shall we?</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.oshogbo.vexillium.org/blog/79/\" rel=\"nofollow\">Bringing zpool checkpoints to a FreeBSD bootloader</a></h3>\n\n<blockquote>\n<p>Almost two years ago I wrote a blog post about checkpoints in ZFS. I didn’t hide that I was a big fan of them. That said, after those two years, I still feel that there are underappreciated features in the ZFS world, so I decided to do something about that.<br>\nCurrently, one of the best practices for upgrading your operating system is to use boot environments. They are a great feature for managing multiple kernels and userlands. They are based on juggling which ZFS datasets are mounted. Each dataset has its own version of the system. Unfortunately, boot environments have their limitations. If we, for example, upgrade our ZFS pool, we may not be able to use older versions of the system anymore. <br>\nThe big advantage of boot environments is that they have very good tools. Two main tools are beadm (which was created by vermaden) and bectl (which currently is in the FreeBSD base system). These tools allow us to create and manage boot environments.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://documents.uow.edu.au/content/groups/public/@web/@inf/@scsse/documents/doc/uow103747.pdf\" rel=\"nofollow\">The First Unix Port</a></li>\n<li><a href=\"https://mwl.io/archives/7346\" rel=\"nofollow\">TLS Mastery updates, August 2020</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=ww60o940kEk\" rel=\"nofollow\">What is the Oldest BSD Distribution still around today</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/ben%20-%20zfs%20send%20questions.md\" rel=\"nofollow\">ben - zfs send questions</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/lars%20-%20zfs%20pool%20question.md\" rel=\"nofollow\">lars - zfs pool question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/366/feedback/neutron%20-%20bectl%20vs%20beadm.md\" rel=\"nofollow\">neutron - bectl vs beadm</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"OpenZFS with ZSTD lands in FreeBSD 13, LibreSSL doc status update, FreeBSD on SPARC64 (is dead), Bringing zpool checkpoints to a FreeBSD bootloader, and more","date_published":"2020-09-03T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ac66cef0-02a8-44b9-b915-813b8e26c643.mp3","mime_type":"audio/mpeg","size_in_bytes":54891512,"duration_in_seconds":3182}]},{"id":"818d1dc0-da99-423a-a552-4ac52474c66c","title":"365: Whole year round","url":"https://www.bsdnow.tv/365","content_text":"FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD USB Audio\n\n\nI recently got a Behringer UMC22 sound card for video conferencing and DJing. This page documents what I’ve learned about using this sound card, and USB audio in general, on FreeBSD.\ntl;dr: Everything works as long as the sound card follows the USB audio device class specification.\n\n\n\nKyua: An introduction for NetBSD users\n\nKyua's current goal is to reimplement only the ATF tools while maintaining backwards compatibility with the tests written with the ATF libraries (i.e. with the NetBSD test suite).\nBecause Kyua is a replacement of some ATF components, the end goal is to integrate Kyua into the NetBSD base system (just as ATF is) and remove the deprecated ATF components. Removing the deprecated components will allow us to make the above-mentioned improvements to Kyua, as well as many others, without having to deal with the obsolete ATF code base. Discussing how and when this transition might happen is out of the scope of this document at the moment.\n\n\n\n\nNews Roundup\n\nKeeping backup ZFS on Linux kernel modules around\n\n\nI'm a long term user of ZFS on Linux and over pretty much all of the time I've used it, I've built it from the latest development version. Generally this means I update my ZoL build at the same time as I update my Fedora kernel, since a ZoL update requires a kernel reboot anyway. This is a little bit daring, of course, although the ZoL development version has generally been quite solid (and this way I get the latest features and improvements long before I otherwise would).\n\n\n\n\nCommand-line Tools can be 235x Faster than your Hadoop Cluster\n\n\nAs I was browsing the web and catching up on some sites I visit periodically, I found a cool article from Tom Hayden about using Amazon Elastic Map Reduce (EMR) and mrjob in order to compute some statistics on win/loss ratios for chess games he downloaded from the millionbase archive, and generally have fun with EMR. Since the data volume was only about 1.75GB containing around 2 million chess games, I was skeptical of using Hadoop for the task, but I can understand his goal of learning and having fun with mrjob and EMR. Since the problem is basically just to look at the result lines of each file and aggregate the different results, it seems ideally suited to stream processing with shell commands. I tried this out, and for the same amount of data I was able to use my laptop to get the results in about 12 seconds (processing speed of about 270MB/sec), while the Hadoop processing took about 26 minutes (processing speed of about 1.14MB/sec).\n\n\n\n\nFreeBSD Laptop Find Out Battery Life Status Command\n\n\nI know how to find out battery life status using Linux operating system. How do I monitor battery status on a laptop running FreeBSD version 9.x/10.x/11.x/12.x?\nYou can use any one of the following commands to get battery status under FreeBSD laptop including remaining battery life and more.\n\n\n\n\nBeastie Bits\n\nBSD Beer\nAwk for JSON\nDrawing Pictures The Unix Way - with pic and troff\nRefactoring the FreeBSD Kernel with Checked C\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nJason - German Locales\npcwizz - Router Style Device\npredrag - OpenBSD Router Hardware\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.davidschlachter.com/misc/freebsd-usb-audio\" rel=\"nofollow\">FreeBSD USB Audio</a></h3>\n\n<blockquote>\n<p>I recently got a Behringer UMC22 sound card for video conferencing and DJing. This page documents what I’ve learned about using this sound card, and USB audio in general, on FreeBSD.<br>\ntl;dr: Everything works as long as the sound card follows the USB audio device class specification.</p>\n\n<hr>\n\n<h3><a href=\"https://wiki.netbsd.org/kyua/\" rel=\"nofollow\">Kyua: An introduction for NetBSD users</a></h3>\n\n<p>Kyua&#39;s current goal is to reimplement only the ATF tools while maintaining backwards compatibility with the tests written with the ATF libraries (i.e. with the NetBSD test suite).<br>\nBecause Kyua is a replacement of some ATF components, the end goal is to integrate Kyua into the NetBSD base system (just as ATF is) and remove the deprecated ATF components. Removing the deprecated components will allow us to make the above-mentioned improvements to Kyua, as well as many others, without having to deal with the obsolete ATF code base. Discussing how and when this transition might happen is out of the scope of this document at the moment.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxModuleBackups\" rel=\"nofollow\">Keeping backup ZFS on Linux kernel modules around</a></h3>\n\n<blockquote>\n<p>I&#39;m a long term user of ZFS on Linux and over pretty much all of the time I&#39;ve used it, I&#39;ve built it from the latest development version. Generally this means I update my ZoL build at the same time as I update my Fedora kernel, since a ZoL update requires a kernel reboot anyway. This is a little bit daring, of course, although the ZoL development version has generally been quite solid (and this way I get the latest features and improvements long before I otherwise would).</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://adamdrake.com/command-line-tools-can-be-235x-faster-than-your-hadoop-cluster.html\" rel=\"nofollow\">Command-line Tools can be 235x Faster than your Hadoop Cluster</a></h3>\n\n<blockquote>\n<p>As I was browsing the web and catching up on some sites I visit periodically, I found a cool article from Tom Hayden about using Amazon Elastic Map Reduce (EMR) and mrjob in order to compute some statistics on win/loss ratios for chess games he downloaded from the millionbase archive, and generally have fun with EMR. Since the data volume was only about 1.75GB containing around 2 million chess games, I was skeptical of using Hadoop for the task, but I can understand his goal of learning and having fun with mrjob and EMR. Since the problem is basically just to look at the result lines of each file and aggregate the different results, it seems ideally suited to stream processing with shell commands. I tried this out, and for the same amount of data I was able to use my laptop to get the results in about 12 seconds (processing speed of about 270MB/sec), while the Hadoop processing took about 26 minutes (processing speed of about 1.14MB/sec).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.cyberciti.biz/faq/freebsd-finding-out-battery-life-state-on-laptop/\" rel=\"nofollow\">FreeBSD Laptop Find Out Battery Life Status Command</a></h3>\n\n<blockquote>\n<p>I know how to find out battery life status using Linux operating system. How do I monitor battery status on a laptop running FreeBSD version 9.x/10.x/11.x/12.x?<br>\nYou can use any one of the following commands to get battery status under FreeBSD laptop including remaining battery life and more.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://i.redd.it/hlh8luidzgg51.jpg\" rel=\"nofollow\">BSD Beer</a><br>\n<a href=\"https://github.com/mohd-akram/jawk\" rel=\"nofollow\">Awk for JSON</a><br>\n<a href=\"https://youtu.be/oG2A_1vC6aM\" rel=\"nofollow\">Drawing Pictures The Unix Way - with pic and troff</a><br>\n<a href=\"https://www.cs.rochester.edu/u/jzhou41/papers/freebsd_checkedc.pdf\" rel=\"nofollow\">Refactoring the FreeBSD Kernel with Checked C</a></p>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/jason%20-%20german%20locale.md\" rel=\"nofollow\">Jason - German Locales</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/pcwizz%20-%20router%20style%20device.md\" rel=\"nofollow\">pcwizz - Router Style Device</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/365/predrag%20-%20openbsd%20router%20hardware.md\" rel=\"nofollow\">predrag - OpenBSD Router Hardware</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD USB Audio, Kyua: An introduction for NetBSD users, Keeping backup ZFS on Linux kernel modules around, CLI Tools 235x Faster than Hadoop, FreeBSD Laptop Battery Life Status Command, and more.","date_published":"2020-08-27T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/818d1dc0-da99-423a-a552-4ac52474c66c.mp3","mime_type":"audio/mpeg","size_in_bytes":49050296,"duration_in_seconds":2814}]},{"id":"7581b101-10df-4469-8e37-0ddb82f82696","title":"364: FreeBSD Wireless Grind","url":"https://www.bsdnow.tv/364","content_text":"FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos's syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD Qt WebEngine GPU Acceleration\n\n\nFreeBSD has a handful of Qt WebEngine-based browsers. Falkon, and Otter-Browser, and qutebrowser and probably others, too. All of them can run into issues on FreeBSD with GPU-accelerated rendering not working. Let’s look at some of the workarounds.\n\n\n\n\nNetBSD on the Nanopi Neo2\n\n\nThe NanoPi NEO2 from FriendlyARM has been serving me well since 2018, being my test machine for OpenBSD/arm64 related things.\nAs NetBSD/evbarm finally gained support for AArch64 in NetBSD 9.0, released back in February, I decided to give it a try on this device. The board only has 512MB of RAM, and this is where NetBSD really shines. Things have become a lot easier since jmcneill@ now provides bootable ARM images for a variety of devices, including the NanoPi NEO2.\n\n\n\n\nI'm back into the grind of FreeBSD's wireless stack and 802.11ac\n\n\nYes, it's been a while since I posted here and yes, it's been a while since I was actively working on FreeBSD's wireless stack. Life's been .. well, life. I started the ath10k port in 2015. I wasn't expecting it to take 5 years, but here we are. My life has changed quite a lot since 2015 and a lot of the things I was doing in 2015 just stopped being fun for a while.\nBut the stars have aligned and it's fun again, so here I am. \n\n\n\n\nNews Roundup\n\nSome thoughts on us overlooking Illumos's syseventadm\n\n\nIn a comment on my praise of ZFS on Linux's ZFS event daemon, Joshua M. Clulow noted that Illumos (and thus OmniOS) has an equivalent in syseventadm, which dates back to Solaris. I hadn't previously known about syseventadm, despite having run Solaris fileservers and OmniOS fileservers for the better part of a decade, and that gives me some tangled feelings.\n\n\n\n\nWhen Unix learned to reboot\n\n\nRecently, a friend asked me the history of halt, and when did we have to stop with the sync / sync / sync dance before running halt or reboot. The two are related, it turns out.\n\n\n\n\nDragonFlyBSD Lands New EXT2/3/4 File-System Driver\n\n\nWhile DragonFlyBSD has its own, original HAMMER2 file-system, for those needing to access data from EXT2/EXT3/EXT4 file-systems, there is a brand new \"ext2fs\" driver implementation for this BSD operating system.\nDragonFlyBSD has long offered an EXT2 file-system driver (that also handles EXT3 and EXT4) while hitting their Git tree this week is a new version. The new sys/vfs/ext2fs driver, which will ultimately replace their existing sys/gnu/vfs/ext2fs driver is based on a port from FreeBSD code. As such, this driver is BSD licensed rather than GPL. But besides the more liberal license to jive with the BSD world, this new driver has various feature/functionality improvements over the prior version. However, there are some known bugs so for the time being both file-system drivers will co-exist.\n\n\n\n\nBeastie Bits\n\n\nLibreOffice 7.0 call for testing\nMore touchpad support\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\nCasey - openbsd wirewall\nDaryl - zfs\nRaymond - hpe microserver\n\n\n\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos&#39;s syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://euroquis.nl/freebsd/2020/07/21/webengine.html\" rel=\"nofollow\">FreeBSD Qt WebEngine GPU Acceleration</a></h3>\n\n<blockquote>\n<p>FreeBSD has a handful of Qt WebEngine-based browsers. Falkon, and Otter-Browser, and qutebrowser and probably others, too. All of them can run into issues on FreeBSD with GPU-accelerated rendering not working. Let’s look at some of the workarounds.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.cambus.net/netbsd-on-the-nanopi-neo2/\" rel=\"nofollow\">NetBSD on the Nanopi Neo2</a></h3>\n\n<blockquote>\n<p>The NanoPi NEO2 from FriendlyARM has been serving me well since 2018, being my test machine for OpenBSD/arm64 related things.<br>\nAs NetBSD/evbarm finally gained support for AArch64 in NetBSD 9.0, released back in February, I decided to give it a try on this device. The board only has 512MB of RAM, and this is where NetBSD really shines. Things have become a lot easier since jmcneill@ now provides bootable ARM images for a variety of devices, including the NanoPi NEO2.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://adrianchadd.blogspot.com/2020/07/im-back-into-grind-of-freebsds-wireless.html\" rel=\"nofollow\">I&#39;m back into the grind of FreeBSD&#39;s wireless stack and 802.11ac</a></h3>\n\n<blockquote>\n<p>Yes, it&#39;s been a while since I posted here and yes, it&#39;s been a while since I was actively working on FreeBSD&#39;s wireless stack. Life&#39;s been .. well, life. I started the ath10k port in 2015. I wasn&#39;t expecting it to take 5 years, but here we are. My life has changed quite a lot since 2015 and a lot of the things I was doing in 2015 just stopped being fun for a while.<br>\nBut the stars have aligned and it&#39;s fun again, so here I am. </p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OverlookingSyseventadm\" rel=\"nofollow\">Some thoughts on us overlooking Illumos&#39;s syseventadm</a></h3>\n\n<blockquote>\n<p>In a comment on my praise of ZFS on Linux&#39;s ZFS event daemon, Joshua M. Clulow noted that Illumos (and thus OmniOS) has an equivalent in syseventadm, which dates back to Solaris. I hadn&#39;t previously known about syseventadm, despite having run Solaris fileservers and OmniOS fileservers for the better part of a decade, and that gives me some tangled feelings.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2020/07/when-unix-learned-to-reboot2.html\" rel=\"nofollow\">When Unix learned to reboot</a></h3>\n\n<blockquote>\n<p>Recently, a friend asked me the history of halt, and when did we have to stop with the sync / sync / sync dance before running halt or reboot. The two are related, it turns out.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-New-EXT2FS\" rel=\"nofollow\">DragonFlyBSD Lands New EXT2/3/4 File-System Driver</a></h3>\n\n<blockquote>\n<p>While DragonFlyBSD has its own, original HAMMER2 file-system, for those needing to access data from EXT2/EXT3/EXT4 file-systems, there is a brand new &quot;ext2fs&quot; driver implementation for this BSD operating system.<br>\nDragonFlyBSD has long offered an EXT2 file-system driver (that also handles EXT3 and EXT4) while hitting their Git tree this week is a new version. The new sys/vfs/ext2fs driver, which will ultimately replace their existing sys/gnu/vfs/ext2fs driver is based on a port from FreeBSD code. As such, this driver is BSD licensed rather than GPL. But besides the more liberal license to jive with the BSD world, this new driver has various feature/functionality improvements over the prior version. However, there are some known bugs so for the time being both file-system drivers will co-exist.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-office/2020-July/005822.html\" rel=\"nofollow\">LibreOffice 7.0 call for testing</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2020/07/15/24747.html\" rel=\"nofollow\">More touchpad support</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/casey%20-%20openbsd%20wirewall.md\" rel=\"nofollow\">Casey - openbsd wirewall</a><br>\n<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/daryl%20-%20zfs.md\" rel=\"nofollow\">Daryl - zfs</a><br>\n<a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/364/feedback/raymond%20-%20hpe%20microserver.md\" rel=\"nofollow\">Raymond - hpe microserver</a></p>\n\n<hr>\n\n<ul>\n<li>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Qt WebEngine GPU Acceleration, the grind of FreeBSD’s wireless stack, thoughts on overlooking Illumos's syseventadm, when Unix learned to reboot, New EXT2/3/4 File-System driver in DragonflyBSD, and more.","date_published":"2020-08-20T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7581b101-10df-4469-8e37-0ddb82f82696.mp3","mime_type":"audio/mpeg","size_in_bytes":41078792,"duration_in_seconds":2818}]},{"id":"5152316f-4859-4e73-8c1c-18f2b9965f5d","title":"363: Traditional Unix toolchains","url":"https://www.bsdnow.tv/363","content_text":"FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD Quarterly Report\n\n\nThis report will be covering FreeBSD related projects between April and June, and covers a diverse set of topics ranging from kernel updates over userland and ports, as well to third-party work.\nSome highlights picked with the roll of a d100 include, but are not limited to, the ability to forcibly unmounting UFS when the underlying media becomes inaccessible, added preliminary support for Bluetooth Low Energy, a introduction to the FreeBSD Office Hours, and a repository of software collections called potluck to be installed with the pot utility, as well as many many more things.\nAs a little treat, readers can also get a rare report from the quarterly team.\nFinally, on behalf of the quarterly team, I would like to extend my deepest appreciation and thank you to salvadore@, who decided to take down his shingle. His contributions not just the quarterly reports themselves, but also the surrounding tooling to many-fold ease the work, are immeasurable.\n\n\n\n\nTraditional Unix Toolchains\n\n\nOlder Unix systems tend to be fairly uniform in how they handle the so-called 'toolchain' for creating binaries. This blog will give a quick overview of the toolchain pipeline for Unix systems that follow the V7 tradition (which evolved along with Unix, a topic for a separate blog maybe).\nUnix is a pipeline based system, either physically or logically. One program takes input, process the data and produces output. The input and output have some interface they obey, usually text-based. The Unix toolchain is no different.\n\n\n\n\nNews Roundup\n\nBastille Day 2020 : v0.7 released\n\n\nThis release matures the project from 0.6.x -&gt; 0.7.x. Continued testing and bug fixes are proving Bastille capable for a range of use-cases. New (experimental) features are examples of innovation from community contribution and feedback. Thank you.\n\n\n\n\nBeastie Bits\n\n\nFinding meltdown on DragonFly\nNetBSD Server Outage\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nVincent - Gnome 3 question\nMalcolm - ZFS question\nHassan - Video question \n\n\nFor those that watch on youtube, don’t forget to subscribe to our new YouTube Channel if you want updates when we post them on YT\n\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2020-04-2020-06.html\" rel=\"nofollow\">FreeBSD Quarterly Report</a></h3>\n\n<blockquote>\n<p>This report will be covering FreeBSD related projects between April and June, and covers a diverse set of topics ranging from kernel updates over userland and ports, as well to third-party work.<br>\nSome highlights picked with the roll of a d100 include, but are not limited to, the ability to forcibly unmounting UFS when the underlying media becomes inaccessible, added preliminary support for Bluetooth Low Energy, a introduction to the FreeBSD Office Hours, and a repository of software collections called potluck to be installed with the pot utility, as well as many many more things.<br>\nAs a little treat, readers can also get a rare report from the quarterly team.<br>\nFinally, on behalf of the quarterly team, I would like to extend my deepest appreciation and thank you to salvadore@, who decided to take down his shingle. His contributions not just the quarterly reports themselves, but also the surrounding tooling to many-fold ease the work, are immeasurable.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2020/07/traditional-unix-toolchains.html?m=1\" rel=\"nofollow\">Traditional Unix Toolchains</a></h3>\n\n<blockquote>\n<p>Older Unix systems tend to be fairly uniform in how they handle the so-called &#39;toolchain&#39; for creating binaries. This blog will give a quick overview of the toolchain pipeline for Unix systems that follow the V7 tradition (which evolved along with Unix, a topic for a separate blog maybe).<br>\nUnix is a pipeline based system, either physically or logically. One program takes input, process the data and produces output. The input and output have some interface they obey, usually text-based. The Unix toolchain is no different.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/BastilleBSD/bastille/releases/tag/0.7.20200714\" rel=\"nofollow\">Bastille Day 2020 : v0.7 released</a></h3>\n\n<blockquote>\n<p>This release matures the project from 0.6.x -&gt; 0.7.x. Continued testing and bug fixes are proving Bastille capable for a range of use-cases. New (experimental) features are examples of innovation from community contribution and feedback. Thank you.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/07/28/24787.html\" rel=\"nofollow\">Finding meltdown on DragonFly</a></li>\n<li><a href=\"https://mobile.twitter.com/netbsd/status/1286898183923277829\" rel=\"nofollow\">NetBSD Server Outage</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/vincent%20-%20gnome3.md\" rel=\"nofollow\">Vincent - Gnome 3 question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/malcolm%20-%20zfs.md\" rel=\"nofollow\">Malcolm - ZFS question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/hassan%20-%20video.md\" rel=\"nofollow\">Hassan - Video question</a> \n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/363/feedback/new-bsdnow-youtube-channel.md\" rel=\"nofollow\">For those that watch on youtube, don’t forget to subscribe to our new YouTube Channel if you want updates when we post them on YT</a></li>\n</ul></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"FreeBSD Q2 Quarterly Status report of 2020, Traditional Unix Toolchains, BastilleBSD 0.7 released, Finding meltdown on DragonflyBSD, and more","date_published":"2020-08-13T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5152316f-4859-4e73-8c1c-18f2b9965f5d.mp3","mime_type":"audio/mpeg","size_in_bytes":36468128,"duration_in_seconds":2085}]},{"id":"5822b2f7-0440-44f4-8f73-70609c960a3d","title":"362: 2.11-BSD restoration","url":"https://www.bsdnow.tv/362","content_text":"Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.\n\nInterview - Warner Losh - imp@freebsd.org / @bsdimp\n\nBSD 2.11 restoration project\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\nSpecial Guest: Warner Losh.","content_html":"<p>Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.</p>\n\n<h4>Interview - Warner Losh - <a href=\"mailto:imp@freebsd.org\" rel=\"nofollow\">imp@freebsd.org</a> / <a href=\"https://twitter.com/bsdimp\" rel=\"nofollow\">@bsdimp</a></h4>\n\n<h2>BSD 2.11 restoration project</h2>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul><p>Special Guest: Warner Losh.</p>","summary":"Interview with Warner Losh about Unix history, the 2.11-BSD restoration project, the Unix heritage society, proper booting, and what devmatch is.","date_published":"2020-08-06T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5822b2f7-0440-44f4-8f73-70609c960a3d.mp3","mime_type":"audio/mpeg","size_in_bytes":58166072,"duration_in_seconds":3750}]},{"id":"e7930697-b2c2-4603-b015-19d1070a7c69","title":"361: Function-based MicroVM","url":"https://www.bsdnow.tv/361","content_text":"Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nEmulex: The Cheapest 10gbe for Your Homelab\n\n\nYears ago, the hunt for the cheapest 10gbe NICs resulted in buying Mellanox ConnectX-2 single-port 10gbe network cards from eBay for around $10. Nowadays those cards have increased in cost to around $20-30. While still cheap, not quite the cheapest. There are now alternatives!\nBefore diving into details, let’s get something very clear. If you want the absolute simplest plug-and-play 10gbe LAN for your homelab, pay the extra for Mellanox. If you’re willing to go hands-on, do some simple manual configuration and installation, read on for my experiences with Emulex 10gbe NICs.\nEmulex NICs can often be had for around $15 on eBay, sometimes even cheaper. I recently picked up a set of 4 of these cards, which came bundled with 6 SFP+ 10g-SR modules for a grand total of $47.48. Considering I can usually find SFP+ modules for about $5/ea, these alone were worth $30.\n\n\nI have also tried some Solarflare cards that I found cheap, they work ok, but are pickier about optics, and tend to be focused on low-latency, so often don’t manage to saturate the full 10 gbps, topping out around 8 gbps.\nI have been using fs.com for optics, patch cables, and DACs. I find DACs are usually cheaper if you are just going between a server and a switch in the same rack, or direct between 2 servers.\n***\n\n\n\nIn Search of 2.11BSD, as released\n\n\nAlmost all of the BSD releases have been well preserved. If you want to find 1BSD, or 2BSD or 4.3-TAHOE BSD you can find them online with little fuss. However, if you search for 2.11BSD, you'll find it easily enough, but it won't be the original. You'll find either the latest patched version (2.11BSD pl 469), or one of the earlier popular version (pl 430 is popular). You can even find the RetroBSD project which used 2.11BSD as a starting point to create systems for tiny mips-based PIC controllers. You'll find every single patch that's been issued for the system.\n\n\n\n\nNews Roundup\n\nFakecracker: NetBSD as a Function Based MicroVM\n\n\nIn November 2018 AWS published an Open Source tool called Firecracker, mostly a virtual machine monitor relying on KVM, a small sized Linux kernel, and a stripped down version of Qemu. What baffled me was the speed at which the virtual machine would fire up and run the service. The whole process is to be compared to a container, but safer, as it does not share the kernel nor any resource, it is a separate and dedicated virtual machine.\nIf you want to learn more on Firecracker‘s internals, here’s a very well put article.\n\n\n\n\nFirst powerpc64 snapshots available for OpenBSD\n\n\nSince we reported the first bits of powerpc64 support going into the tree on 16 May, work has progressed at a steady pace, resulting in snapshots now being available for this platform.\nSo, if you have a POWER9 system idling around, go to your nearest mirror and fetch this snapshot. Keep in mind that as this is still very early days, very little handholding is available - you are basically on your own.\n\n\n\n\nOPNsense 20.1.8 released\n\n\nSorry about the delay while we chased a race condition in the updates back to an issue with the latest FreeBSD package manager updates. For now we reverted to our current version but all relevant third party packages have been updated as updates became available over the last weeks, e.g. cURL and Python, and hostapd / wpa_supplicant amongst others.\n\n\n\n\nBeastie Bits\n\n\nOld School Disk Partitioning\nNomad BSD 1.3.2 Released\nChai-Fi\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nPoojan - ZFS Question\ngraceon - supermicro\nzenbum - groff\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\nSpecial Guest: Warner Losh.","content_html":"<p>Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://vincerants.com/emulex-the-cheapest-10gbe/\" rel=\"nofollow\">Emulex: The Cheapest 10gbe for Your Homelab</a></h3>\n\n<blockquote>\n<p>Years ago, the hunt for the cheapest 10gbe NICs resulted in buying Mellanox ConnectX-2 single-port 10gbe network cards from eBay for around $10. Nowadays those cards have increased in cost to around $20-30. While still cheap, not quite the cheapest. There are now alternatives!<br>\nBefore diving into details, let’s get something very clear. If you want the absolute simplest plug-and-play 10gbe LAN for your homelab, pay the extra for Mellanox. If you’re willing to go hands-on, do some simple manual configuration and installation, read on for my experiences with Emulex 10gbe NICs.<br>\nEmulex NICs can often be had for around $15 on eBay, sometimes even cheaper. I recently picked up a set of 4 of these cards, which came bundled with 6 SFP+ 10g-SR modules for a grand total of $47.48. Considering I can usually find SFP+ modules for about $5/ea, these alone were worth $30.</p>\n\n<ul>\n<li>I have also tried some Solarflare cards that I found cheap, they work ok, but are pickier about optics, and tend to be focused on low-latency, so often don’t manage to saturate the full 10 gbps, topping out around 8 gbps.</li>\n<li>I have been using fs.com for optics, patch cables, and DACs. I find DACs are usually cheaper if you are just going between a server and a switch in the same rack, or direct between 2 servers.\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2020/07/211bsd-original-tapes-recreation.html\" rel=\"nofollow\">In Search of 2.11BSD, as released</a></h3>\n\n<blockquote>\n<p>Almost all of the BSD releases have been well preserved. If you want to find 1BSD, or 2BSD or 4.3-TAHOE BSD you can find them online with little fuss. However, if you search for 2.11BSD, you&#39;ll find it easily enough, but it won&#39;t be the original. You&#39;ll find either the latest patched version (2.11BSD pl 469), or one of the earlier popular version (pl 430 is popular). You can even find the RetroBSD project which used 2.11BSD as a starting point to create systems for tiny mips-based PIC controllers. You&#39;ll find every single patch that&#39;s been issued for the system.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://imil.net/blog/posts/2020/fakecracker-netbsd-as-a-function-based-microvm/\" rel=\"nofollow\">Fakecracker: NetBSD as a Function Based MicroVM</a></h3>\n\n<blockquote>\n<p>In November 2018 AWS published an Open Source tool called Firecracker, mostly a virtual machine monitor relying on KVM, a small sized Linux kernel, and a stripped down version of Qemu. What baffled me was the speed at which the virtual machine would fire up and run the service. The whole process is to be compared to a container, but safer, as it does not share the kernel nor any resource, it is a separate and dedicated virtual machine.<br>\nIf you want to learn more on Firecracker‘s internals, here’s a very well put article.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20200707001113\" rel=\"nofollow\">First powerpc64 snapshots available for OpenBSD</a></h3>\n\n<blockquote>\n<p>Since we reported the first bits of powerpc64 support going into the tree on 16 May, work has progressed at a steady pace, resulting in snapshots now being available for this platform.<br>\nSo, if you have a POWER9 system idling around, go to your nearest mirror and fetch this snapshot. Keep in mind that as this is still very early days, very little handholding is available - you are basically on your own.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-1-8-released/\" rel=\"nofollow\">OPNsense 20.1.8 released</a></h3>\n\n<blockquote>\n<p>Sorry about the delay while we chased a race condition in the updates back to an issue with the latest FreeBSD package manager updates. For now we reverted to our current version but all relevant third party packages have been updated as updates became available over the last weeks, e.g. cURL and Python, and hostapd / wpa_supplicant amongst others.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://bsdimp.blogspot.com/2020/07/old-school-disk-partitioning.html\" rel=\"nofollow\">Old School Disk Partitioning</a></li>\n<li><a href=\"http://nomadbsd.org/index.html#1.3.2\" rel=\"nofollow\">Nomad BSD 1.3.2 Released</a></li>\n<li><a href=\"https://github.com/gonzoua/chaifi\" rel=\"nofollow\">Chai-Fi</a></li>\n</ul>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/Poojan%20-%20ZFS%20question.md\" rel=\"nofollow\">Poojan - ZFS Question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/graceon%20-%20supermicro.md\" rel=\"nofollow\">graceon - supermicro</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/361/feedback/zenbum%20-%20groff.md\" rel=\"nofollow\">zenbum - groff</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul><p>Special Guest: Warner Losh.</p>","summary":"Emulex: The Cheapest 10gbe for Your Homelab, In Search of 2.11BSD, as released, Fakecracker: NetBSD as a Function Based MicroVM, First powerpc64 snapshots available for OpenBSD, OPNsense 20.1.8 released, and more.\r\n","date_published":"2020-07-30T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e7930697-b2c2-4603-b015-19d1070a7c69.mp3","mime_type":"audio/mpeg","size_in_bytes":64248344,"duration_in_seconds":3730}]},{"id":"69d88af7-54da-4612-9fc2-84ffae001c46","title":"360: Full circle","url":"https://www.bsdnow.tv/360","content_text":"Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nChasing a bad commit\n\n\nWhile working on a big project where multiple teams merge their feature branches frequently into a release Git branch, developers often run into situations where they find that some of their work have been either removed, modified or affected by someone else's work accidentally. It can happen in smaller teams as well. Two features could have been working perfectly fine until they got merged together and broke something. That's a highly possible case. There are many other cases which could cause such hard to understand and subtle bugs which even continuous integration (CI) systems running the entire test suite of our projects couldn't catch.\nWe are not going to discuss how such subtle bugs can get into our release branch because that's just a wild territory out there. Instead, we can definitely discuss about how to find a commit that deviated from an expected outcome of a certain feature. The deviation could be any behaviour of our code that we can measure distinctively — either good or bad in general.\n\n\n\n\nNew FreeBSD Core Team Elected\n\n\nThe FreeBSD Project is pleased to announce the completion of the 2020 Core Team election. Active committers to the project have elected your Eleventh FreeBSD Core Team.!\n\n\n\nBaptiste Daroussin (bapt)\nEd Maste (emaste)\nGeorge V. Neville-Neil (gnn)\nHiroki Sato (hrs)\nKyle Evans (kevans)\nMark Johnston (markj)\nScott Long (scottl)\nSean Chittenden (seanc)\nWarner Losh (imp)\n***\n\n\nNews Roundup\n\nGetting Started with NetBSD on the Pinebook Pro\n\n\nIf you buy a Pinebook Pro now, it comes with Manjaro Linux on the internal eMMC storage. Let’s install NetBSD instead!\nThe easiest way to get started is to buy a decent micro-SD card (what sort of markings it should have is a science of its own, by the way) and install NetBSD on that. On a warm boot (i.e. when rebooting a running system), the micro-SD card has priority compared to the eMMC, so the system will boot from there.\n\n\nA FreeBSD developer has borrowed some of the NetBSD code to get audio working on RockPro64 and Pinebook Pro: https://twitter.com/kernelnomicon/status/1282790609778905088\n***\n\n\n\nFreeBSD on the Intel 10th Gen i3 NUC\n\n\nI have ended up with some 10th Gen i3 NUC's (NUC10i3FNH to be specific) to put to work in my testbed. These are quite new devices, the build date on the boxes is 13APR2020. Before I figure out what their true role is (one of them might have to run linux) I need to install FreeBSD -CURRENT and see how performance and hardware support is.\n\n\n\n\npf table size check and change\n\n\nDid you know there’s a default size limit to pf’s state table?  I did not, but it makes sense that there is one.  If for some reason you bump into this limit (difficult for home use, I’d think), here’s how you change it\nThere is a table-entries limit specified, you can see current settings with\n'pfctl -s all'.  You can adjust the limits in the /etc/pf.conf file\ncontaining the rules with a line like this near the top:\nset limit table-entries 100000\n\n\nIn the original mail thread, there is mention of the FreeBSD sysctl net.pf.request_maxcount, which controls the maximum number of entries that can be sent as a single ioctl(). This allows the user to adjust the memory limit for how big of a list the kernel is willing to allocate memory for.\n***\n\n\n\nBeastie Bits\n\n\ntmux and bhyve\nAzure and FreeBSD\nGroff Tutorial\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\nTarsnap Mastery\n\n\nFeedback/Questions\n\n\nChris - ZFS Question\nPatrick - Tarsnap\nPin - pkgsrc\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://vishaltelangre.com/chasing-a-bad-commit/\" rel=\"nofollow\">Chasing a bad commit</a></h3>\n\n<blockquote>\n<p>While working on a big project where multiple teams merge their feature branches frequently into a release Git branch, developers often run into situations where they find that some of their work have been either removed, modified or affected by someone else&#39;s work accidentally. It can happen in smaller teams as well. Two features could have been working perfectly fine until they got merged together and broke something. That&#39;s a highly possible case. There are many other cases which could cause such hard to understand and subtle bugs which even continuous integration (CI) systems running the entire test suite of our projects couldn&#39;t catch.<br>\nWe are not going to discuss how such subtle bugs can get into our release branch because that&#39;s just a wild territory out there. Instead, we can definitely discuss about how to find a commit that deviated from an expected outcome of a certain feature. The deviation could be any behaviour of our code that we can measure distinctively — either good or bad in general.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.freebsdnews.com/2020/07/14/new-freebsd-core-team-elected/\" rel=\"nofollow\">New FreeBSD Core Team Elected</a></h3>\n\n<blockquote>\n<p>The FreeBSD Project is pleased to announce the completion of the 2020 Core Team election. Active committers to the project have elected your Eleventh FreeBSD Core Team.!</p>\n</blockquote>\n\n<ul>\n<li>Baptiste Daroussin (bapt)</li>\n<li>Ed Maste (emaste)</li>\n<li>George V. Neville-Neil (gnn)</li>\n<li>Hiroki Sato (hrs)</li>\n<li>Kyle Evans (kevans)</li>\n<li>Mark Johnston (markj)</li>\n<li>Scott Long (scottl)</li>\n<li>Sean Chittenden (seanc)</li>\n<li>Warner Losh (imp)\n***</li>\n</ul>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://bentsukun.ch/posts/pinebook-pro-netbsd/\" rel=\"nofollow\">Getting Started with NetBSD on the Pinebook Pro</a></h3>\n\n<blockquote>\n<p>If you buy a Pinebook Pro now, it comes with Manjaro Linux on the internal eMMC storage. Let’s install NetBSD instead!<br>\nThe easiest way to get started is to buy a decent micro-SD card (what sort of markings it should have is a science of its own, by the way) and install NetBSD on that. On a warm boot (i.e. when rebooting a running system), the micro-SD card has priority compared to the eMMC, so the system will boot from there.</p>\n\n<ul>\n<li>A FreeBSD developer has borrowed some of the NetBSD code to get audio working on RockPro64 and Pinebook Pro: <a href=\"https://twitter.com/kernelnomicon/status/1282790609778905088\" rel=\"nofollow\">https://twitter.com/kernelnomicon/status/1282790609778905088</a>\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://adventurist.me/posts/00300\" rel=\"nofollow\">FreeBSD on the Intel 10th Gen i3 NUC</a></h3>\n\n<blockquote>\n<p>I have ended up with some 10th Gen i3 NUC&#39;s (NUC10i3FNH to be specific) to put to work in my testbed. These are quite new devices, the build date on the boxes is 13APR2020. Before I figure out what their true role is (one of them might have to run linux) I need to install FreeBSD -CURRENT and see how performance and hardware support is.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2020/06/29/24698.html\" rel=\"nofollow\">pf table size check and change</a></h3>\n\n<blockquote>\n<p>Did you know there’s a default size limit to pf’s state table?  I did not, but it makes sense that there is one.  If for some reason you bump into this limit (difficult for home use, I’d think), <a href=\"http://lists.dragonflybsd.org/pipermail/users/2020-June/381261.html\" rel=\"nofollow\">here’s how you change it</a><br>\nThere is a table-entries limit specified, you can see current settings with<br>\n&#39;pfctl -s all&#39;.  You can adjust the limits in the /etc/pf.conf file<br>\ncontaining the rules with a line like this near the top:<br>\n<code>set limit table-entries 100000</code></p>\n\n<ul>\n<li>In the original mail thread, there is mention of the FreeBSD sysctl net.pf.request_maxcount, which controls the maximum number of entries that can be sent as a single ioctl(). This allows the user to adjust the memory limit for how big of a list the kernel is willing to allocate memory for.\n***</li>\n</ul>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://callfortesting.org/tmux/\" rel=\"nofollow\">tmux and bhyve</a></li>\n<li><a href=\"https://azuremarketplace.microsoft.com/en-us/marketplace/apps/thefreebsdfoundation.freebsd-12_1\" rel=\"nofollow\">Azure and FreeBSD</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=bvkmnK6-qao&feature=youtu.be\" rel=\"nofollow\">Groff Tutorial</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n<a href=\"https://mwl.io/nonfiction/tools#tarsnap\" rel=\"nofollow\">Tarsnap Mastery</a></li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Chris%20-%20zfs%20question.md\" rel=\"nofollow\">Chris - ZFS Question</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/Patrick%20-%20Tarsnap.md\" rel=\"nofollow\">Patrick - Tarsnap</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/360/feedback/pin%20-%20pkgsrc.md\" rel=\"nofollow\">Pin - pkgsrc</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Chasing a bad commit, New FreeBSD Core Team elected, Getting Started with NetBSD on the Pinebook Pro, FreeBSD on the Intel 10th Gen i3 NUC, pf table size check and change, and more.","date_published":"2020-07-23T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/69d88af7-54da-4612-9fc2-84ffae001c46.mp3","mime_type":"audio/mpeg","size_in_bytes":42925160,"duration_in_seconds":2547}]},{"id":"b066740d-03a5-423b-9ab9-8936c3246979","title":"359: Throwaway Browser","url":"https://www.bsdnow.tv/359","content_text":"Throw-Away Browser on FreeBSD With \"pot\" within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nThrow-Away Browser on FreeBSD With \"pot\" Within 5 Minutes\n\n\npot is a great and relatively new jail management tool. It offers DevOps style provisioning and can even be used to provide Docker-like, scalable cloud services together with nomad and consul (more about this in Orchestrating jails with nomad and pot).\n\n\n\n\nOpenBSD guest with bhyve - OmniOS\n\n\nToday I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.\nThis post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.\n\n\n\n\nNews Roundup\n\nBSD versus Linux distribution development\n\n\nQ: Comparing-apples-to-BSDs asks: I was reading one of the old articles from the archive. One of the things mentioned was how the BSDs have a distinct approach in terms of packaging the base system relative to userland apps, and that the Linux distros at the time were not following the same practice. Are there Linux distros that have adopted the same approach in modern times? If not, are there technical limitations that are preventing them from doing so, such as some distros supporting multiple kernel versions maybe?\nDistroWatch answers: In the article mentioned above, I made the observation that Linux distributions tend to take one of two approaches when it comes to packaging software. Generally a Linux distribution will either offer a rolling release, where virtually all packages are regularly upgraded to their latest stable releases, or a fixed release where almost all packages are kept at a set version number and only receive bug fixes for the life cycle of the distribution. Projects like Arch Linux and Void are popular examples of rolling, always-up-to-date distributions while Fedora and Ubuntu offer fixed platforms.\n\n\n\nMy FreeBSD Laptop Build\n\nI have always liked Thinkpad hardware and when I started to do more commuting I decided I needed something that had a decent sized screen but fit well on a bus. Luckily about this time Lenovo gave me a nice gift in the Thinkpad X390. Its basically the famous X2xx series but with a 13” screen and smaller bezel.\nSo with this laptop I figured it was time to actually put the docs together on how I got my FreeBSD workstation working on it. I will here in the near future have another post that will cover this for HardenedBSD as well since the steps are similar but have a few extra gotchas due to the extra hardening.\n\n\n\nFreeBSD CURRENT Binary Upgrades\n\n\nDisclaimer\nThis proof-of-concept is not a publication of FreeBSD.\nDescription\nup.bsd.lv is a proof-of-concept of binary updates for FreeBSD/amd64 CURRENT/HEAD to facilitate the exhaustive testing of FreeBSD and the bhyve hypervisor and OpenZFS 2.0 specifically. Updates are based on the SVN revisions of official FreeBSD Release Engineering bi-monthly snapshots.\n\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nKarl - pfsense\nVal - esxi question\nlars - openbsd router hardware\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Throw-Away Browser on FreeBSD With &quot;pot&quot; within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://honeyguide.eu/posts/pot-throwaway-firefox/\" rel=\"nofollow\">Throw-Away Browser on FreeBSD With &quot;pot&quot; Within 5 Minutes</a></h3>\n\n<blockquote>\n<p>pot is a great and relatively new jail management tool. It offers DevOps style provisioning and can even be used to provide Docker-like, scalable cloud services together with nomad and consul (more about this in Orchestrating jails with nomad and pot).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.pbdigital.org/omniosce/bhyve/openbsd/2020/06/08/bhyve-zones-omnios.html\" rel=\"nofollow\">OpenBSD guest with bhyve - OmniOS</a></h3>\n\n<blockquote>\n<p>Today I will be creating a OpenBSD guest via bhyve on OmniOS. I will also be adding a Pass Through Ethernet Controller so I can have a multi-homed guest that will serve as a firewall/router.<br>\nThis post will cover setting up bhyve on OmniOS, so it will also be a good introduction to bhyve. As well, I look into OpenBSD’s uEFI boot loader so if you have had trouble with this, then you are in the right place.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://distrowatch.com/weekly.php?issue=20200622#qa\" rel=\"nofollow\">BSD versus Linux distribution development</a></h3>\n\n<blockquote>\n<p>Q: Comparing-apples-to-BSDs asks: I was reading one of the old articles from the archive. One of the things mentioned was how the BSDs have a distinct approach in terms of packaging the base system relative to userland apps, and that the Linux distros at the time were not following the same practice. Are there Linux distros that have adopted the same approach in modern times? If not, are there technical limitations that are preventing them from doing so, such as some distros supporting multiple kernel versions maybe?<br>\nDistroWatch answers: In the article mentioned above, I made the observation that Linux distributions tend to take one of two approaches when it comes to packaging software. Generally a Linux distribution will either offer a rolling release, where virtually all packages are regularly upgraded to their latest stable releases, or a fixed release where almost all packages are kept at a set version number and only receive bug fixes for the life cycle of the distribution. Projects like Arch Linux and Void are popular examples of rolling, always-up-to-date distributions while Fedora and Ubuntu offer fixed platforms.</p>\n\n<hr>\n\n<h3><a href=\"https://corrupted.io/2020/06/21/my-freebsd-laptop-build.html\" rel=\"nofollow\">My FreeBSD Laptop Build</a></h3>\n\n<p>I have always liked Thinkpad hardware and when I started to do more commuting I decided I needed something that had a decent sized screen but fit well on a bus. Luckily about this time Lenovo gave me a nice gift in the Thinkpad X390. Its basically the famous X2xx series but with a 13” screen and smaller bezel.<br>\nSo with this laptop I figured it was time to actually put the docs together on how I got my FreeBSD workstation working on it. I will here in the near future have another post that will cover this for HardenedBSD as well since the steps are similar but have a few extra gotchas due to the extra hardening.</p>\n\n<hr>\n\n<h3><a href=\"http://up.bsd.lv\" rel=\"nofollow\">FreeBSD CURRENT Binary Upgrades</a></h3>\n\n<ul>\n<li>Disclaimer\nThis proof-of-concept is not a publication of FreeBSD.</li>\n<li>Description\nup.bsd.lv is a proof-of-concept of binary updates for FreeBSD/amd64 CURRENT/HEAD to facilitate the exhaustive testing of FreeBSD and the bhyve hypervisor and OpenZFS 2.0 specifically. Updates are based on the SVN revisions of official FreeBSD Release Engineering bi-monthly snapshots.</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Karl%20-%20pfsense.md\" rel=\"nofollow\">Karl - pfsense</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/Val%20-%20esxi%20question.md\" rel=\"nofollow\">Val - esxi question</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/359/Feedback/lars%20-%20openbsd%20router%20hardware.md\" rel=\"nofollow\">lars - openbsd router hardware</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Throw-Away Browser on FreeBSD With \"pot\" within 5 minutes, OmniOS as OpenBSD guest with bhyve, BSD vs Linux distro development, My FreeBSD Laptop Build, FreeBSD CURRENT Binary Upgrades, and more.","date_published":"2020-07-16T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b066740d-03a5-423b-9ab9-8936c3246979.mp3","mime_type":"audio/mpeg","size_in_bytes":44787992,"duration_in_seconds":2605}]},{"id":"dd2d31ad-23bc-492d-b813-caf9f661e315","title":"358: OpenBSD Kubernetes Clusters","url":"https://www.bsdnow.tv/358","content_text":"Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nyubikey-agent on FreeBSD\n\n\nSome time ago Filippo Valsorda wrote yubikey-agent, seamless SSH agent for YubiKeys. I really like YubiKeys and worked on the FreeBSD support for U2F in Chromium and pyu2f, getting yubikey-agent ported looked like an interesting project. It took some hacking to make it work but overall it wasn’t hard. Following is the roadmap on how to get it set up on FreeBSD. The actual details depend on your system (as you will see)\n\n\n\n\nManage Kubernetes clusters from OpenBSD\n\n\nThis should work with OpenBSD 6.7. I write this while the source tree is locked for release, so even if I use -current this is as close as -current gets to -release\nUpdate 2020-06-05: we now have a port for kubectl. So, at least in -current things get a bit easier.\n\n\n\n\nNews Roundup\n\nHistory of FreeBSD Part 1: Unix and BSD\n\n\nFreeBSD, a free and open-source Unix-like operating system has been around since 1993. However, its origins are directly linked to that of BSD, and further back, those of Unix. During this History of FreeBSD series, we will talk about how Unix came to be, and how Berkeley’s Unix developed at Bell Labs.\n\n\n\n\nRunning Jitsi-Meet in a FreeBSD Jail\n\n\nDue to the situation with COVID-19 that also lead to people being confined to their homes in South Africa as well, we decided to provide a (freely usable of course) Jitsi Meet instance to the community being hosted in South Africa on our FreeBSD environment.\nThat way, communities in South Africa and beyond have a free alternative to the commercial conferencing solutions with sometimes dubious security and privacy histories and at the same time improved user experience due to the lower latency of local hosting.\n\n\nGrafana for Jitsi-Meet\n***\n\n\n\nCommand Line Bug Hunting in FreeBSD\n\n\nFreeBSD uses bugzilla for tracking bugs, taking feature requests, regressions and issues in the Operating System. The web interface for bugzilla is okay, but if you want to do a lot of batch operations it is slow to deal with. We are planning to run a bugsquash on July 11th and that really needs some tooling to help any hackers that show up process the giant bug list we have.\n\n\n\n\nBeastie Bits\n\n\nGame of Github\n+ Wireguard official merged into OpenBSD\n***\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nFlorian : Lua for $HOME\nKevin : FreeBSD Source Question\nTom : HomeLabs\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://kernelnomicon.org/?p=855\" rel=\"nofollow\">yubikey-agent on FreeBSD</a></h3>\n\n<blockquote>\n<p>Some time ago Filippo Valsorda wrote yubikey-agent, seamless SSH agent for YubiKeys. I really like YubiKeys and worked on the FreeBSD support for U2F in Chromium and pyu2f, getting yubikey-agent ported looked like an interesting project. It took some hacking to make it work but overall it wasn’t hard. Following is the roadmap on how to get it set up on FreeBSD. The actual details depend on your system (as you will see)</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://e1e0.net/manage-k8s-from-openbsd.html\" rel=\"nofollow\">Manage Kubernetes clusters from OpenBSD</a></h3>\n\n<blockquote>\n<p>This should work with OpenBSD 6.7. I write this while the source tree is locked for release, so even if I use -current this is as close as -current gets to -release<br>\nUpdate 2020-06-05: we now have a port for kubectl. So, at least in -current things get a bit easier.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://klarasystems.com/articles/history-of-freebsd-unix-and-bsd/?utm_source=bsdnow\" rel=\"nofollow\">History of FreeBSD Part 1: Unix and BSD</a></h3>\n\n<blockquote>\n<p>FreeBSD, a free and open-source Unix-like operating system has been around since 1993. However, its origins are directly linked to that of BSD, and further back, those of Unix. During this History of FreeBSD series, we will talk about how Unix came to be, and how Berkeley’s Unix developed at Bell Labs.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://honeyguide.eu/posts/jitsi-freebsd/\" rel=\"nofollow\">Running Jitsi-Meet in a FreeBSD Jail</a></h3>\n\n<blockquote>\n<p>Due to the situation with COVID-19 that also lead to people being confined to their homes in South Africa as well, we decided to provide a (freely usable of course) Jitsi Meet instance to the community being hosted in South Africa on our FreeBSD environment.<br>\nThat way, communities in South Africa and beyond have a free alternative to the commercial conferencing solutions with sometimes dubious security and privacy histories and at the same time improved user experience due to the lower latency of local hosting.</p>\n\n<ul>\n<li><a href=\"https://honeyguide.eu/posts/jitsi-grafana/\" rel=\"nofollow\">Grafana for Jitsi-Meet</a>\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://adventurist.me/posts/00301\" rel=\"nofollow\">Command Line Bug Hunting in FreeBSD</a></h3>\n\n<blockquote>\n<p>FreeBSD uses bugzilla for tracking bugs, taking feature requests, regressions and issues in the Operating System. The web interface for bugzilla is okay, but if you want to do a lot of batch operations it is slow to deal with. We are planning to run a bugsquash on July 11th and that really needs some tooling to help any hackers that show up process the giant bug list we have.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://glebbahmutov.com/game-of-github/\" rel=\"nofollow\">Game of Github</a></li>\n<li>+ <a href=\"https://marc.info/?l=openbsd-cvs&m=159274150512676&w=2\" rel=\"nofollow\">Wireguard official merged into OpenBSD</a>\n***</li>\n</ul>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Florian%20-%20Lua%20for%20%24HOME\" rel=\"nofollow\">Florian : Lua for $HOME</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Kevin%20-%20FreeBSD%20Source%20Question\" rel=\"nofollow\">Kevin : FreeBSD Source Question</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/358/feedback/Tom%20-%20HomeLabs\" rel=\"nofollow\">Tom : HomeLabs</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"Yubikey-agent on FreeBSD, Managing Kubernetes clusters from OpenBSD, History of FreeBSD part 1, Running Jitsi-Meet in a FreeBSD Jail, Command Line Bug Hunting in FreeBSD, Game of Github, Wireguard official merged into OpenBSD, and more","date_published":"2020-07-09T09:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/dd2d31ad-23bc-492d-b813-caf9f661e315.mp3","mime_type":"audio/mpeg","size_in_bytes":43199240,"duration_in_seconds":2612}]},{"id":"3155c049-a0b4-4449-9ecb-1f820e68f542","title":"357: Study the Code","url":"https://www.bsdnow.tv/357","content_text":"OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nOpenBSD 6.7 on PC Engines APU4D4\n\n\nI just got myself a PC Engines APU4D4. I miss an OpenBSD box providing home services. It’s quite simple to install and run OpenBSD on this machine. And you can even update the BIOS from OpenBSD.\n\n\n\nNetBSD code study\n\n\n\n\nNews Roundup\n\nBooting FreeBSD off the HPE MicroServer Gen8 ODD SATA port\n\n\nMy small homelab post generated a ton of questions and comments, most of them specific to running FreeBSD on the HP MicroServer. I’ll try and answer these over the coming week.\nJosh Paxton emailed to ask how I got FreeBSD booting on it, given the unconventional booting limitations of the hardware. I thought I wrote about it a few years ago, but maybe it’s on my proverbial draft heap. If you’re impatient, the script is in my lunchbox.\n\n\n\n\n3 ways to multiboot\n\n\nmultiboot installation of a BSD system with other operating systems\n(OSs) on UEFI hardware is not officially supported by any of the\npopular\n\n\n\n\nBeastie Bits\n\n\npfSense2.4.5-Release-p1 now available\nBSDCan 2020 TomSmyth - OpenBSD And OpenBGPD As ISP Controlplane\nOpenBSD DRM Update\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\n James - Apple T2\nMichael - Jordyns ZFS Question\n\n\nNote from JT\n\nRob - FreeBSD Freindly Registrar\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.tumfatig.net/20200530/openbsd-6-7-on-pc-engines-apu4d4/\" rel=\"nofollow\">OpenBSD 6.7 on PC Engines APU4D4</a></h3>\n\n<blockquote>\n<p>I just got myself a PC Engines APU4D4. I miss an OpenBSD box providing home services. It’s quite simple to install and run OpenBSD on this machine. And you can even update the BIOS from OpenBSD.</p>\n\n<hr>\n\n<h3><a href=\"http://silas.net.br/codereading/netbsd-code.html\" rel=\"nofollow\">NetBSD code study</a></h3>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://rubenerd.com/booting-freebsd-off-the-microserver-odd-sata-port/\" rel=\"nofollow\">Booting FreeBSD off the HPE MicroServer Gen8 ODD SATA port</a></h3>\n\n<blockquote>\n<p>My small homelab post generated a ton of questions and comments, most of them specific to running FreeBSD on the HP MicroServer. I’ll try and answer these over the coming week.<br>\nJosh Paxton emailed to ask how I got FreeBSD booting on it, given the unconventional booting limitations of the hardware. I thought I wrote about it a few years ago, but maybe it’s on my proverbial draft heap. If you’re impatient, the script is in my lunchbox.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://marc.info/?l=openbsd-misc&m=159146428705118&w=2\" rel=\"nofollow\">3 ways to multiboot</a></h3>\n\n<blockquote>\n<p>multiboot installation of a BSD system with other operating systems<br>\n(OSs) on UEFI hardware is not officially supported by any of the<br>\npopular</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.netgate.com/blog/pfsense-2-4-5-release-p1-now-available.html\" rel=\"nofollow\">pfSense2.4.5-Release-p1 now available</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=_eOVlaYWqS8\" rel=\"nofollow\">BSDCan 2020 TomSmyth - OpenBSD And OpenBGPD As ISP Controlplane</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20200608075708\" rel=\"nofollow\">OpenBSD DRM Update</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/James%20-%20Apple%20T2\" rel=\"nofollow\"> James - Apple T2</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Michael%20-%20Jordyns%20ZFS%20Question\" rel=\"nofollow\">Michael - Jordyns ZFS Question</a></p>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Note%20from%20JT\" rel=\"nofollow\">Note from JT</a></li>\n</ul></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/357/feedback/Rob%20-%20FreeBSD%20Freindly%20Registrar\" rel=\"nofollow\">Rob - FreeBSD Freindly Registrar</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"OpenBSD 6.7 on PC Engines, NetBSD code study, DRM Update on OpenBSD, Booting FreeBSD on HPE Microserver SATA port, 3 ways to multiboot, and more.","date_published":"2020-07-02T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3155c049-a0b4-4449-9ecb-1f820e68f542.mp3","mime_type":"audio/mpeg","size_in_bytes":36249920,"duration_in_seconds":2279}]},{"id":"666c3655-32bf-4341-a986-ab085baa9c10","title":"356: Dig in Deeper","url":"https://www.bsdnow.tv/356","content_text":"TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nTrueNAS is Multi-OS\n\n\nThere was a time in history where all that mattered was an Operating System (OS) and the hardware it ran on — the “pre-software era”, if you will. Your hardware dictated the OS you used.\nOnce software applications became prominent, your hardware’s OS determined the applications you could run. Application vendors were forced to juggle the burden of “portability” between OS platforms, choosing carefully the operating systems they’d develop their software to. Then, there were the great OS Wars of the 1990s, replete with the rampant competition, licensing battles, and nasty lawsuits, which more or less gave birth to the “open source OS” era.\nThe advent of the hypervisor simultaneously gave way to the “virtual era” which set us on a path of agnosticism toward the OS. Instead of choosing from the applications available for your chosen OS, you could simply install another OS on the same hardware for your chosen application. The OS became nothing but a necessary cog in the stack.\nTrueNAS open storage enables this “post-OS era” with support for storage clients of all UNIX flavors, Linux, FreeBSD, Windows, MacOS, VMware, Citrix, and many others. Containerization has carried that mentality even further. An operating system, like the hardware that runs it, is now just thought of as part of the “infrastructure”.\n\n\n\nEncrypted ZFS on NetBSD 9.0, for a FreeBSD guy\n\nI had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?\n\n\n\n\nNews Roundup\n\nFreeBSD's New Code of Conduct\n\n\nFreeBSD Announcement Email\n\n\n\n\nGaming on OpenBSD\n\n\nWhile no one would expect this, there are huge efforts from a small team to bring more games into OpenBSD. In fact, now some commercial games works natively now, thanks to Mono or Java. There are no wine or linux emulation layer in OpenBSD.\nHere is a small list of most well known games that run on OpenBSD:\n\n\n\n'dig' a little deeper\n\nI knew the existence of the dig command but didn't exactly know when and how to use it. Then, just recently I encountered an issue that allowed me to learn and make use of it.\n\n\n\nHAMMER2 and periodic snapshots\n\nThe first version of HAMMER took automatic snapshots, set within the config for each filesystem.  HAMMER2 now also takes automatic snapshots, via periodic(8) like most every repeating task on your DragonFly system.\n\n\ngit: Implement periodic hammer2 snapshots\n***\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nCy - OpenSSL relicensing\nChristian - lagg vlans and iocage\nBrad - SMR\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-multi-os/\" rel=\"nofollow\">TrueNAS is Multi-OS</a></h3>\n\n<blockquote>\n<p>There was a time in history where all that mattered was an Operating System (OS) and the hardware it ran on — the “pre-software era”, if you will. Your hardware dictated the OS you used.<br>\nOnce software applications became prominent, your hardware’s OS determined the applications you could run. Application vendors were forced to juggle the burden of “portability” between OS platforms, choosing carefully the operating systems they’d develop their software to. Then, there were the great OS Wars of the 1990s, replete with the rampant competition, licensing battles, and nasty lawsuits, which more or less gave birth to the “open source OS” era.<br>\nThe advent of the hypervisor simultaneously gave way to the “virtual era” which set us on a path of agnosticism toward the OS. Instead of choosing from the applications available for your chosen OS, you could simply install another OS on the same hardware for your chosen application. The OS became nothing but a necessary cog in the stack.<br>\nTrueNAS open storage enables this “post-OS era” with support for storage clients of all UNIX flavors, Linux, FreeBSD, Windows, MacOS, VMware, Citrix, and many others. Containerization has carried that mentality even further. An operating system, like the hardware that runs it, is now just thought of as part of the “infrastructure”.</p>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/encrypted-zfs-on-netbsd-9-for-a-freebsd-guy/\" rel=\"nofollow\">Encrypted ZFS on NetBSD 9.0, for a FreeBSD guy</a></h3>\n\n<p>I had one of my other HP Microservers brought back from the office last week to help with this working-from-home world we’re in right now. I was going to wipe an old version of Debian Wheezy/Xen and install FreeBSD to mirror my other machines before thinking: why not NetBSD?</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.freebsd.org/internal/code-of-conduct.html\" rel=\"nofollow\">FreeBSD&#39;s New Code of Conduct</a></h3>\n\n<ul>\n<li><a href=\"https://raw.githubusercontent.com/BSDNow/bsdnow.tv/master/episodes/356/FBSD-CoC-Email\" rel=\"nofollow\">FreeBSD Announcement Email</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-06-05-openbsd-gaming.html\" rel=\"nofollow\">Gaming on OpenBSD</a></h3>\n\n<blockquote>\n<p>While no one would expect this, there are huge efforts from a small team to bring more games into OpenBSD. In fact, now some commercial games works natively now, thanks to Mono or Java. There are no wine or linux emulation layer in OpenBSD.<br>\nHere is a small list of most well known games that run on OpenBSD:</p>\n\n<hr>\n\n<h3><a href=\"https://vishaltelangre.com/dig-a-little-deeper/\" rel=\"nofollow\">&#39;dig&#39; a little deeper</a></h3>\n\n<p>I knew the existence of the dig command but didn&#39;t exactly know when and how to use it. Then, just recently I encountered an issue that allowed me to learn and make use of it.</p>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2020/06/15/24635.html\" rel=\"nofollow\">HAMMER2 and periodic snapshots</a></h3>\n\n<p>The first version of HAMMER took automatic snapshots, set within the config for each filesystem.  HAMMER2 now also takes automatic snapshots, via periodic(8) like most every repeating task on your DragonFly system.</p>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2020-June/769247.html\" rel=\"nofollow\">git: Implement periodic hammer2 snapshots</a>\n***</li>\n</ul>\n</blockquote>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Cy%20-%20OPenSSL%20relicensing.md\" rel=\"nofollow\">Cy - OpenSSL relicensing</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Christian%20-%20lagg%20vlans%20and%20iocage\" rel=\"nofollow\">Christian - lagg vlans and iocage</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/356/feedback/Brad%20-%20SMR\" rel=\"nofollow\">Brad - SMR</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"TrueNAS is Multi-OS, Encrypted ZFS on NetBSD, FreeBSD’s new Code of Conduct, Gaming on OpenBSD, dig a little deeper, Hammer2 and periodic snapshots, and more.","date_published":"2020-06-25T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/666c3655-32bf-4341-a986-ab085baa9c10.mp3","mime_type":"audio/mpeg","size_in_bytes":31946816,"duration_in_seconds":1928}]},{"id":"369decb7-b522-4745-b385-2339d05211d9","title":"355: Man Page Origins","url":"https://www.bsdnow.tv/355","content_text":"Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nHow to Upgrade OpenBSD and Build a Kernel\n\n\nLet's see how to upgrade your OpenBSD system. Maybe you are doing this because the latest release just came out. If so, this is pretty simple: back up your data, boot from install media, and select \"Upgrade\" instead of \"Install\". But maybe the latest release has been out for a few months. Why would we go through the trouble of building and installing a new kernel or other core system components? Maybe some patches have been released to improve system security or stability. It is pretty easy to build and install a kernel on OpenBSD, easier and simpler in many ways than it is on Linux.\n\n\n\n\nThe History of man pages\n\n\nWhere do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage authors: where were those economical two- and three-letter instructions developed?\n\n\n\n\nVAX port needs help\n\n\nThe VAX is the oldest machine architecture still supported by NetBSD.\nUnfortunately there is another challenge, totally outside of NetBSD, but affecting the VAX port big time: the compiler support for VAX is ... let's say sub-optimal. It is also risking to be dropped completely by gcc upstream.\nNow here is where people can help: there is a bounty campaign to finance a gcc hacker to fix the hardest and most immediate issue with gcc for VAX. Without this being resolved, gcc will drop support for VAX in a near future version.\n\n\n\n\nMy new FreeBSD Laptop: Dell Latitude 7390\n\n\nAs a FreeBSD developer, I make a point of using FreeBSD whenever I can — including on the desktop. I've been running FreeBSD on laptops since 2004; this hasn't always been easy, but over the years I've found that the situation has generally been improving. One of the things we still lack is adequate documentation, however — so I'm writing this to provide an example for users and also Google bait in case anyone runs into some of the problems I had to address.\n\n\n\n\nPFS tool changes in DragonFly\n\n\nHAMMER2 just became a little more DWIM: the pfs-list and pfs-delete directives will now look across all mounted filesystems, not just the current directory’s mount path.  pfs-delete won’t delete any filesystem name that appears in more than one place, though\n\n\ngit: hammer2 - Enhance pfs-list and pfs-delete\nEnhance pfs-list to list PFSs available across all mounted hammer2 filesystems instead of just the current directory's mount.  A specific mount may be specified via -s mountpt.\nEnhance pfs-delete to look for the PFS name across all mounted hammer2 filesystems instead of just the current directory's mount.\nAs a safety, pfs-delete will refuse to delete PFS names which are duplicated across multiple mounts.  A specific mount may be specified via -s mountpt.\n\n\n\n\n\nBeastie Bits\n\n\nBastilleBSD Templates\nTianocore update\nReminder: FreeBSD Office Hours on June 24, 2020\n***\n###Tarsnap\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\nFeedback/Questions\n\n\nNiclas - Regarding the Lenovo E595 user from Episode 340\nErik - What happened with the video\nIgor - Boot Environments\n***\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n","content_html":"<p>Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://cromwell-intl.com/open-source/openbsd-kernel.html\" rel=\"nofollow\">How to Upgrade OpenBSD and Build a Kernel</a></h3>\n\n<blockquote>\n<p>Let&#39;s see how to upgrade your OpenBSD system. Maybe you are doing this because the latest release just came out. If so, this is pretty simple: back up your data, boot from install media, and select &quot;Upgrade&quot; instead of &quot;Install&quot;. But maybe the latest release has been out for a few months. Why would we go through the trouble of building and installing a new kernel or other core system components? Maybe some patches have been released to improve system security or stability. It is pretty easy to build and install a kernel on OpenBSD, easier and simpler in many ways than it is on Linux.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://manpages.bsd.lv/history.html\" rel=\"nofollow\">The History of man pages</a></h3>\n\n<blockquote>\n<p>Where do UNIX manpages come from? Who introduced the section-based layout of NAME, SYNOPSIS, and so on? And for manpage authors: where were those economical two- and three-letter instructions developed?</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/vax_port_needs_help\" rel=\"nofollow\">VAX port needs help</a></h3>\n\n<blockquote>\n<p>The VAX is the oldest machine architecture still supported by NetBSD.<br>\nUnfortunately there is another challenge, totally outside of NetBSD, but affecting the VAX port big time: the compiler support for VAX is ... let&#39;s say sub-optimal. It is also risking to be dropped completely by gcc upstream.<br>\nNow here is where people can help: there is a bounty campaign to finance a gcc hacker to fix the hardest and most immediate issue with gcc for VAX. Without this being resolved, gcc will drop support for VAX in a near future version.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"http://www.daemonology.net/blog/2020-05-22-my-new-FreeBSD-laptop-Dell-7390.html\" rel=\"nofollow\">My new FreeBSD Laptop: Dell Latitude 7390</a></h3>\n\n<blockquote>\n<p>As a FreeBSD developer, I make a point of using FreeBSD whenever I can — including on the desktop. I&#39;ve been running FreeBSD on laptops since 2004; this hasn&#39;t always been easy, but over the years I&#39;ve found that the situation has generally been improving. One of the things we still lack is adequate documentation, however — so I&#39;m writing this to provide an example for users and also Google bait in case anyone runs into some of the problems I had to address.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.dragonflydigest.com/2020/06/09/24612.html\" rel=\"nofollow\">PFS tool changes in DragonFly</a></h3>\n\n<blockquote>\n<p>HAMMER2 just became a little more DWIM: the pfs-list and pfs-delete directives will now look across all mounted filesystems, not just the current directory’s mount path.  pfs-delete won’t delete any filesystem name that appears in more than one place, though</p>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2020-June/769226.html\" rel=\"nofollow\">git: hammer2 - Enhance pfs-list and pfs-delete</a>\nEnhance pfs-list to list PFSs available across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.  A specific mount may be specified via -s mountpt.\nEnhance pfs-delete to look for the PFS name across all mounted hammer2 filesystems instead of just the current directory&#39;s mount.\nAs a safety, pfs-delete will refuse to delete PFS names which are duplicated across multiple mounts.  A specific mount may be specified via -s mountpt.</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://gitlab.com/bastillebsd-templates\" rel=\"nofollow\">BastilleBSD Templates</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2020/06/08/24610.html\" rel=\"nofollow\">Tianocore update</a></li>\n<li><a href=\"https://wiki.freebsd.org/OfficeHours\" rel=\"nofollow\">Reminder: FreeBSD Office Hours on June 24, 2020</a>\n***\n###Tarsnap</li>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Niclas%20-%20Regarding%20the%20Lenovo%20E595%20user%20from%20Episode%20340.md\" rel=\"nofollow\">Niclas - Regarding the Lenovo E595 user from Episode 340</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Erik%20-%20What%20happened%20with%20the%20video.md\" rel=\"nofollow\">Erik - What happened with the video</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/355/feedback/Igor%20-%20Boot%20Environments.md\" rel=\"nofollow\">Igor - Boot Environments</a>\n***</li>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>","summary":"Upgrading OpenBSD, Where do Unix man pages come from?, Help for NetBSD’s VAX port, FreeBSD on Dell Latitude 7390, PFS Tool changes in DragonflyBSD, and more.","date_published":"2020-06-18T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/369decb7-b522-4745-b385-2339d05211d9.mp3","mime_type":"audio/mpeg","size_in_bytes":40900704,"duration_in_seconds":2439}]},{"id":"2b93f76f-bbea-49a0-8cf1-80c997d4510e","title":"354: ZFS safekeeps data","url":"https://www.bsdnow.tv/354","content_text":"FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nFreeBSD 11.4-RC2 Now Available\n\n\nThe second RC build of the 11.4-RELEASE release cycle is now available.\n\n\n11.4-RELEASE notes (still in progress at the time of recording)\n***\n\n\n\nInstall OpenBSD 6.7-current on a PineBook Pro 64\n\n\nThis document is work in progress and I'll update the date above once I change something. If you have something to add, remarks, etc please contact me. Preferably via Mastodon but other means of communication are also fine.\n\n\n\n\nNews Roundup\n\nUnderstanding How OpenZFS Keeps Your Data Safe\n\n\nVeteran technology writer Jim Salter wrote an excellent guide on the ZFS file system’s features and performance that we absolutely had to share. There’s plenty of information in the article for ZFS newbies and advanced users alike. Be sure to check out the article over at Ars Technica to learn more about ZFS concepts including pools, vdevs, datasets, snapshots, and replication, just to name a few. \n\n\n\n\nBringing FreeBSD to ec2\n\n\nColin is the founder of Tarsnap, a secure online backup service which combines the flexibility and scriptability of the standard UNIX \"tar\" utility with strong encryption, deduplication, and the reliability of Amazon S3 storage. Having started work on Tarsnap in 2006, Colin is among the first generation of users of Amazon Web Services, and has written dozens of articles about his experiences with AWS on his blog.\n\n\n\n\nFreeBSD 2020 Community Survey\n\n\nThe FreeBSD Core Team invites you to complete the 2020 FreeBSD Community Survey.  The purpose of this survey is to collect quantitative data from the public in order to help guide the project’s priorities and efforts.  This is only the second time a survey has been conducted by the FreeBSD Project and your input is valued.\nThe survey will remain open for 14 days and will close on June 16th at 17:00 UTC (Tuesday 10am PDT).\n\n\n\n\nBeastie Bits\n\n\nFreeBSD Project Proposals\nTJ Hacking\nScotland Open Source podcast\nNext FreeBSD Office Hours on June 24, 2020\n***\n\n\nFeedback/Questions\n\n\nTom - Writing for LPIrstudio\nLuke - rstudio\nMatt - Vlans and Jails\nMorgan - Can I get some commentary on this issue\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\nSponsored By:Tarsnap Promo Code: bsdnow","content_html":"<p>FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2020-May/092320.html\" rel=\"nofollow\">FreeBSD 11.4-RC2 Now Available</a></h3>\n\n<blockquote>\n<p>The second RC build of the 11.4-RELEASE release cycle is now available.</p>\n\n<ul>\n<li><a href=\"https://www.freebsd.org/releases/11.4R/relnotes.html\" rel=\"nofollow\">11.4-RELEASE notes</a> (still in progress at the time of recording)\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://xosc.org/pinebookpro.html\" rel=\"nofollow\">Install OpenBSD 6.7-current on a PineBook Pro 64</a></h3>\n\n<blockquote>\n<p>This document is work in progress and I&#39;ll update the date above once I change something. If you have something to add, remarks, etc please contact me. Preferably via Mastodon but other means of communication are also fine.</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.ixsystems.com/blog/openzfs-keeps-your-data-safe/\" rel=\"nofollow\">Understanding How OpenZFS Keeps Your Data Safe</a></h3>\n\n<blockquote>\n<p>Veteran technology writer Jim Salter wrote an excellent guide on the ZFS file system’s features and performance that we absolutely had to share. There’s plenty of information in the article for ZFS newbies and advanced users alike. Be sure to check out the article over at Ars Technica to learn more about ZFS concepts including pools, vdevs, datasets, snapshots, and replication, just to name a few. </p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.lastweekinaws.com/podcast/screaming-in-the-cloud/bringing-freebsd-to-ec2-with-colin-percival/\" rel=\"nofollow\">Bringing FreeBSD to ec2</a></h3>\n\n<blockquote>\n<p>Colin is the founder of Tarsnap, a secure online backup service which combines the flexibility and scriptability of the standard UNIX &quot;tar&quot; utility with strong encryption, deduplication, and the reliability of Amazon S3 storage. Having started work on Tarsnap in 2006, Colin is among the first generation of users of Amazon Web Services, and has written dozens of articles about his experiences with AWS on his blog.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.research.net/r/freebsd-2020-community-survey\" rel=\"nofollow\">FreeBSD 2020 Community Survey</a></h3>\n\n<blockquote>\n<p>The FreeBSD Core Team invites you to complete the 2020 FreeBSD Community Survey.  The purpose of this survey is to collect quantitative data from the public in order to help guide the project’s priorities and efforts.  This is only the second time a survey has been conducted by the FreeBSD Project and your input is valued.<br>\nThe survey will remain open for 14 days and will close on June 16th at 17:00 UTC (Tuesday 10am PDT).</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.freebsdfoundation.org/blog/submit-your-freebsd-project-proposal\" rel=\"nofollow\">FreeBSD Project Proposals</a></li>\n<li><a href=\"https://www.youtube.com/channel/UCknj_nW8JWcFJOAbgd5_Zgw\" rel=\"nofollow\">TJ Hacking</a></li>\n<li><a href=\"https://twitter.com/ScotlandOSUM/status/1265987126321188864?s=19\" rel=\"nofollow\">Scotland Open Source podcast</a></li>\n<li><a href=\"https://wiki.freebsd.org/OfficeHours\" rel=\"nofollow\">Next FreeBSD Office Hours on June 24, 2020</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Tom%20-%20Wriitng%20for%20LPI.md\" rel=\"nofollow\">Tom - Writing for LPIrstudio</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Luke%20-%20rstudio.md\" rel=\"nofollow\">Luke - rstudio</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Matt%20-%20Vlans%20and%20Jails.md\" rel=\"nofollow\">Matt - Vlans and Jails</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/354/feedback/Morgan%20-%20Can%20I%20get%20some%20commentary%20on%20this%20issue.md\" rel=\"nofollow\">Morgan - Can I get some commentary on this issue</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul><p>Sponsored By:</p><ul><li><a rel=\"nofollow\" href=\"https://www.tarsnap.com/bsdnow\">Tarsnap</a> Promo Code: bsdnow</li></ul>","summary":"FreeBSD 11.4-RC 2 available, OpenBSD 6.7 on a PineBook Pro 64, How OpenZFS Keeps Your Data Safe, Bringing FreeBSD to EC2, FreeBSD 2020 Community Survey, and more.","date_published":"2020-06-11T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2b93f76f-bbea-49a0-8cf1-80c997d4510e.mp3","mime_type":"audio/mpeg","size_in_bytes":33544616,"duration_in_seconds":2107}]},{"id":"fe0e809c-411c-4156-bf80-80c98028f1ae","title":"353: ZFS on Ironwolf","url":"https://www.bsdnow.tv/353","content_text":"Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more.\n\nNOTES\nThis episode of BSDNow is brought to you by Tarsnap\n\nHeadlines\n\nScheduling in NetBSD – Part 1\n\n\nIn this blog, we will discuss about the 4.4BSD Thread scheduler one of the two schedulers in NetBSD and a few OS APIs that can be used to control the schedulers and get information while executing.\n\n\n\n\nZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner\n\n\nThis has been a long while in the making—it's test results time. To truly understand the fundamentals of computer storage, it's important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It's also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers.\n\n\n\nIf you want to hear more from Jim, he has a new bi-weekly podcast with Allan and Joe Ressington over at 2.5admins.com\n\n\n\n\nNews Roundup\n\nOpenBSD on the Microsoft Surface Go 2\n\n\nI used OpenBSD on the original Surface Go back in 2018 and many things worked with the big exception of the internal Atheros WiFi. This meant I had to keep it tethered to a USB-C dock for Ethernet or use a small USB-A WiFi dongle plugged into a less-than-small USB-A-to-USB-C adapter.\n\n\n\n\nFreeBSD UNIX for Linux sysadmins\n\n\nIf you’ve ever installed and explored another Linux distro (what Linux sysadmin hasn’t?!?), then exploring FreeBSD is going be somewhat similar with a few key differences.\nWhile there is no graphical installation, the installation process is straightforward and similar to installing a server-based Linux distro. Just make sure you choose the local_unbound package when prompted if you want to cache DNS lookups locally, as FreeBSD doesn’t have a built-in local DNS resolver that does this.\nFollowing installation, the directory structure is almost identical to Linux. Of course, you’ll notice some small differences here and there (e.g. regular user home directories are located under /usr/home instead of /home). Standard UNIX commands such as ls, chmod, find, which, ps, nice, ifconfig, netstat, sockstat (the ss command in Linux) are exactly as you’d expect, but with some different options here and there that you’ll see in the man pages. And yes, reboot and poweroff are there too.\n\n\n\n\nFreeBSD on the Lenovo Thinkpad T480\n\n\nRecently I replaced my 2014 MacBook Air with a Lenovo Thinkpad T480, on which I've installed FreeBSD, currently 12.1-RELEASE. This page documents my set-up along with various configuration tweaks and fixes.\n\n\n\n\nTarsnap\n\n\nThis weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.\n\n\n\n\nFeedback/Questions\n\n\nBenjamin - ZFS Question\nBrad - swap_pager_getswapspace errors\nBrandon - gaming\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\nSponsored By:Tarsnap Promo Code: bsdnow","content_html":"<p>Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more.</p>\n\n<p><strong><em>NOTES</em></strong><br>\nThis episode of BSDNow is brought to you by <a href=\"https://www.tarsnap.com/\" rel=\"nofollow\">Tarsnap</a></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://manikishan.wordpress.com/2020/05/10/scheduling-in-netbsd-part-1/\" rel=\"nofollow\">Scheduling in NetBSD – Part 1</a></h3>\n\n<blockquote>\n<p>In this blog, we will discuss about the 4.4BSD Thread scheduler one of the two schedulers in NetBSD and a few OS APIs that can be used to control the schedulers and get information while executing.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://arstechnica.com/gadgets/2020/05/zfs-versus-raid-eight-ironwolf-disks-two-filesystems-one-winner/\" rel=\"nofollow\">ZFS versus RAID: Eight Ironwolf disks, two filesystems, one winner</a></h3>\n\n<blockquote>\n<p>This has been a long while in the making—it&#39;s test results time. To truly understand the fundamentals of computer storage, it&#39;s important to explore the impact of various conventional RAID (Redundant Array of Inexpensive Disks) topologies on performance. It&#39;s also important to understand what ZFS is and how it works. But at some point, people (particularly computer enthusiasts on the Internet) want numbers.</p>\n</blockquote>\n\n<ul>\n<li>If you want to hear more from Jim, he has a new bi-weekly podcast with Allan and Joe Ressington over at <a href=\"https://2.5admins.com/\" rel=\"nofollow\">2.5admins.com</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jcs.org/2020/05/15/surface_go2\" rel=\"nofollow\">OpenBSD on the Microsoft Surface Go 2</a></h3>\n\n<blockquote>\n<p>I used OpenBSD on the original Surface Go back in 2018 and many things worked with the big exception of the internal Atheros WiFi. This meant I had to keep it tethered to a USB-C dock for Ethernet or use a small USB-A WiFi dongle plugged into a less-than-small USB-A-to-USB-C adapter.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://triosdevelopers.com/jason.eckert/blog/Entries/2020/5/2_FreeBSD_UNIX_for_Linux_sysadmins.html\" rel=\"nofollow\">FreeBSD UNIX for Linux sysadmins</a></h3>\n\n<blockquote>\n<p>If you’ve ever installed and explored another Linux distro (what Linux sysadmin hasn’t?!?), then exploring FreeBSD is going be somewhat similar with a few key differences.<br>\nWhile there is no graphical installation, the installation process is straightforward and similar to installing a server-based Linux distro. Just make sure you choose the local_unbound package when prompted if you want to cache DNS lookups locally, as FreeBSD doesn’t have a built-in local DNS resolver that does this.<br>\nFollowing installation, the directory structure is almost identical to Linux. Of course, you’ll notice some small differences here and there (e.g. regular user home directories are located under /usr/home instead of /home). Standard UNIX commands such as ls, chmod, find, which, ps, nice, ifconfig, netstat, sockstat (the ss command in Linux) are exactly as you’d expect, but with some different options here and there that you’ll see in the man pages. And yes, reboot and poweroff are there too.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.davidschlachter.com/misc/t480-freebsd\" rel=\"nofollow\">FreeBSD on the Lenovo Thinkpad T480</a></h3>\n\n<blockquote>\n<p>Recently I replaced my 2014 MacBook Air with a Lenovo Thinkpad T480, on which I&#39;ve installed FreeBSD, currently 12.1-RELEASE. This page documents my set-up along with various configuration tweaks and fixes.</p>\n</blockquote>\n\n<hr>\n\n<h3>Tarsnap</h3>\n\n<ul>\n<li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Benjamin%20-%20ZFS%20Question.md\" rel=\"nofollow\">Benjamin - ZFS Question</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brad%20-%20swap_pager_getswapspace%20errors.md\" rel=\"nofollow\">Brad - swap_pager_getswapspace errors</a></p></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/353/feedback/Brandon%20-%20gaming.md\" rel=\"nofollow\">Brandon - gaming</a></p></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr><p>Sponsored By:</p><ul><li><a rel=\"nofollow\" href=\"https://www.tarsnap.com/bsdnow\">Tarsnap</a> Promo Code: bsdnow</li></ul>","summary":"Scheduling in NetBSD, ZFS vs. RAID on Ironwolf disks, OpenBSD on Microsoft Surface Go 2, FreeBSD for Linux sysadmins, FreeBSD on Lenovo T480, and more","date_published":"2020-06-04T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fe0e809c-411c-4156-bf80-80c98028f1ae.mp3","mime_type":"audio/mpeg","size_in_bytes":36491000,"duration_in_seconds":2311}]},{"id":"a4aba73b-ccc0-41d3-bd39-45783e594bd3","title":"352: Introducing Randomness","url":"https://www.bsdnow.tv/352","content_text":"A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.\n\nHeadlines\n\nEntropy\n\n\n\nA brief introduction to randomness\n\n\n\n\nProblem: Computers are very predictable. This is by design.\n\n\n\nBut what if we want them to act unpredictably? This is very useful if we want to secure our private communications with randomized keys, or not let people cheat at video games, or if we're doing statistical simulations or similar.\n\n\n\n\nLogs grinding Netatalk on FreeBSD to a hault\n\n\n\nI’ve heard it said the cobbler’s children walk barefoot. While posessing the qualities of a famed financial investment strategy, it speaks to how we generally put more effort into things for others than ourselves; at least in business.\nThe HP Microserver I share with Clara is a modest affair compared to what we run at work. It has six spinning rust drives and two SSDs which are ZFS-mirrored; not even in a RAID 10 equivalent. This is underlaid with GELI for encryption, and served to our Macs with Netatalk over gigabit Ethernet with jumbo frames.\n\n\n\n\n\nNews Roundup\n\nNetBSD Core Team Changes\n\n\nMatt Thomas (matt@) has served on the NetBSD core team for over ten years, and has made many contributions, including ELF functionality, being the long-time VAX maintainer, gcc contributor, the generic pmap, and also networking functionality, and platform bring-up over the years.  Matt has stepped down from the NetBSD core team, and we thank him for his many, extensive contributions.\nRobert Elz (kre@), a long time BSD contributor, has kindly accepted the offer to join the core team, and help us out with the benefit of his experience and advice over many years.  Amongst other things, Robert has been maintaining our shell, liaising with the Austin Group, and bringing it up to date with modern functionality.\n\n\n\n\nUsing qemu guest agent on OpenBSD kvm/qemu guests\n\n\nIn a post to the ports@ mailing list, Landry Breuil (landry@) shared some of his notes on using qemu guest agent on OpenBSD kvm/qemu guests.\n\n\n\n\nWireGuard patchset for OpenBSD\n\n\nA while ago I wanted to learn more about OpenBSD development. So I picked a project, in this case WireGuard, to develop a native client for. Over the last two years, with many different iterations, and working closely with the WireGuard's creator (Jason [Jason A. Donenfeld - Ed.], CC'd), it started to become a serious project eventually reaching parity with other official implementations. Finally, we are here and I think it is time for any further development to happen inside the src tree.\n\n\n\n\nFreeBSD 12.1 on a laptop\n\n\nI’m using FreeBSD again on a laptop for some reasons so expect to read more about FreeBSD here. This tutorial explain how to get a graphical desktop using FreeBSD 12.1.\n\n\n\n\nBeastie Bits\n\n\nList of useful FreeBSD Commands\nMaster Your Network With Unix Command Line Tools\nOriginal Unix containers aka FreeBSD jails\nFlashback : 2003 Article : Bill Joy's greatest gift to man – the vi editor\nFreeBSD Journal March/April 2020 Filesystems: ZFS Encryption, FUSE, and more, plus Network Bridges\nHAMBug meeting will be online again in June, so those from all over the world are welcome to join, June 9th (2nd Tuesday of each month) at 18:30 Eastern\n\n\n\n\nFeedback/Questions\n\n\n+ Lyubomir - GELI and ZFS\nPatrick - powerd and powerd++\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://washbear.neocities.org/entropy.html\" rel=\"nofollow\">Entropy</a></h3>\n\n<blockquote>\n<blockquote>\n<p>A brief introduction to randomness</p>\n</blockquote>\n</blockquote>\n\n<ul>\n<li>Problem: Computers are very predictable. This is by design.</li>\n</ul>\n\n<blockquote>\n<p>But what if we want them to act unpredictably? This is very useful if we want to secure our private communications with randomized keys, or not let people cheat at video games, or if we&#39;re doing statistical simulations or similar.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/logs-grinding-netatalk-on-freebsd-to-a-hault/\" rel=\"nofollow\">Logs grinding Netatalk on FreeBSD to a hault</a></h3>\n\n<blockquote>\n<blockquote>\n<p>I’ve heard it said the cobbler’s children walk barefoot. While posessing the qualities of a famed financial investment strategy, it speaks to how we generally put more effort into things for others than ourselves; at least in business.<br>\nThe HP Microserver I share with Clara is a modest affair compared to what we run at work. It has six spinning rust drives and two SSDs which are ZFS-mirrored; not even in a RAID 10 equivalent. This is underlaid with GELI for encryption, and served to our Macs with Netatalk over gigabit Ethernet with jumbo frames.</p>\n</blockquote>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mail-index.netbsd.org/netbsd-announce/2020/05/07/msg000314.html\" rel=\"nofollow\">NetBSD Core Team Changes</a></h3>\n\n<blockquote>\n<p>Matt Thomas (matt@) has served on the NetBSD core team for over ten years, and has made many contributions, including ELF functionality, being the long-time VAX maintainer, gcc contributor, the generic pmap, and also networking functionality, and platform bring-up over the years.  Matt has stepped down from the NetBSD core team, and we thank him for his many, extensive contributions.<br>\nRobert Elz (kre@), a long time BSD contributor, has kindly accepted the offer to join the core team, and help us out with the benefit of his experience and advice over many years.  Amongst other things, Robert has been maintaining our shell, liaising with the Austin Group, and bringing it up to date with modern functionality.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20200514073852\" rel=\"nofollow\">Using qemu guest agent on OpenBSD kvm/qemu guests</a></h3>\n\n<blockquote>\n<p>In a post to the ports@ mailing list, Landry Breuil (landry@) shared some of his notes on using qemu guest agent on OpenBSD kvm/qemu guests.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20200512080047\" rel=\"nofollow\">WireGuard patchset for OpenBSD</a></h3>\n\n<blockquote>\n<p>A while ago I wanted to learn more about OpenBSD development. So I picked a project, in this case WireGuard, to develop a native client for. Over the last two years, with many different iterations, and working closely with the WireGuard&#39;s creator (Jason [Jason A. Donenfeld - Ed.], CC&#39;d), it started to become a serious project eventually reaching parity with other official implementations. Finally, we are here and I think it is time for any further development to happen inside the src tree.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2020-05-11-freebsd-workstation.html\" rel=\"nofollow\">FreeBSD 12.1 on a laptop</a></h3>\n\n<blockquote>\n<p>I’m using FreeBSD again on a laptop for some reasons so expect to read more about FreeBSD here. This tutorial explain how to get a graphical desktop using FreeBSD 12.1.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://medium.com/@tdebarbora/list-of-useful-freebsd-commands-92dffb8f8c57\" rel=\"nofollow\">List of useful FreeBSD Commands</a></li>\n<li><a href=\"https://itnext.io/master-your-network-with-unix-command-line-tools-790bdd3b3b87\" rel=\"nofollow\">Master Your Network With Unix Command Line Tools</a></li>\n<li><a href=\"https://twitter.com/nixcraft/status/1257674069387993088\" rel=\"nofollow\">Original Unix containers aka FreeBSD jails</a></li>\n<li><a href=\"https://www.theregister.co.uk/2003/09/11/bill_joys_greatest_gift/\" rel=\"nofollow\">Flashback : 2003 Article : Bill Joy&#39;s greatest gift to man – the vi editor</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/past-issues/filesystems/\" rel=\"nofollow\">FreeBSD Journal March/April 2020 Filesystems: ZFS Encryption, FUSE, and more, plus Network Bridges</a></li>\n<li><a href=\"https://www.hambug.ca/\" rel=\"nofollow\">HAMBug meeting will be online again in June, so those from all over the world are welcome to join, June 9th (2nd Tuesday of each month) at 18:30 Eastern</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>+ <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Lyubomir%20-%20GELI%20and%20ZFS.md\" rel=\"nofollow\">Lyubomir - GELI and ZFS</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/352/feedback/Patrick%20-%20powerd%20and%20powerd%2B%2B.md\" rel=\"nofollow\">Patrick - powerd and powerd++</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>","summary":"A brief introduction to randomness, logs grinding netatalk to a halt, NetBSD core team changes, Using qemu guest agent on OpenBSD kvm/qemu guests, WireGuard patchset for OpenBSD, FreeBSD 12.1 on a laptop, and more.","date_published":"2020-05-28T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a4aba73b-ccc0-41d3-bd39-45783e594bd3.mp3","mime_type":"audio/mpeg","size_in_bytes":45132517,"duration_in_seconds":3056}]},{"id":"2a4b866e-d026-416c-9ab7-e0b95bf24043","title":"351: Heaven: OpenBSD 6.7","url":"https://www.bsdnow.tv/351","content_text":"Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD's standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.\n\nHeadlines\n\nBackup and Restore on NetBSD\n\n\nPutting together the bits and pieces of a backup and restore concept, while not being rocket science, always seems to be a little bit ungrateful. Most Admin Handbooks handle this topic only within few pages. After replacing my old Mac Mini's OS by NetBSD, I tried to implement an automated backup, allowing me to handle it similarly to the time machine backups I've been using before. Suggestions on how to improve are always welcome.\n\n\n\n\nBSD Release: OpenBSD 6.7\n\n\nThe OpenBSD project produces and operating system which places focus on portability, standardisation, code correctness, proactive security and integrated cryptography. The project's latest release is OpenBSD 6.7 which introduces several new improvements to the cron scheduling daemon, improvements to the web server daemon, and the top command now offers scrollable output. These and many more changes can be found in the project's release announcement: \"This is a partial list of new features and systems included in OpenBSD 6.7. For a comprehensive list, see the changelog leading to 6.7. General improvements and bugfixes: Reduced the minimum allowed number of chunks in a CONCAT volume from 2 to 1, increasing the number of volumes which can be created on a single disk with bioctl(8) from 7 to 15. This can be used to create more partitions than previously. Rewrote the cron(8) flag-parsing code to be getopt-like, allowing tight formations like -ns and flag repetition. Renamed the 'options' field in crontab(5) to 'flags'. Added crontab(5) -s flag to the command field, indicating that only a single instance of the job should run concurrently. Added cron(8) support for random time values using the ~ operator. Allowed cwm(1) configuration of window size based on percentage of the master window during horizontal and vertical tiling actions.\"\n\n\n\nRelease Announcement\nRelease Notes\n\n\n\n\nNews Roundup\n\nBuilding a WireGuard Jail with the FreeBSD's Standard Tools\n\n\nRecently, I had an opportunity to build a WireGuard jail on a FreeBSD 12.1 host.\nAs it was really quick and easy to setup and it has been working completely fine for a month, I’d like to share my experience with anyone interested in this topic. \n\n\n\n\nThe Unix divide over who gets to chown things, and (disk space) quotas\n\n\nOne of the famous big splits between the BSD Unix world and the System V world is whether ordinary users can use chown (the command and the system call) to give away their own files. In System V derived Unixes you were generally allowed to; in BSD derived Unixes you weren't. Until I looked it up now to make sure, I thought that BSD changed this behavior from V7 and that V7 had an unrestricted chown. However, this turns out to be wrong; in V7 Unix, chown(2) was restricted to root only.\n\n\n\n\nYou Can Influence the TrueNAS CORE Roadmap!\n\n\nAs many of you know, we’ve historically had three ticket types available in our tracker: Bugs, Features, and Improvements, which are all fairly self-explanatory. After some discussion internally, we’ve decided to implement a new type of ticket, a “Suggestion”. These will be replacing Feature and Improvement requests for the TrueNAS Community, simplifying things down to two options: Bugs and Suggestions. This change also introduces a slightly different workflow than before.\n\n\n\n\nBeastie Bits\n\n\nFreeNAS Spare Parts Build: Testing ZFS With Imbalanced VDEVs and Mismatched Drives\nTLSv1.3 server code enabled in LibreSSL in -current\nInterview with Deb Goodkin\n***\n\n\nFeedback/Questions\n\n\nBostjan - WireGaurd\nChad - ZFS Pool Design\nPedreo - Scale FreeBSD Jails\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD&#39;s standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://e17i.github.io/articles-netbsd-backup/\" rel=\"nofollow\">Backup and Restore on NetBSD</a></h3>\n\n<blockquote>\n<p>Putting together the bits and pieces of a backup and restore concept, while not being rocket science, always seems to be a little bit ungrateful. Most Admin Handbooks handle this topic only within few pages. After replacing my old Mac Mini&#39;s OS by NetBSD, I tried to implement an automated backup, allowing me to handle it similarly to the time machine backups I&#39;ve been using before. Suggestions on how to improve are always welcome.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://distrowatch.com/?newsid=10921\" rel=\"nofollow\">BSD Release: OpenBSD 6.7</a></h3>\n\n<blockquote>\n<p>The OpenBSD project produces and operating system which places focus on portability, standardisation, code correctness, proactive security and integrated cryptography. The project&#39;s latest release is OpenBSD 6.7 which introduces several new improvements to the cron scheduling daemon, improvements to the web server daemon, and the top command now offers scrollable output. These and many more changes can be found in the project&#39;s release announcement: &quot;This is a partial list of new features and systems included in OpenBSD 6.7. For a comprehensive list, see the changelog leading to 6.7. General improvements and bugfixes: Reduced the minimum allowed number of chunks in a CONCAT volume from 2 to 1, increasing the number of volumes which can be created on a single disk with bioctl(8) from 7 to 15. This can be used to create more partitions than previously. Rewrote the cron(8) flag-parsing code to be getopt-like, allowing tight formations like -ns and flag repetition. Renamed the &#39;options&#39; field in crontab(5) to &#39;flags&#39;. Added crontab(5) -s flag to the command field, indicating that only a single instance of the job should run concurrently. Added cron(8) support for random time values using the ~ operator. Allowed cwm(1) configuration of window size based on percentage of the master window during horizontal and vertical tiling actions.&quot;</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://marc.info/?l=openbsd-announce&m=158989783626149&w=2\" rel=\"nofollow\">Release Announcement</a></li>\n<li><a href=\"https://www.openbsd.org/67.html\" rel=\"nofollow\">Release Notes</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://genneko.github.io/playing-with-bsd/networking/freebsd-wireguard-jail/\" rel=\"nofollow\">Building a WireGuard Jail with the FreeBSD&#39;s Standard Tools</a></h3>\n\n<blockquote>\n<p>Recently, I had an opportunity to build a WireGuard jail on a FreeBSD 12.1 host.<br>\nAs it was really quick and easy to setup and it has been working completely fine for a month, I’d like to share my experience with anyone interested in this topic. </p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ChownDivideAndQuotas\" rel=\"nofollow\">The Unix divide over who gets to chown things, and (disk space) quotas</a></h3>\n\n<blockquote>\n<p>One of the famous big splits between the BSD Unix world and the System V world is whether ordinary users can use chown (the command and the system call) to give away their own files. In System V derived Unixes you were generally allowed to; in BSD derived Unixes you weren&#39;t. Until I looked it up now to make sure, I thought that BSD changed this behavior from V7 and that V7 had an unrestricted chown. However, this turns out to be wrong; in V7 Unix, chown(2) was restricted to root only.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-bugs-and-suggestions/\" rel=\"nofollow\">You Can Influence the TrueNAS CORE Roadmap!</a></h3>\n\n<blockquote>\n<p>As many of you know, we’ve historically had three ticket types available in our tracker: Bugs, Features, and Improvements, which are all fairly self-explanatory. After some discussion internally, we’ve decided to implement a new type of ticket, a “Suggestion”. These will be replacing Feature and Improvement requests for the TrueNAS Community, simplifying things down to two options: Bugs and Suggestions. This change also introduces a slightly different workflow than before.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=EFrlG3CUKFQ\" rel=\"nofollow\">FreeNAS Spare Parts Build: Testing ZFS With Imbalanced VDEVs and Mismatched Drives</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20200512074150\" rel=\"nofollow\">TLSv1.3 server code enabled in LibreSSL in -current</a></li>\n<li><a href=\"https://itsfoss.com/freebsd-interview-deb-goodkin/\" rel=\"nofollow\">Interview with Deb Goodkin</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Bostjan%20-%20WireGaurd.md\" rel=\"nofollow\">Bostjan - WireGaurd</a></li>\n<li><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Chad%20-%20ZFS%20Pool%20Design.md\" rel=\"nofollow\">Chad - ZFS Pool Design</a></li>\n<li><p><a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/351/feedback/Pedreo%20-%20Scale%20FreeBSD%20Jails.md\" rel=\"nofollow\">Pedreo - Scale FreeBSD Jails</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n</ul>\n\n<hr>","summary":"Backup and Restore on NetBSD, OpenBSD 6.7 available, Building a WireGuard Jail with FreeBSD's standard tools, who gets to chown things and quotas, influence TrueNAS CORE roadmap, and more.\r\nDate: 2020-05-20","date_published":"2020-05-21T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2a4b866e-d026-416c-9ab7-e0b95bf24043.mp3","mime_type":"audio/mpeg","size_in_bytes":43675400,"duration_in_seconds":2949}]},{"id":"49114e72-83f1-43b6-ae71-9e608a059b3e","title":"350: Speedy Bridges","url":"https://www.bsdnow.tv/350","content_text":"5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.\n\nHeadlines\n\n5x if_bridge Performance Improvement\n\n\nWith FreeBSD Foundation grant, Kristof Provost harnesses new parallel techniques to uncork performance bottleneck \n\n\nKristof also streamed some of his work, providing an interesting insight into how such development work happens\n&gt; https://www.twitch.tv/provostk/videos\n***\n\n\n\nHow Unix Won\n\n+&gt; Unix has won in every conceivable way. And in true mythic style, it contains the seeds of its own eclipse. This is my subjective historical narrative of how that happened.\n\n\nI’m using the name “Unix” to include the entire family of operating systems descended from it, or that have been heavily influenced by it. That includes Linux, SunOS, Solaris, BSD, Mac OS X, and many, many others.\nBoth major mobile OSs, Android and iOS, have Unix roots. Their billions of users dwarf those using clunky things like laptops and desktops, but even there, Windows is only the non-Unix viable OS. Almost everything running server-side in giant datacenters is Linux.\nHow did Unix win?\n\n\n\n\nNews Roundup\n\nCheck logs of central syslog-ng log host on FreeBSD\n\n\nThis blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not to difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host. And the solution presented in this blog post works pretty well for me!\n\n\n\n\nUnderstanding VLAN Configuration on FreeBSD\n\n\nUntil recently, I’ve never had a chance to use VLANs on FreeBSD hosts, though I sometimes configure them on ethernet switches.\nBut when I was playing with vnet jails, I suddenly got interested in VLAN configuration on FreeBSD and experimented with it for some time.\nI wrote this short article to summarize my current understanding of how to configure VLANs on FreeBSD.\n\n\n\n\nUsing bhyve PCI passthrough on OmniOS\n\n\nSome hardware is not supported in illumos yet, but luckily there is bhyve which supports pci passthrough to any guest operating system. To continue with my OmniOS desktop on \"modern\" hardware I would love wifi support, so why not using a bhyve guest as router zone which provide the required drivers?\n\n\n\n\nTrueNAS 11.3-U2 is Generally Available\n\n\nTrueNAS 11.3-U2.1 is generally available as of 4/22/2020. This update is based on FreeNAS 11.3-U2 which has had over 50k deployments and received excellent community and third party reviews. The Release Notes are available on the iXsystems.com website.\n\n\n\n\nBeastie Bits\n\nHardenedBSD April 2020 Status Report\nNYC Bug’s Mailing List - Listing of open Dev Jobs\n\n\n\nFeedback/Questions\n\n\nGreg - Lenovo\nMatt - BSD Packaging\nMorgan - Performance\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsdfoundation.org/blog/500-if_bridge-performance-improvement/\" rel=\"nofollow\">5x if_bridge Performance Improvement</a></h3>\n\n<blockquote>\n<p>With FreeBSD Foundation grant, Kristof Provost harnesses new parallel techniques to uncork performance bottleneck </p>\n\n<ul>\n<li>Kristof also streamed some of his work, providing an interesting insight into how such development work happens</li>\n<li>&gt; <a href=\"https://www.twitch.tv/provostk/videos\" rel=\"nofollow\">https://www.twitch.tv/provostk/videos</a>\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://blog.vivekhaldar.com/post/617189040564928512/how-unix-won\" rel=\"nofollow\">How Unix Won</a></h3>\n\n<p>+&gt; Unix has won in every conceivable way. And in true mythic style, it contains the seeds of its own eclipse. This is my subjective historical narrative of how that happened.</p>\n\n<blockquote>\n<p>I’m using the name “Unix” to include the entire family of operating systems descended from it, or that have been heavily influenced by it. That includes Linux, SunOS, Solaris, BSD, Mac OS X, and many, many others.<br>\nBoth major mobile OSs, Android and iOS, have Unix roots. Their billions of users dwarf those using clunky things like laptops and desktops, but even there, Windows is only the non-Unix viable OS. Almost everything running server-side in giant datacenters is Linux.<br>\nHow did Unix win?</p>\n\n<hr>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html\" rel=\"nofollow\">Check logs of central syslog-ng log host on FreeBSD</a></h3>\n\n<blockquote>\n<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not to difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host. And the solution presented in this blog post works pretty well for me!</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://genneko.github.io/playing-with-bsd/networking/freebsd-vlan/\" rel=\"nofollow\">Understanding VLAN Configuration on FreeBSD</a></h3>\n\n<blockquote>\n<p>Until recently, I’ve never had a chance to use VLANs on FreeBSD hosts, though I sometimes configure them on ethernet switches.<br>\nBut when I was playing with vnet jails, I suddenly got interested in VLAN configuration on FreeBSD and experimented with it for some time.<br>\nI wrote this short article to summarize my current understanding of how to configure VLANs on FreeBSD.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.cyber-tec.org/2019/05/29/using-bhyve-pci-passthrough-on-omnios/\" rel=\"nofollow\">Using bhyve PCI passthrough on OmniOS</a></h3>\n\n<blockquote>\n<p>Some hardware is not supported in illumos yet, but luckily there is bhyve which supports pci passthrough to any guest operating system. To continue with my OmniOS desktop on &quot;modern&quot; hardware I would love wifi support, so why not using a bhyve guest as router zone which provide the required drivers?</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-11-3-u2-is-available/\" rel=\"nofollow\">TrueNAS 11.3-U2 is Generally Available</a></h3>\n\n<blockquote>\n<p>TrueNAS 11.3-U2.1 is generally available as of 4/22/2020. This update is based on FreeNAS 11.3-U2 which has had over 50k deployments and received excellent community and third party reviews. The Release Notes are available on the iXsystems.com website.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<p><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-04-24/hardenedbsd-april-2020-status-report\" rel=\"nofollow\">HardenedBSD April 2020 Status Report</a><br>\n<a href=\"http://lists.nycbug.org/pipermail/jobs/2020-April/000553.html\" rel=\"nofollow\">NYC Bug’s Mailing List - Listing of open Dev Jobs</a></p>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Greg - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Greg%20-%20Lenovos.md\" rel=\"nofollow\">Lenovo</a></li>\n<li>Matt - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Matt%20-%20BSD%20Packaging.md\" rel=\"nofollow\">BSD Packaging</a></li>\n<li><p>Morgan - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/350/feedback/Morgan%20-%20Performance.md\" rel=\"nofollow\">Performance</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>\n\n<hr></li>\n</ul>","summary":"5x if_bridge Performance Improvement, How Unix Won, Understanding VLAN Configuration on FreeBSD, Using bhyve PCI passthrough on OmniOS, TrueNAS 11.3-U2 Available, and more.","date_published":"2020-05-14T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/49114e72-83f1-43b6-ae71-9e608a059b3e.mp3","mime_type":"audio/mpeg","size_in_bytes":37173656,"duration_in_seconds":2080}]},{"id":"468d2fe0-ed8f-4e89-aaae-8aa4a0fbf66f","title":"349: Entropy Overhaul","url":"https://www.bsdnow.tv/349","content_text":"Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.\n\nHeadlines\n\nEKCD - Encrypted Crash Dumps in FreeBSD\n\n\nSome time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.\n\nThe main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.\n\n\n\n\nTime on Unix\n\n\nTime, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.\n\nOver millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.\n\nWe’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.\n\n\nSee the article for more\n\n\n\nNews Roundup\n\nImprove ZVOL sync write performance by using a taskq\n\n\n\nA central log host with syslog-ng on FreeBSD - Part 1\n\n\nsyslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.\n\n\n\n\nHEADS UP: NetBSD Entropy Overhaul\n\n\nThis week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html.\n\n\n\n\nSetting Up NetBSD Kernel Dev Environment\n\n\nI used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.\n\n\n\n\nBeastie Bits\n\n\nYou can now use ccache to speed up dsynth even more.\nImproving libossaudio, and the future of OSS in NetBSD\nDragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes\nReminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC\n\n\n\n\nFeedback/Questions\n\n\nGhislain - ZFS Question\nJake - Paypal Donations\nOswin - Hammer tutorial\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://oshogbo.vexillium.org/blog/74/\" rel=\"nofollow\">EKCD - Encrypted Crash Dumps in FreeBSD</a></h3>\n\n<blockquote>\n<p>Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.</p>\n\n<p>The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://venam.nixers.net/blog/unix/2020/05/02/time-on-unix.html\" rel=\"nofollow\">Time on Unix</a></h3>\n\n<blockquote>\n<p>Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.</p>\n\n<p>Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.</p>\n\n<p>We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.</p>\n</blockquote>\n\n<p>See the article for more</p>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/openzfs/zfs/commit/0929c4de398606f8305057ca540cf577e6771c30\" rel=\"nofollow\">Improve ZVOL sync write performance by using a taskq</a></h3>\n\n<hr>\n\n<h3><a href=\"https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html\" rel=\"nofollow\">A central log host with syslog-ng on FreeBSD - Part 1</a></h3>\n\n<blockquote>\n<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://mail-index.netbsd.org/current-users/2020/05/01/msg038495.html\" rel=\"nofollow\">HEADS UP: NetBSD Entropy Overhaul</a></h3>\n\n<blockquote>\n<p>This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: <a href=\"https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html\" rel=\"nofollow\">https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html</a>.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://adityapadala.com/2020/04/20/Setting-Up-NetBSD-Kernel-Dev-Environment/\" rel=\"nofollow\">Setting Up NetBSD Kernel Dev Environment</a></h3>\n\n<blockquote>\n<p>I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/05/04/24480.html\" rel=\"nofollow\">You can now use ccache to speed up dsynth even more.</a></li>\n<li><a href=\"http://blog.netbsd.org/tnf/entry/improving_libossaudio_and_the_future\" rel=\"nofollow\">Improving libossaudio, and the future of OSS in NetBSD</a></li>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2020-April/769021.html\" rel=\"nofollow\">DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes</a></li>\n<li><a href=\"https://wiki.freebsd.org/OfficeHours\" rel=\"nofollow\">Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Ghislain - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Ghislain%20-%20ZFS%20Question.md\" rel=\"nofollow\">ZFS Question</a></li>\n<li>Jake - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Jake%20-%20Paypal%20Donations.md\" rel=\"nofollow\">Paypal Donations</a></li>\n<li>Oswin - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Oswin%20-%20Hammer%20tutorial.md\" rel=\"nofollow\">Hammer tutorial</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.","date_published":"2020-05-07T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/468d2fe0-ed8f-4e89-aaae-8aa4a0fbf66f.mp3","mime_type":"audio/mp3","size_in_bytes":41444019,"duration_in_seconds":3453}]},{"id":"ed288ede-fe94-433f-85a4-6eebb8cb2478","title":"348: BSD Community Collections","url":"https://www.bsdnow.tv/348","content_text":"FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.\n\nHeadlines\n\nFuryBSD 2020Q2 Images Available for XFCE and KDE\n\n\nThe Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. \n\n\n\n\nTechnical reasons to choose FreeBSD over GNU/Linux\n\n\nSince I wrote my article \"Why you should migrate everything from Linux to BSD\" I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.\n\n\n\n\nNews Roundup\n\n+ Not actually Linux distro review deux: GhostBSD\n\n\nWhen I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly.\n\nI think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.\n\nGhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.\n\n\n\n\n“TLS Mastery” sponsorships open\n\n\nMy next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.\n\nThis should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.\n\n\n\n\nJT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:\n\n\nJT's post: https://twitter.com/q5sys/status/1251194823589138432\n\n\nHigh Resolution Image to see the bottom shelf better: https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg\nCloseup of the BSD Section: https://twitter.com/q5sys/status/1251294290782928897\n\nOthers jumped in with their collections:\n\n\nDeb Goodkin's collection: https://twitter.com/dgoodkin/status/1251294016139743232 &amp; https://twitter.com/dgoodkin/status/1251298125672660992\nFreeBSD Frau's FreeBSD Collection: https://twitter.com/freebsdfrau/status/1251290430475350018\nJason Tubnor's OpenBSD Collection: https://twitter.com/Tubsta/status/1251265902214918144\n\n\n\nDo you have a nice collection, take a picture and send it in!\n\n\n\nTale of OpenBSD secure memory allocator internals - malloc(3)\n\n\nHi there,\n\nIt's been a very long time I haven't written anything after my last OpenBSD blogs, that is, \n\nOpenBSD Kernel Internals — Creation of process from user-space to kernel space.\n\nOpenBSD: Introduction to execpromises in the pledge(2)\n\npledge(2): OpenBSD's defensive approach to OS Security\n\nSo, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator\n\n\n\n\nHow I learned to stop worrying and love SSDs\n\n\nmy home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?\n\nSo I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?\n\nWell even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.\n\n\n\n\nMy infrastructure as of 2019\n\n\nI've wanted to write about my infrastructure for a while, but I kept thinking, \"I'll wait until after I've done $next_thing_on_my_todo.\" Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I'll write an update on it in a couple of moons; who knows?\n\n\n\n\nFor something different than our usual Beastie Bits… we bring you…\n\nWe're all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we'll feature you!\n\n\nInstallation of NetBSD on a Mac Mini\nOpenBSD on the HP Envy 13\nInstall NetBSD on a Vintage Computer\nBSDCan Home Lab Panel recording session: May 5th at 18:00 UTC\nAllan started a series of FreeBSD Office Hours\n\n\n\n\nBSDNow is going Independent\n\n\nAfter being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.\nWhat does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.\n\n\nFeedback/Questions\n\n\nTodd - LinusTechTips Claims about ZFS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.furybsd.org/furybsd-2020-q2-images-are-available-for-xfce-and-kde/\" rel=\"nofollow\">FuryBSD 2020Q2 Images Available for XFCE and KDE</a></h3>\n\n<blockquote>\n<p>The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. </p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://unixsheikh.com/articles/technical-reasons-to-choose-freebsd-over-linux.html\" rel=\"nofollow\">Technical reasons to choose FreeBSD over GNU/Linux</a></h3>\n\n<blockquote>\n<p>Since I wrote my article &quot;Why you should migrate everything from Linux to BSD&quot; I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3>+ <a href=\"https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-deux-ghostbsd/\" rel=\"nofollow\">Not actually Linux distro review deux: GhostBSD</a></h3>\n\n<blockquote>\n<p>When I began work on the FreeBSD 12.1-RELEASE review last week, it didn&#39;t take long to figure out that the desktop portion wasn&#39;t going very smoothly.</p>\n\n<p>I think it&#39;s important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.</p>\n\n<p>GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/6265\" rel=\"nofollow\">“TLS Mastery” sponsorships open</a></h3>\n\n<blockquote>\n<p>My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.</p>\n\n<p>This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.</p>\n</blockquote>\n\n<hr>\n\n<h3>JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:</h3>\n\n<ul>\n<li><p>JT&#39;s post: <a href=\"https://twitter.com/q5sys/status/1251194823589138432\" rel=\"nofollow\">https://twitter.com/q5sys/status/1251194823589138432</a></p>\n\n<ul>\n<li>High Resolution Image to see the bottom shelf better: <a href=\"https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg\" rel=\"nofollow\">https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg</a></li>\n<li>Closeup of the BSD Section: <a href=\"https://twitter.com/q5sys/status/1251294290782928897\" rel=\"nofollow\">https://twitter.com/q5sys/status/1251294290782928897</a></li>\n</ul></li>\n<li><p>Others jumped in with their collections:</p>\n\n<ul>\n<li>Deb Goodkin&#39;s collection: <a href=\"https://twitter.com/dgoodkin/status/1251294016139743232\" rel=\"nofollow\">https://twitter.com/dgoodkin/status/1251294016139743232</a> &amp; <a href=\"https://twitter.com/dgoodkin/status/1251298125672660992\" rel=\"nofollow\">https://twitter.com/dgoodkin/status/1251298125672660992</a></li>\n<li>FreeBSD Frau&#39;s FreeBSD Collection: <a href=\"https://twitter.com/freebsdfrau/status/1251290430475350018\" rel=\"nofollow\">https://twitter.com/freebsdfrau/status/1251290430475350018</a></li>\n<li>Jason Tubnor&#39;s OpenBSD Collection: <a href=\"https://twitter.com/Tubsta/status/1251265902214918144\" rel=\"nofollow\">https://twitter.com/Tubsta/status/1251265902214918144</a></li>\n</ul></li>\n</ul>\n\n<p>Do you have a nice collection, take a picture and send it in!</p>\n\n<hr>\n\n<h3><a href=\"https://bsdb0y.github.io/blog/deep-dive-into-the-OpenBSD-malloc-and-friends-internals-part-1.html\" rel=\"nofollow\">Tale of OpenBSD secure memory allocator internals - malloc(3)</a></h3>\n\n<blockquote>\n<p>Hi there,</p>\n\n<p>It&#39;s been a very long time I haven&#39;t written anything after my last OpenBSD blogs, that is, </p>\n\n<p>OpenBSD Kernel Internals — Creation of process from user-space to kernel space.</p>\n\n<p>OpenBSD: Introduction to <code>execpromises</code> in the pledge(2)</p>\n\n<p>pledge(2): OpenBSD&#39;s defensive approach to OS Security</p>\n\n<p>So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/community/threads/how-i-learned-to-stop-worrying-and-love-ssds.82617/\" rel=\"nofollow\">How I learned to stop worrying and love SSDs</a></h3>\n\n<blockquote>\n<p>my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?</p>\n\n<p>So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?</p>\n\n<p>Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://chown.me/blog/infrastructure-2019.html\" rel=\"nofollow\">My infrastructure as of 2019</a></h3>\n\n<blockquote>\n<p>I&#39;ve wanted to write about my infrastructure for a while, but I kept thinking, &quot;I&#39;ll wait until after I&#39;ve done $next_thing_on_my_todo.&quot; Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I&#39;ll write an update on it in a couple of moons; who knows?</p>\n</blockquote>\n\n<hr>\n\n<h2>For something different than our usual Beastie Bits… we bring you…</h2>\n\n<h2>We&#39;re all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we&#39;ll feature you!</h2>\n\n<ul>\n<li><p><a href=\"https://e17i.github.io/articles-netbsd-install/\" rel=\"nofollow\">Installation of NetBSD on a Mac Mini</a></p></li>\n<li><p><a href=\"https://icyphox.sh/blog/openbsd-hp-envy/\" rel=\"nofollow\">OpenBSD on the HP Envy 13</a></p></li>\n<li><p><a href=\"https://www.rs-online.com/designspark/install-netbsd-on-a-vintage-computer\" rel=\"nofollow\">Install NetBSD on a Vintage Computer</a></p></li>\n<li><p><a href=\"https://twitter.com/allanjude/status/1251895348836143104\" rel=\"nofollow\">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></p></li>\n<li><p><a href=\"https://wiki.freebsd.org/OfficeHours\" rel=\"nofollow\">Allan started a series of FreeBSD Office Hours</a></p></li>\n</ul>\n\n<hr>\n\n<h2>BSDNow is going Independent</h2>\n\n<ul>\n<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.\nWhat does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Todd - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/348/feedback/Todd%20-%20LinusTechTips&#x27;%20claims%20on%20ZFS.md\" rel=\"nofollow\">LinusTechTips Claims about ZFS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0348.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.","date_published":"2020-04-30T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ed288ede-fe94-433f-85a4-6eebb8cb2478.mp3","mime_type":"audio/mp3","size_in_bytes":43398814,"duration_in_seconds":3616}]},{"id":"25cb0a70-b178-4702-8e8f-a8e7427a9ae2","title":"347: New Directions","url":"https://www.bsdnow.tv/347","content_text":"Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.\n\nHeadlines\n\nRethinking OpenBSD Security\n\n\nOpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.\nI picked a few errata, not all of them, that were interesting and happened to suit my narrative.\n\n\n\n\nFreeBSD 2020 Q1 Quarterly report\n\n\nWelcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.\n\n\n\n\nNews Roundup\n\nThe Notion of Progress and User Interfaces\n\n\nOne trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.\n\nHow should we think about progress? Both in general and regarding technology?\n\n\n\n\nThomas E. Dickey on NetBSD curses\n\n\nI was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don't want to go through Mr. Dickey's document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.\n\n\n\n\nMaking Unix a little more Plan9-like\n\n\nI’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.\n\nA Warning\n\nThe suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.\n\n\n\n\nNot-actually Linux distro review: FreeBSD 12.1-RELEASE\n\n\nThis month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems.\n\nThe first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.\n\nBefore we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it.\n\nFreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.\n\n\n\n\nBeastie Bits\n\n\nWifi renewal restarted\nHAMMER2 and a quick start for DragonFly\nEngineering NetBSD 9.0\nAntivirus Protection using OPNsense Plugins\nBSDCan Home Lab Panel recording session: May 5th at 18:00 UTC\n\n\n\n\nBSDNow is going Independent\n\n\nAfter being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different. \nWhat does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.\n\n\n\n\nFeedback/Questions\n\n\nJordyn - ZFS Pool Problem\n\n\ndebug - https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://flak.tedunangst.com/post/rethinking-openbsd-security\" rel=\"nofollow\">Rethinking OpenBSD Security</a></h3>\n\n<blockquote>\n<p>OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.<br>\nI picked a few errata, not all of them, that were interesting and happened to suit my narrative.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2020-01-2020-03.html\" rel=\"nofollow\">FreeBSD 2020 Q1 Quarterly report</a></h3>\n\n<blockquote>\n<p>Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://herebeseaswines.net/essays/2020-04-13-the-notion-of-progress-and-user-interfaces\" rel=\"nofollow\">The Notion of Progress and User Interfaces</a></h3>\n\n<blockquote>\n<p>One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.</p>\n\n<p>How should we think about progress? Both in general and regarding technology?</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://implementality.blogspot.com/2020/04/thomas-e-dickey-on-netbsd-curses.html\" rel=\"nofollow\">Thomas E. Dickey on NetBSD curses</a></h3>\n\n<blockquote>\n<p>I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don&#39;t want to go through Mr. Dickey&#39;s document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://woozle.org/papers/plan9.html\" rel=\"nofollow\">Making Unix a little more Plan9-like</a></h3>\n\n<blockquote>\n<p>I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.</p>\n\n<p>A Warning</p>\n\n<p>The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-freebsd-12-1-release/\" rel=\"nofollow\">Not-actually Linux distro review: FreeBSD 12.1-RELEASE</a></h3>\n\n<blockquote>\n<p>This month&#39;s Linux distro review isn&#39;t of a Linux distribution at all—instead, we&#39;re taking a look at FreeBSD, the original gangster of free Unix-like operating systems.</p>\n\n<p>The first FreeBSD release was in 1993, but the operating system&#39;s roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz&#39;s 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.</p>\n\n<p>Before we get started, I&#39;d like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD&#39;s strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We&#39;re going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can&#39;t imagine readers wouldn&#39;t care about it.</p>\n\n<p>FreeBSD does not provide a good desktop experience, to say the least. But if you&#39;re hankering for a BSD-based desktop, don&#39;t worry—we&#39;re already planning a followup review of GhostBSD, a desktop-focused BSD distribution.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/wifi_renewal_restarted\" rel=\"nofollow\">Wifi renewal restarted</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2020/04/21/24421.html\" rel=\"nofollow\">HAMMER2 and a quick start for DragonFly</a></li>\n<li><a href=\"http://netbsd.org/%7Ekamil/AsiaBSDCon/Kamil_Rytarowski_Engineering_NetBSD_9.0.pdf\" rel=\"nofollow\">Engineering NetBSD 9.0</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=94vz_-5lAkE\" rel=\"nofollow\">Antivirus Protection using OPNsense Plugins</a></li>\n<li><a href=\"https://twitter.com/allanjude/status/1251895348836143104\" rel=\"nofollow\">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></li>\n</ul>\n\n<hr>\n\n<h2>BSDNow is going Independent</h2>\n\n<ul>\n<li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different. \nWhat does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><p>Jordyn - <a href=\"https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/347/feedback/Jordyn%20zfs%20pool%20problem.md\" rel=\"nofollow\">ZFS Pool Problem</a></p>\n\n<ul>\n<li>debug - <a href=\"https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt\" rel=\"nofollow\">https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt</a></li>\n</ul></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0347.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.","date_published":"2020-04-23T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/25cb0a70-b178-4702-8e8f-a8e7427a9ae2.mp3","mime_type":"audio/mp3","size_in_bytes":43806325,"duration_in_seconds":3650}]},{"id":"8f8d0474-abb5-4b90-955c-8d8cfd6dc489","title":"346: Core File Tales","url":"https://www.bsdnow.tv/346","content_text":"Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.\n\nHeadlines\n\nTales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later\n\n\nOn the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.\n\n\n\n\nUpdate Lenovo X260 BIOS with OpenBSD\n\n\nMy X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.\n\nFirst off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.\n\n\n\n\nNews Roundup\n\nThe problem of Unix iowait and multi-CPU machines\n\n\nVarious Unixes have had a 'iowait' statistic for a long time now (although I can't find a source for where it originated; it's not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it's the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as 'idle' (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, 'iowait'.\n\n\n\n\nMy Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More\n\n\nAfter hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.\n\nIn this post, i’ll show you my workflow for deploying my Hugo generated site (www.jaredwolff.com). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.\n\nLet’s get to it.\n\n\n\n\nExtending support for the NetBSD-7 branch\n\n\nTypically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.\n\nWe've decided to hold off on doing that to ensure our users don't feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.\n\nSecurity fixes will still be made to the NetBSD-7 branch.\n\nWe hope you're all safe. Stay home.\n\n\n\n\nTale of two hypervisor bugs - Escaping from FreeBSD bhyve\n\n\nVM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT\n\n\n\n\nBeastie Bits\n\n\nGhostBSD 20.02 Overview\nFuryBSD 12.1 Overview\n&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that's community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.\nOS108-9.0 amd64 MATE released\nFreeBSD hacking: carp panics &amp; test\nInaugural FreeBSD Office Hours\n\n\n\n\nFeedback/Questions\n\n\nShody - systemd question\nBen - GELI and GPT\nStig - DIY NAS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://fingolfin.org/blog/20200327/stdio-abi.html\" rel=\"nofollow\">Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later</a></h3>\n\n<blockquote>\n<p>On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.tumfatig.net/20200331/update-lenovo-x260-bios-with-openbsd/\" rel=\"nofollow\">Update Lenovo X260 BIOS with OpenBSD</a></h3>\n\n<blockquote>\n<p>My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.</p>\n\n<p>First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/IowaitAndMultipleCPUs\" rel=\"nofollow\">The problem of Unix iowait and multi-CPU machines</a></h3>\n\n<blockquote>\n<p>Various Unixes have had a &#39;iowait&#39; statistic for a long time now (although I can&#39;t find a source for where it originated; it&#39;s not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it&#39;s the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as &#39;idle&#39; (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, &#39;iowait&#39;.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.jaredwolff.com/my-latest-self-hosted-hugo-workflow/\" rel=\"nofollow\">My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More</a></h3>\n\n<blockquote>\n<p>After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.</p>\n\n<p>In this post, i’ll show you my workflow for deploying my Hugo generated site (<a href=\"http://www.jaredwolff.com\" rel=\"nofollow\">www.jaredwolff.com</a>). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.</p>\n\n<p>Let’s get to it.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/extending_support_for_the_netbsd\" rel=\"nofollow\">Extending support for the NetBSD-7 branch</a></h3>\n\n<blockquote>\n<p>Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.</p>\n\n<p>We&#39;ve decided to hold off on doing that to ensure our users don&#39;t feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.</p>\n\n<p>Security fixes will still be made to the NetBSD-7 branch.</p>\n\n<p>We hope you&#39;re all safe. Stay home.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://phrack.org/papers/escaping_from_freebsd_bhyve.html\" rel=\"nofollow\">Tale of two hypervisor bugs - Escaping from FreeBSD bhyve</a></h3>\n\n<blockquote>\n<p>VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=kFG-772WGwg\" rel=\"nofollow\">GhostBSD 20.02 Overview</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=5V8680uoXxw\" rel=\"nofollow\">FuryBSD 12.1 Overview</a>\n&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that&#39;s community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.</li>\n<li><a href=\"https://forums.os108.org/d/27-os108-9-0-amd64-mate-released\" rel=\"nofollow\">OS108-9.0 amd64 MATE released</a></li>\n<li><a href=\"https://www.twitch.tv/videos/584064729\" rel=\"nofollow\">FreeBSD hacking: carp panics &amp; test</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=6qBm5NM3zTQ\" rel=\"nofollow\">Inaugural FreeBSD Office Hours</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Shody - <a href=\"http://dpaste.com/2SAQDJJ#wrap\" rel=\"nofollow\">systemd question</a></li>\n<li>Ben - <a href=\"http://dpaste.com/1S0DGT3#wrap\" rel=\"nofollow\">GELI and GPT</a></li>\n<li>Stig - <a href=\"http://dpaste.com/2NGNZG5#wrap\" rel=\"nofollow\">DIY NAS</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.","date_published":"2020-04-16T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/8f8d0474-abb5-4b90-955c-8d8cfd6dc489.mp3","mime_type":"audio/mp3","size_in_bytes":40304872,"duration_in_seconds":3358}]},{"id":"c46952e4-8ea3-4506-b4eb-54f2870547ee","title":"345: Switchers to BSD","url":"https://www.bsdnow.tv/345","content_text":"NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.\n\nHeadlines\n\nNetBSD 8.2 is available!\n\n\nThe third release in the NetBSD-8 is now available.\n\nThis release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.\n\n\n\nSome highlights include:\n\n\nx86: fixed regression in booting old CPUs\nx86: Hyper-V Gen.2 VM framebuffer support\nhttpd(8): fixed various security issues\nixg(4): various fixes / improvements\nx86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.\nVarious kernel memory info leaks fixes\nUpdate expat to 2.2.8\nFix ryzen USB issues and support xHCI version 3.10.\nAccept root device specification as NAME=label.\nAdd multiboot 2 support to x86 bootloaders.\nFix for CVE-2019-9506: 'Key Negotiation of Bluetooth' attack.\nnouveau: limit the supported devices and fix firmware loading.\nradeon: fix loading of the TAHITI VCE firmware.\nnamed(8): stop using obsolete dnssec-lookaside.\n\n\n\n\n\nNextCloud on OpenBSD\n\n\nNextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.\n\n\n\nPreface\n\n\n\nBack when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).\n\nA rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.\n\n\n\n\nNews Roundup\n\nX11 screen locking: a secure and modular approach\n\n\nFor years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements\n\n\n\n\nNetBSD and RISC OS running parallel\n\n\nI have been experimenting with running two systems at the same time on the RK3399 SoC.\nIt all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.\nOK I thought why not give it something to do!\nMy first step was to run some small programs.\nIt worked!\n\n\nThanks to Tom Jones for the pointer to this article\n\n\n\n\n\nSeveral weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.\n\n\nJamie - Dumping Linux for BSD\nMatt - BSD Packaging\nBrad - Linux vs BS\nMJ - Linux vs BSD Feedback\nBen - Feedback for JT\nHenrik - Why you should migrate everything to BSD\n\n\n\n\nBeastie Bits\n\n\nssh-copy-id now included\nOPNsense 20.1.3 released\nA Collection of prebuilt BSD Cloud Images\nInstant terminal sharing\n\n\n\n\nFeedback/Questions\n\n\nAles - Manually verify signature files for pkg package\nShody - Yubikey\nMike - Site for hashes from old disks\n\n\nAnswer: https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing\n\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/netbsd_8_2_is_available\" rel=\"nofollow\">NetBSD 8.2 is available!</a></h3>\n\n<blockquote>\n<p>The third release in the NetBSD-8 is now available.</p>\n\n<p>This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.</p>\n</blockquote>\n\n<ul>\n<li>Some highlights include:\n\n<ul>\n<li>x86: fixed regression in booting old CPUs</li>\n<li>x86: Hyper-V Gen.2 VM framebuffer support</li>\n<li>httpd(8): fixed various security issues</li>\n<li>ixg(4): various fixes / improvements</li>\n<li>x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.</li>\n<li>Various kernel memory info leaks fixes</li>\n<li>Update expat to 2.2.8</li>\n<li>Fix ryzen USB issues and support xHCI version 3.10.</li>\n<li>Accept root device specification as NAME=label.</li>\n<li>Add multiboot 2 support to x86 bootloaders.</li>\n<li>Fix for CVE-2019-9506: &#39;Key Negotiation of Bluetooth&#39; attack.</li>\n<li>nouveau: limit the supported devices and fix firmware loading.</li>\n<li>radeon: fix loading of the TAHITI VCE firmware.</li>\n<li>named(8): stop using obsolete dnssec-lookaside.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://h3artbl33d.nl/2020-nextcloud.html\" rel=\"nofollow\">NextCloud on OpenBSD</a></h3>\n\n<blockquote>\n<p>NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</p>\n</blockquote>\n\n<ul>\n<li>Preface</li>\n</ul>\n\n<blockquote>\n<p>Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).</p>\n\n<p>A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://leahneukirchen.org/blog/archive/2020/01/x11-screen-locking-a-secure-and-modular-approach.html\" rel=\"nofollow\">X11 screen locking: a secure and modular approach</a></h3>\n\n<blockquote>\n<p>For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://www.update.uu.se/%7Emicken/ronetbsd.html\" rel=\"nofollow\">NetBSD and RISC OS running parallel</a></h3>\n\n<blockquote>\n<p>I have been experimenting with running two systems at the same time on the RK3399 SoC.<br>\nIt all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.<br>\nOK I thought why not give it something to do!<br>\nMy first step was to run some small programs.<br>\nIt worked!</p>\n\n<ul>\n<li>Thanks to Tom Jones for the pointer to this article</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3>Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.</h3>\n\n<ul>\n<li>Jamie - <a href=\"http://dpaste.com/0CH1YXQ#wrap\" rel=\"nofollow\">Dumping Linux for BSD</a></li>\n<li>Matt - <a href=\"http://dpaste.com/2N68YPJ#wrap\" rel=\"nofollow\">BSD Packaging</a></li>\n<li>Brad - <a href=\"http://dpaste.com/2SF9V38#wrap\" rel=\"nofollow\">Linux vs BS</a></li>\n<li>MJ - <a href=\"http://dpaste.com/0Z2ZT4V#wrap\" rel=\"nofollow\">Linux vs BSD Feedback</a></li>\n<li>Ben - <a href=\"http://dpaste.com/0B3M85X\" rel=\"nofollow\">Feedback for JT</a></li>\n<li>Henrik - <a href=\"http://dpaste.com/3F36EQE#wrap\" rel=\"nofollow\">Why you should migrate everything to BSD</a></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/04/06/24367.html\" rel=\"nofollow\">ssh-copy-id now included</a></li>\n<li><a href=\"https://opnsense.org/opnsense-20-1-3-released/\" rel=\"nofollow\">OPNsense 20.1.3 released</a></li>\n<li><a href=\"https://bsd-cloud-image.org/\" rel=\"nofollow\">A Collection of prebuilt BSD Cloud Images</a></li>\n<li><a href=\"https://tmate.io/\" rel=\"nofollow\">Instant terminal sharing</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Ales - <a href=\"http://dpaste.com/1EBWTK5#wrap\" rel=\"nofollow\">Manually verify signature files for pkg package</a></li>\n<li>Shody - <a href=\"http://dpaste.com/340PM9Q#wrap\" rel=\"nofollow\">Yubikey</a></li>\n<li>Mike - <a href=\"http://dpaste.com/13W9SF0\" rel=\"nofollow\">Site for hashes from old disks</a>\n\n<ul>\n<li>Answer: <a href=\"https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing\" rel=\"nofollow\">https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing</a></li>\n</ul></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0345.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.","date_published":"2020-04-09T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c46952e4-8ea3-4506-b4eb-54f2870547ee.mp3","mime_type":"audio/mp3","size_in_bytes":34426694,"duration_in_seconds":2868}]},{"id":"e17510a7-48e1-4fa3-9500-222f5e4904ee","title":"344: Grains of Salt","url":"https://www.bsdnow.tv/344","content_text":"Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.\n\nHeadlines\n\nText processing in the shell\n\n\nThis article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!\n\nOne of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.\n\nWhen working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.\n\n\n\n\nRebalancing data on ZFS mirrors\n\n\nOne of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”\n\nIf you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.\n\nDon’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.\n\n\n\n\nNews Roundup\n\nUsing OpenBSD relayd to Add Security Headers\n\n\nI am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.\n\n\n\n\nHow we set up our ZFS filesystem hierarchy in our ZFS pools\n\n\nOur long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.\n\n\n\n\nSpeeding up ZSH\n\nhttps://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh\n\n\nI was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.\n\nIn the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.\n\n\n\n\nHow do Unix Pipes work\n\n\nPipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.\n\n\n\n\nWhat we do to enable us to grow our ZFS pools over time\n\n\nIn my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.\nOur big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.\n\n\n\n\nLinux maintains bugs: The real reason ifconfig on Linux is deprecated\n\n\nIn my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).\n\n\nIn the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.\n\n\n\nClear Your Terminal in Style\n\n\nif you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.\n\nThis post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.\n\n\n\n\nFeedback/Questions\n\n\nGuy - AMD GPU Help\nMLShroyer13 - VLANs and Jails\nMaster One - ZFS Suspend/resume\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.balthazar-rouberol.com/text-processing-in-the-shell\" rel=\"nofollow\">Text processing in the shell</a></h3>\n\n<blockquote>\n<p>This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!</p>\n\n<p>One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.</p>\n\n<p>When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/\" rel=\"nofollow\">Rebalancing data on ZFS mirrors</a></h3>\n\n<blockquote>\n<p>One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”</p>\n\n<p>If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.</p>\n\n<p>Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/\" rel=\"nofollow\">Using OpenBSD relayd to Add Security Headers</a></h3>\n\n<blockquote>\n<p>I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOurContainerFilesystems\" rel=\"nofollow\">How we set up our ZFS filesystem hierarchy in our ZFS pools</a></h3>\n\n<blockquote>\n<p>Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call &#39;work directory&#39; (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.jonlu.ca/posts/speeding-up-zsh\" rel=\"nofollow\">Speeding up ZSH</a></h3>\n\n<p><a href=\"https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh\" rel=\"nofollow\">https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh</a></p>\n\n<blockquote>\n<p>I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.</p>\n\n<p>In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/\" rel=\"nofollow\">How do Unix Pipes work</a></h3>\n\n<blockquote>\n<p>Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSHowWeGrowPools\" rel=\"nofollow\">What we do to enable us to grow our ZFS pools over time</a></h3>\n\n<blockquote>\n<p>In my entry on why ZFS isn&#39;t good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.<br>\nOur big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/\" rel=\"nofollow\">Linux maintains bugs: The real reason ifconfig on Linux is deprecated</a></h3>\n\n<blockquote>\n<p>In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).</p>\n</blockquote>\n\n<p>In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.</p>\n\n<hr>\n\n<h3><a href=\"https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/\" rel=\"nofollow\">Clear Your Terminal in Style</a></h3>\n\n<blockquote>\n<p>if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.</p>\n\n<p>This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.</p>\n</blockquote>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Guy - <a href=\"http://dpaste.com/2NEPDHB\" rel=\"nofollow\">AMD GPU Help</a></li>\n<li>MLShroyer13 - <a href=\"http://dpaste.com/31KBNP4#wrap\" rel=\"nofollow\">VLANs and Jails</a></li>\n<li>Master One - <a href=\"http://dpaste.com/0DKM8CF#wrap\" rel=\"nofollow\">ZFS Suspend/resume</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0344.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.","date_published":"2020-04-02T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e17510a7-48e1-4fa3-9500-222f5e4904ee.mp3","mime_type":"audio/mp3","size_in_bytes":40072591,"duration_in_seconds":3339}]},{"id":"1752e8c2-3d6e-40dc-8bd9-5c7654660b15","title":"343: FreeBSD, Corona: Fight!","url":"https://www.bsdnow.tv/343","content_text":"Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.\n\nHeadlines\n\nFighting the Coronavirus with FreeBSD\n\n\nHere is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.\n\nUPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.\n\nPer default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.\n\n\n\n\nHow to configure the Wireguard VPN in OPNsense\n\n\nWireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha's. The gotcha's occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home's Internet connection.\n\nWireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.\n\nThe documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.\n\n\n\n\nNews Roundup\n\nNomadBSD 1.3.1\n\n\nNomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.\n\n\n\n\nGhostBSD 20.02\n\n\nEric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.\n\n\n\n\nNew FuryBSD XFCE and KDE images\n\n\nThis new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.\n\n\n\n\npf-badhost 0.3 Released\n\n\npf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet's biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.\n\n\n\n\nBeastie Bits\n\n\nDragonFly i915 drm update\nCShell is punk rock\nThe most surprising Unix programs\n\n\n\n\nFeedback/Questions\n\n\nMaster One - Torn between OpenBSD and FreeBSD\nBrad - Follow up to Linus ZFS story\nFilipe Carvalho - Call for Portuguese BSD User Groups\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.leidinger.net/blog/2020/03/19/fighting-the-coronavirus-with-freebsd-foldinghome/\" rel=\"nofollow\">Fighting the Coronavirus with FreeBSD</a></h3>\n\n<blockquote>\n<p>Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.</p>\n\n<p>UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.</p>\n\n<p>Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://homenetworkguy.com/how-to/configure-wireguard-opnsense/\" rel=\"nofollow\">How to configure the Wireguard VPN in OPNsense</a></h3>\n\n<blockquote>\n<p>WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha&#39;s. The gotcha&#39;s occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home&#39;s Internet connection.</p>\n\n<p>WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.</p>\n\n<p>The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://nomadbsd.org/index.html#1.3.1\" rel=\"nofollow\">NomadBSD 1.3.1</a></h3>\n\n<blockquote>\n<p>NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://ghostbsd.org/20.02_release_announcement\" rel=\"nofollow\">GhostBSD 20.02</a></h3>\n\n<blockquote>\n<p>Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.furybsd.org/new-furybsd-12-1-based-images-are-available-for-xfce-and-kde/\" rel=\"nofollow\">New FuryBSD XFCE and KDE images</a></h3>\n\n<blockquote>\n<p>This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.geoghegan.ca/pfbadhost.html\" rel=\"nofollow\">pf-badhost 0.3 Released</a></h3>\n\n<blockquote>\n<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet&#39;s biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/03/23/24324.html\" rel=\"nofollow\">DragonFly i915 drm update</a></li>\n<li><a href=\"http://blog.snailtext.com/posts/cshell-is-punk-rock.html\" rel=\"nofollow\">CShell is punk rock</a></li>\n<li><a href=\"https://minnie.tuhs.org/pipermail/tuhs/2020-March/020664.html\" rel=\"nofollow\">The most surprising Unix programs</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Master One - <a href=\"http://dpaste.com/102HKF5#wrap\" rel=\"nofollow\">Torn between OpenBSD and FreeBSD</a></li>\n<li>Brad - <a href=\"http://dpaste.com/1VXQA2Y#wrap\" rel=\"nofollow\">Follow up to Linus ZFS story</a></li>\n<li>Filipe Carvalho - <a href=\"http://dpaste.com/2H7S8YP\" rel=\"nofollow\">Call for Portuguese BSD User Groups</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0343.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.","date_published":"2020-03-26T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1752e8c2-3d6e-40dc-8bd9-5c7654660b15.mp3","mime_type":"audio/mp3","size_in_bytes":28131915,"duration_in_seconds":2344}]},{"id":"d6b1fa91-dcee-41e7-9e1c-b0f240d34ea0","title":"342: Layout the DVA","url":"https://www.bsdnow.tv/342","content_text":"OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.\n\nHeadlines\n\nOpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload\n\n\nIt has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.\n\nWindows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)\n\nUbuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption\n\nI purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.\n\n\n\nSee article for rest of story\n\n\n\n\nFreeBSD 12.0 EOL\n\n\nDear FreeBSD community,\n\nAs of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.\n\n\n\n12.1 Active release\n12.2 Release Schedule\n\n\n\n\nNews Roundup\n\nSome effects of the ZFS DVA format on data layout and growing ZFS pools\n\n\nOne piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we're talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it's talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn't really thought about until the other day.\n\nRight away we can see why ZFS has a problem removing a vdev; the vdev's number is burned into every DVA that refers to data on it. If there's no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it's been removed.\n\n\n\n\nWarning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.\n\n\nCritical Information for Current FreeNAS and TrueNAS Users\n\n\n\nMicrosoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.\n\nFreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.\n\n\n\n\nFull name of the FreeBSD Root Account\n\n\nNetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....\n\n\n\n\nOpenBSD Go Situation\n\n\nOver in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:\n\nI don't think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.\n\nIf you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don't want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn't guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it's written in.\n\n\n\n\nBeastie Bits\n\n\nTest your TOR\nOPNsense 20.1.1 released\npkg for FreeBSD 1.13\n\n\n\n\nFeedback/Questions\n\n\nBostjan writes in about Wireguard\nCharlie has a followup to wpa_supplicant as lower class citizen\nLars writes about LibreSSL as a positive example\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://functionallyparanoid.com/2020/03/07/openbsd-full-disk-encryption-with-coreboot-and-tianocore-payload/\" rel=\"nofollow\">OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload</a></h3>\n\n<blockquote>\n<p>It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.</p>\n\n<p>Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)</p>\n\n<p>Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption</p>\n\n<p>I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.</p>\n</blockquote>\n\n<ul>\n<li>See article for rest of story</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001930.html\" rel=\"nofollow\">FreeBSD 12.0 EOL</a></h3>\n\n<blockquote>\n<p>Dear FreeBSD community,</p>\n\n<p>As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.freebsd.org/releases/12.1R/announce.html\" rel=\"nofollow\">12.1 Active release</a></li>\n<li><a href=\"https://www.freebsd.org/releases/12.2R/schedule.html\" rel=\"nofollow\">12.2 Release Schedule</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSDVAFormatAndGrowth\" rel=\"nofollow\">Some effects of the ZFS DVA format on data layout and growing ZFS pools</a></h3>\n\n<blockquote>\n<p>One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we&#39;re talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it&#39;s talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn&#39;t really thought about until the other day.</p>\n\n<p>Right away we can see why ZFS has a problem removing a vdev; the vdev&#39;s number is burned into every DVA that refers to data on it. If there&#39;s no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it&#39;s been removed.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/active-directory-truenas-and-freenas/\" rel=\"nofollow\">Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.</a></h3>\n\n<ul>\n<li>Critical Information for Current FreeNAS and TrueNAS Users</li>\n</ul>\n\n<blockquote>\n<p>Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.</p>\n\n<p>FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.geeklan.co.uk/?p=2457\" rel=\"nofollow\">Full name of the FreeBSD Root Account</a></h3>\n\n<blockquote>\n<p>NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/programming/GoOpenBSDSituation\" rel=\"nofollow\">OpenBSD Go Situation</a></h3>\n\n<blockquote>\n<p>Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:</p>\n\n<p>I don&#39;t think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.</p>\n\n<p>If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don&#39;t want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn&#39;t guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it&#39;s written in.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.nycbug.org/pipermail/talk/2020-February/018174.html\" rel=\"nofollow\">Test your TOR</a></li>\n<li><a href=\"https://opnsense.org/opnsense-20-1-1-released/\" rel=\"nofollow\">OPNsense 20.1.1 released</a></li>\n<li><a href=\"https://svnweb.freebsd.org/ports?view=revision&revision=525794\" rel=\"nofollow\">pkg for FreeBSD 1.13</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"http://dpaste.com/3WKG09D#wrap\" rel=\"nofollow\">Bostjan writes in about Wireguard</a></li>\n<li><a href=\"http://dpaste.com/0DDN99Q#wrap\" rel=\"nofollow\">Charlie has a followup to wpa_supplicant as lower class citizen</a></li>\n<li><a href=\"http://dpaste.com/1N12HFB#wrap\" rel=\"nofollow\">Lars writes about LibreSSL as a positive example</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0342.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.","date_published":"2020-03-19T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d6b1fa91-dcee-41e7-9e1c-b0f240d34ea0.mp3","mime_type":"audio/mp3","size_in_bytes":34437665,"duration_in_seconds":2869}]},{"id":"28217a13-b389-4ab7-bc99-8a6f5d61e5b5","title":"341: U-NAS-ification","url":"https://www.bsdnow.tv/341","content_text":"FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.\n\nHeadlines\n\nFreeBSD on Power\n\n\nThe power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.\n\nThe FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.\n\nThis blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.\n\n\n\n\nDragonfly 5.8\n\n\nDragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.\n\nThe details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.\n\n\n\nSee article for rest of information\n\n\n\n\n2nd HamBUG meeting recap\n\n\nThe second meeting of the Hamilton BSD Users Group took place last night\nThe next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020\n\n\n\n\nNews Roundup\n\nFreeNAS/TrueNAS Brand Unification\n\n\nFreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. \n\nFrom the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.\n\nWith the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. \n\n\n\n\nOpenBSD versus Prometheus (and Go).\n\n\nWe have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I've determined that it's not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD's lack of ABI stability\n\n\n\n\nFreeBSD removed gcc from base\n\n\nAs described in Warner's email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1's retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).\n\nGCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.\n\n\n\n\nBeastie Bits\n\n\nNew Archive location for Dragonfly 4.x\nA dead simple git cheat sheet\nXorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections\n\n\n\n\nFeedback/Questions\n\n\nNiclas writes in Regarding the Lenovo E595 user (episode 340)\nLyubomir writes about GELI and ZFS\nPeter writes in about scaling FreeBSD jails\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsdfoundation.org/blog/power-to-the-people-making-freebsd-a-first-class-citizen-on-power/\" rel=\"nofollow\">FreeBSD on Power</a></h3>\n\n<blockquote>\n<p>The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.</p>\n\n<p>The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.</p>\n\n<p>This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflybsd.org/release58/\" rel=\"nofollow\">Dragonfly 5.8</a></h3>\n\n<blockquote>\n<p>DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.</p>\n\n<p>The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.</p>\n</blockquote>\n\n<ul>\n<li>See article for rest of information</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.hambug.ca/\" rel=\"nofollow\">2nd HamBUG meeting recap</a></h3>\n\n<ul>\n<li>The second meeting of the Hamilton BSD Users Group took place last night</li>\n<li>The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020</li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.ixsystems.com/blog/freenas-truenas-unification/\" rel=\"nofollow\">FreeNAS/TrueNAS Brand Unification</a></h3>\n\n<blockquote>\n<p>FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. </p>\n\n<p>From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.</p>\n\n<p>With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. </p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDVsPrometheusAndGo\" rel=\"nofollow\">OpenBSD versus Prometheus (and Go).</a></h3>\n\n<blockquote>\n<p>We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I&#39;ve determined that it&#39;s not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD&#39;s lack of ABI stability</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=358454\" rel=\"nofollow\">FreeBSD removed gcc from base</a></h3>\n\n<blockquote>\n<p>As described in Warner&#39;s email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1&#39;s retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).</p>\n\n<p>GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2020/03/10/24276.html\" rel=\"nofollow\">New Archive location for Dragonfly 4.x</a></li>\n<li><a href=\"https://hub.iwebthings.com/a-dead-simple-git-cheatsheet/\" rel=\"nofollow\">A dead simple git cheat sheet</a></li>\n<li><a href=\"https://twitter.com/lattera/status/1233412881569415168\" rel=\"nofollow\">Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"http://dpaste.com/2YJ6PFW#wrap\" rel=\"nofollow\">Niclas writes in Regarding the Lenovo E595 user (episode 340)</a></li>\n<li><a href=\"http://dpaste.com/1S0DGT3#wrap\" rel=\"nofollow\">Lyubomir writes about GELI and ZFS</a></li>\n<li><a href=\"http://dpaste.com/2FSZQ8V#wrap\" rel=\"nofollow\">Peter writes in about scaling FreeBSD jails</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0341.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.","date_published":"2020-03-12T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/28217a13-b389-4ab7-bc99-8a6f5d61e5b5.mp3","mime_type":"audio/mp3","size_in_bytes":36740725,"duration_in_seconds":3061}]},{"id":"7e026ede-d713-4ed5-993a-9a39cab4aab1","title":"340: Check My Sums","url":"https://www.bsdnow.tv/340","content_text":"Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.\n\nHeadlines\n\nChecksumming in filesystems, and why ZFS is doing it right\n\n\nOne of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:\n\n\n\nData bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.\nMisdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.\nMisdirected read - when we miss reading the block when a bit flip occurred.\nPhantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.\n\n\n\nChecksumming may help us detect errors in a few of those situations.\n\n\n\n\nDragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance\n\n\nIt's been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system \"TMPFS\" optimizations for better throughput including with swap.\n\nOf several interesting commits merged tonight, the improved write clustering is a big one. In particular, \"Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure.\"\n\n\n\nhttps://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860\n\n\n\nThere's also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.\n\n\n\nhttps://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351\n\n\n\nThis work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.\n\n\n\n\nNews Roundup\n\nWhy ZFS is not good at growing and reshaping pools (or shrinking them)\n\n\nrecently read Mark McBride's Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we're basically forced to use mirroring instead of RAIDZ.\n\n(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we're using SSDs instead of HDs.)\n\n\n\n\nUsing PKGSRC on Manjaro Linux aarch64 Pinebook-pro\n\n\nI wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.\n\nOne might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)\n\nI have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/\n\n\n\n\nA Central Log Host with syslog-ng on FreeBSD\n\n\nPart 1\n\n\n\nsyslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.\n\n\n\nPart 2\n\n\n\nThis blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.\n\n\n\n\nBeastie Bits\n\n\nFreeBSD at Linux Conf 2020 session videos now online\nUnlock your laptop with your phone\nManaging a database of vulnerabilities for a package system: the pkgsrc study\nHamilton BSD User group will meet again on March 10th](http://studybsd.com/)\nCharmBUG Meeting: March 24th 7pm in Severn, MD\n***\n\n\nFeedback/Questions\n\n\nAndrew - ZFS feature Flags\nSam - TwinCat BSD\nDacian - Freebsd + amdgpu + Lenovo E595\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://oshogbo.vexillium.org/blog/73/\" rel=\"nofollow\">Checksumming in filesystems, and why ZFS is doing it right</a></h3>\n\n<blockquote>\n<p>One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:</p>\n</blockquote>\n\n<ul>\n<li>Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.</li>\n<li>Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.</li>\n<li>Misdirected read - when we miss reading the block when a bit flip occurred.</li>\n<li>Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.</li>\n</ul>\n\n<blockquote>\n<p>Checksumming may help us detect errors in a few of those situations.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-TMPFS-Throughput\" rel=\"nofollow\">DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance</a></h3>\n\n<blockquote>\n<p>It&#39;s been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system &quot;TMPFS&quot; optimizations for better throughput including with swap.</p>\n\n<p>Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, &quot;Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure.&quot;</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860\" rel=\"nofollow\">https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860</a></li>\n</ul>\n\n<blockquote>\n<p>There&#39;s also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351\" rel=\"nofollow\">https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351</a></li>\n</ul>\n\n<blockquote>\n<p>This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWhyNoRealReshaping\" rel=\"nofollow\">Why ZFS is not good at growing and reshaping pools (or shrinking them)</a></h3>\n\n<blockquote>\n<p>recently read Mark McBride&#39;s Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we&#39;re basically forced to use mirroring instead of RAIDZ.</p>\n\n<p>(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we&#39;re using SSDs instead of HDs.)</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://astr0baby.wordpress.com/2020/02/09/using-pkgsrc-on-manjaro-linux-aarch64-pinebook-pro/\" rel=\"nofollow\">Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro</a></h3>\n\n<blockquote>\n<p>I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.</p>\n\n<p>One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)</p>\n\n<p>I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here <a href=\"https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/\" rel=\"nofollow\">https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/</a></p>\n</blockquote>\n\n<hr>\n\n<h3>A Central Log Host with syslog-ng on FreeBSD</h3>\n\n<ul>\n<li><a href=\"https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html\" rel=\"nofollow\">Part 1</a></li>\n</ul>\n\n<blockquote>\n<p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html\" rel=\"nofollow\">Part 2</a></li>\n</ul>\n\n<blockquote>\n<p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://mirror.linux.org.au/pub/linux.conf.au/2020/room_9/Tuesday/\" rel=\"nofollow\">FreeBSD at Linux Conf 2020 session videos now online</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2020/01/09/freebsd-desktop-part-20-configuration-unlock-your-laptop-with-phone/\" rel=\"nofollow\">Unlock your laptop with your phone</a></li>\n<li><a href=\"https://www.netbsd.org/gallery/presentations/leot/itasec20/pkgsrc-security.pdf\" rel=\"nofollow\">Managing a database of vulnerabilities for a package system: the pkgsrc study</a></li>\n<li>Hamilton BSD User group will meet again on March 10th](<a href=\"http://studybsd.com/\" rel=\"nofollow\">http://studybsd.com/</a>)</li>\n<li><a href=\"https://www.meetup.com/en-AU/CharmBUG/events/268251508/\" rel=\"nofollow\">CharmBUG Meeting: March 24th 7pm in Severn, MD</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Andrew - <a href=\"http://dpaste.com/2YM23C0#wrap\" rel=\"nofollow\">ZFS feature Flags</a></li>\n<li>Sam - <a href=\"http://dpaste.com/0FCZV6R\" rel=\"nofollow\">TwinCat BSD</a></li>\n<li>Dacian - <a href=\"http://dpaste.com/1R7F1JN#wrap\" rel=\"nofollow\">Freebsd + amdgpu + Lenovo E595</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0340.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.","date_published":"2020-03-05T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7e026ede-d713-4ed5-993a-9a39cab4aab1.mp3","mime_type":"audio/mp3","size_in_bytes":36478978,"duration_in_seconds":3039}]},{"id":"581b71e1-6a98-41d7-b8d8-477eaaaba8db","title":"339: BSD Fundraising","url":"https://www.bsdnow.tv/339","content_text":"Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines\n\nMeet FuryBSD: A New Desktop BSD Distribution\n\n\nAt its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.\n\nYou might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.\n\nAs it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”\n\nCurrently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.\n\n\n\n\nNetBSD 9.0\n\n\nThe NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.\n\nThis release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.\n\n\n\n\nNews Roundup\n\nOpenBSD Foundation 2019 campaign wrapup\n\n\nOur target for 2019 was CDN$300K. Our community's continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.\n\nWe thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!\n\n\n\nOpenBSD Foundation 2019 Fundraising Goal Exceeded\n\n\n\n\nA retrospective on our OmniOS ZFS-based NFS fileservers\n\n\nOur OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.\n\nI will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.\n\nOn the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I'm pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.\n\n\n\n\nNetBSD Fundraising 2020 goal\n\n\nIs it really more than 10 years since we last had an official fundraising drive?\n\nLooking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.\n\n\n\n\nOpenSSH 8.2 released February 14, 2020\n\n\nOpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at https://www.openssh.com/.\n\nOpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.\n\nOnce again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:\n\n\n\nhttps://www.openssh.com/donations.html\n\n\n\n\nBeastie Bits\n\n\nFreeNAS vs. Unraid: GRUDGE MATCH!\nUnix Toolbox\nRigs of Rods - OpenBSD Physics Game\nNYCBug - Dr Vixie\nHamilton BSD User group will meet again on March 10th](http://studybsd.com/)\nBSD Stockholm - Meetup March 3rd 2020\n\n\n\n\nFeedback/Questions\n\n\nShirkdog - Question\nMaster One - ZFS + Suspend/resume\nMicah Roth - ZFS write caching\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines</p>\n\n<h3><a href=\"https://itsfoss.com/furybsd/\" rel=\"nofollow\">Meet FuryBSD: A New Desktop BSD Distribution</a></h3>\n\n<blockquote>\n<p>At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.</p>\n\n<p>You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.</p>\n\n<p>As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”</p>\n\n<p>Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html\" rel=\"nofollow\">NetBSD 9.0</a></h3>\n\n<blockquote>\n<p>The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.</p>\n\n<p>This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20200217001107\" rel=\"nofollow\">OpenBSD Foundation 2019 campaign wrapup</a></h3>\n\n<blockquote>\n<p>Our target for 2019 was CDN$300K. Our community&#39;s continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.</p>\n\n<p>We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.openbsdfoundation.org/campaign2019.html\" rel=\"nofollow\">OpenBSD Foundation 2019 Fundraising Goal Exceeded</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OmniOSFileserverRetrospective\" rel=\"nofollow\">A retrospective on our OmniOS ZFS-based NFS fileservers</a></h3>\n\n<blockquote>\n<p>Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.</p>\n\n<p>I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.</p>\n\n<p>On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I&#39;m pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/fundraising_2020\" rel=\"nofollow\">NetBSD Fundraising 2020 goal</a></h3>\n\n<blockquote>\n<p>Is it really more than 10 years since we last had an official fundraising drive?</p>\n\n<p>Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://www.openssh.com/txt/release-8.2\" rel=\"nofollow\">OpenSSH 8.2 released February 14, 2020</a></h3>\n\n<blockquote>\n<p>OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at <a href=\"https://www.openssh.com/\" rel=\"nofollow\">https://www.openssh.com/</a>.</p>\n\n<p>OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.</p>\n\n<p>Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.openssh.com/donations.html\" rel=\"nofollow\">https://www.openssh.com/donations.html</a></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=aXsRIrC5bjg\" rel=\"nofollow\">FreeNAS vs. Unraid: GRUDGE MATCH!</a></li>\n<li><a href=\"http://cb.vu/unixtoolbox.xhtml\" rel=\"nofollow\">Unix Toolbox</a></li>\n<li><a href=\"https://docs.rigsofrods.org/\" rel=\"nofollow\">Rigs of Rods - OpenBSD Physics Game</a></li>\n<li><a href=\"http://dpaste.com/0V35MAB#wrap\" rel=\"nofollow\">NYCBug - Dr Vixie</a></li>\n<li>Hamilton BSD User group will meet again on March 10th](<a href=\"http://studybsd.com/\" rel=\"nofollow\">http://studybsd.com/</a>)</li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/267873938/\" rel=\"nofollow\">BSD Stockholm - Meetup March 3rd 2020</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Shirkdog - <a href=\"http://dpaste.com/36E2BZ1\" rel=\"nofollow\">Question</a></li>\n<li>Master One - <a href=\"http://dpaste.com/3B9M814#wrap\" rel=\"nofollow\">ZFS + Suspend/resume</a></li>\n<li>Micah Roth - <a href=\"http://dpaste.com/0D4GDX1#wrap\" rel=\"nofollow\">ZFS write caching</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0339.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.","date_published":"2020-02-27T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/581b71e1-6a98-41d7-b8d8-477eaaaba8db.mp3","mime_type":"audio/mp3","size_in_bytes":38843791,"duration_in_seconds":3236}]},{"id":"7e9e4cfc-7a05-4ebe-8d45-a7282fe7ab0f","title":"338: iocage in Jail","url":"https://www.bsdnow.tv/338","content_text":"Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.\n\nHeadlines\n\nDistrowatch Fury BSD Review\n\n\nFuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.\n\nFuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.\n\nMy fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.\n\nFuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.\n\n\n\n\nLLDB now works on i386\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n\nIn February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.\n\nThe original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.\n\n\n\n\nNews Roundup\n\nwpa_supplicant is definitely a lower-class citizen, sorry\n\n\nwpa_supplicant is definitely a lower-class citizen, sorry.\n\nI increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part\n    + entire cities have open wifi in their downtown core\n    + edu vs edu+transit split horizon problems have to be solved anyways\n    + many universities have parallel open wifi\n    + rate limiting / fare-share approaches for the open-net, on unmetered\n    + flat-rate solves the problem\n    + LTE hotspot off a phone isn't a rip off anymore\n    + other open networks exist\n\nessentially no one else feels compelled to do use 802.11x for a so called \"semi-open access network\", so I think they've lost the plot on friction vs benefit.\n\n(we've held hackathons at EDU campus that are locked down like that, and in every case we've said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).\n\n\n\n\nKDE FreeBSD Updates Feb 2020\n\n\nSome bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. \n\n\n\nThe big ticket things:\n\n\n Frameworks are at 5.66\nPlasma is at 5.17.5 (the beta 5.18 hasn’t been tried)\nKDE release service has landed 19.12.2 (same day it was released)\n\nDeveloper-centric:\n\n\nKDevelop is at 5.5.0\nKUserfeedback landed its 1.0.0 release\nCMake is 3.16.3\n\nApplications:\n\n\nMusescore is at 3.4.2\nElisa now part of the KDE release service updates\n\nFuure work:\n\n\nKIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.\nKTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.\n\n\n\n\n\nTravel Grant Application for BSDCan is now open\n\n\nHi everyone,\n\nThe Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/\n\nDid you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: https://goo.gl/forms/QzsOMR8Jra0vqFYH2\n\n\n\n\nCreating a ZFS dataset for testing iocage within a jail\n\n\nBe warned, this failed. I’m stalled and I have not completed this.\n\n\n\nI’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.\n\n\n\nIn this post:\n\n\nFreeBSD 12.1\npy36-iocage-1.2_3\npy36-iocage-1.2_4\n\n\n\n\nThis post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.\n\n\n\n\nBeastie Bits\n\n\nReminder: the FreeBSD Journal is free! Check out these great articles\nSerenity GUI desktop running on an OpenBSD kernel\nThe Open Source Parts of MacOS\nFOSDEM videos available\n\n\n\n\nFeedback/Questions\n\n\nMichael - Install with ZFS\nMohammad - Server Freeze\nTodd - ZFS Questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://distrowatch.com/weekly.php?issue=20200127#furybsd\" rel=\"nofollow\">Distrowatch Fury BSD Review</a></h3>\n\n<blockquote>\n<p>FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.</p>\n\n<p>FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.</p>\n\n<p>My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.</p>\n\n<p>FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/lldb_now_works_on_i386\" rel=\"nofollow\">LLDB now works on i386</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>\n\n<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>\n\n<p>The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://marc.info/?l=openbsd-misc&m=158068418807352&w=2\" rel=\"nofollow\">wpa_supplicant is definitely a lower-class citizen, sorry</a></h3>\n\n<blockquote>\n<p>wpa_supplicant is definitely a lower-class citizen, sorry.</p>\n\n<p>I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part<br>\n    + entire cities have open wifi in their downtown core<br>\n    + edu vs edu+transit split horizon problems have to be solved anyways<br>\n    + many universities have parallel open wifi<br>\n    + rate limiting / fare-share approaches for the open-net, on unmetered<br>\n    + flat-rate solves the problem<br>\n    + LTE hotspot off a phone isn&#39;t a rip off anymore<br>\n    + other open networks exist</p>\n\n<p>essentially no one else feels compelled to do use 802.11x for a so called &quot;semi-open access network&quot;, so I think they&#39;ve lost the plot on friction vs benefit.</p>\n\n<p>(we&#39;ve held hackathons at EDU campus that are locked down like that, and in every case we&#39;ve said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://euroquis.nl/freebsd/2020/02/08/freebsd.html\" rel=\"nofollow\">KDE FreeBSD Updates Feb 2020</a></h3>\n\n<blockquote>\n<p>Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. </p>\n</blockquote>\n\n<ul>\n<li>The big ticket things:\n\n<ul>\n<li> Frameworks are at 5.66</li>\n<li>Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried)</li>\n<li>KDE release service has landed 19.12.2 (same day it was released)</li>\n</ul></li>\n<li>Developer-centric:\n\n<ul>\n<li>KDevelop is at 5.5.0</li>\n<li>KUserfeedback landed its 1.0.0 release</li>\n<li>CMake is 3.16.3</li>\n</ul></li>\n<li>Applications:\n\n<ul>\n<li>Musescore is at 3.4.2</li>\n<li>Elisa now part of the KDE release service updates</li>\n</ul></li>\n<li>Fuure work:\n\n<ul>\n<li>KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.</li>\n<li>KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001929.html\" rel=\"nofollow\">Travel Grant Application for BSDCan is now open</a></h3>\n\n<blockquote>\n<p>Hi everyone,</p>\n\n<p>The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: <a href=\"https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/\" rel=\"nofollow\">https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/</a></p>\n\n<p>Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: <a href=\"https://goo.gl/forms/QzsOMR8Jra0vqFYH2\" rel=\"nofollow\">https://goo.gl/forms/QzsOMR8Jra0vqFYH2</a></p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2020/02/01/creating-a-zfs-dataset-for-testing-iocage-within-a-jail/\" rel=\"nofollow\">Creating a ZFS dataset for testing iocage within a jail</a></h3>\n\n<ul>\n<li>Be warned, this failed. I’m stalled and I have not completed this.</li>\n</ul>\n\n<blockquote>\n<p>I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.</p>\n</blockquote>\n\n<ul>\n<li>In this post:\n\n<ul>\n<li>FreeBSD 12.1</li>\n<li>py36-iocage-1.2_3</li>\n<li>py36-iocage-1.2_4</li>\n</ul></li>\n</ul>\n\n<blockquote>\n<p>This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.freebsdfoundation.org/journal/browser-based-edition/\" rel=\"nofollow\">Reminder: the FreeBSD Journal is free! Check out these great articles</a></li>\n<li><a href=\"https://twitter.com/jcs/status/1224205573656322048\" rel=\"nofollow\">Serenity GUI desktop running on an OpenBSD kernel</a></li>\n<li><a href=\"https://github.com/apple-open-source/macos\" rel=\"nofollow\">The Open Source Parts of MacOS</a></li>\n<li><a href=\"https://www.fosdem.org/2020/schedule/track/bsd/\" rel=\"nofollow\">FOSDEM videos available</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Michael - <a href=\"http://dpaste.com/3WRC9CQ#wrap\" rel=\"nofollow\">Install with ZFS</a></li>\n<li>Mohammad - <a href=\"http://dpaste.com/3BYZKMS#wrap\" rel=\"nofollow\">Server Freeze</a></li>\n<li>Todd - <a href=\"http://dpaste.com/2J50HSJ#wrap\" rel=\"nofollow\">ZFS Questions</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0338.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.","date_published":"2020-02-20T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7e9e4cfc-7a05-4ebe-8d45-a7282fe7ab0f.mp3","mime_type":"audio/mp3","size_in_bytes":45174932,"duration_in_seconds":3764}]},{"id":"4a814adb-1ea5-41e3-baee-5645c60315d2","title":"337: Kubernetes on bhyve","url":"https://www.bsdnow.tv/337","content_text":"Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.\n\nHeadlines\n\nThe happinesses and stresses of full-time FOSS work\n\n\nIn the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.\n\nFebruary will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.\n\nThe good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.\n\nThe frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.\n\n\n\n\nBuilding a FreeBSD File Server\n\n\nRecently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.\n\nNow, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!\n\n\n\n\nReport from the first Hamilton BSD Users Group Meeting\n\n\nFebruary 11th was the first meeting of this new user group, founded by John Young and myself\n\n11 people attended, and a lot of good discussions were had\n\nOne of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.\n\nSpecial thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.\n\nThe next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.\n\nWe are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.\n\n\n\n\nNews Roundup\n\nKubernetes on FreeBSD Bhyve\n\n\nThere are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!\n\n\n\n\nNetBSD 9 RC1 Available\n\n\nWe hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).\n\n\n\nHere are a few highlights of the new release:\n\n\nSupport for Arm AArch64 (64-bit Armv8-A) machines, including \"Arm ServerReady\" compliant machines (SBBR+SBSA)\nEnhanced hardware support for Armv7-A\nUpdated GPU drivers (e.g. support for Intel Kabylake)\nEnhanced virtualization support\nSupport for hardware-accelerated virtualization (NVMM)\nSupport for Performance Monitoring Counters\nSupport for Kernel ASLR\nSupport several kernel sanitizers (KLEAK, KASAN, KUBSAN)\nSupport for userland sanitizers\nAudit of the network stack\nMany improvements in NPF\nUpdated ZFS\nReworked error handling and NCQ support in the SATA subsystem\nSupport a common framework for USB Ethernet drivers (usbnet)\n\nYou can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/\n\n\n\n\nOPNsense 20.1 Keen Kingfisher released\n\n\nFor over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.\n\n20.1, nicknamed \"Keen Kingfisher\", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.\n\n\n\n\nIdealistic Future for HardenedBSD\n\n\nOver the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!\n\nHardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations.\n\nNavigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.\n\n\n\n\nBeastie Bits\n\n\nWarner Losh's FOSDEM talk\nRelational Pipes v0.15\nA reminder for where to find NetBSD ARM images\nNew Safe Memory Reclamation feature in UMA\nBSD Users Stockholm Meetup\n\n\n\n\nFeedback/Questions\n\n\nZFS - Rosetta Stone Document?\nPat - Question\nSigflup - Wayland on the BSDs\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://drewdevault.com//2020/01/21/Stress-and-happiness.html\" rel=\"nofollow\">The happinesses and stresses of full-time FOSS work</a></h3>\n\n<blockquote>\n<p>In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.</p>\n\n<p>February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.</p>\n\n<p>The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.</p>\n\n<p>The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.vmwareblog.org/building-freebsd-file-server/\" rel=\"nofollow\">Building a FreeBSD File Server</a></h3>\n\n<blockquote>\n<p>Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.</p>\n\n<p>Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://twitter.com/hambug_ca/status/1227664949914349569\" rel=\"nofollow\">Report from the first Hamilton BSD Users Group Meeting</a></h3>\n\n<blockquote>\n<p>February 11th was the first meeting of this new user group, founded by John Young and myself</p>\n\n<p>11 people attended, and a lot of good discussions were had</p>\n\n<p>One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.</p>\n\n<p>Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.</p>\n\n<p>The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.</p>\n\n<p>We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html\" rel=\"nofollow\">Kubernetes on FreeBSD Bhyve</a></h3>\n\n<blockquote>\n<p>There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let&#39;s take a FreeBSD here!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd\" rel=\"nofollow\">NetBSD 9 RC1 Available</a></h3>\n\n<blockquote>\n<p>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</p>\n</blockquote>\n\n<ul>\n<li><p>Here are a few highlights of the new release:</p>\n\n<ul>\n<li>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot; compliant machines (SBBR+SBSA)</li>\n<li>Enhanced hardware support for Armv7-A</li>\n<li>Updated GPU drivers (e.g. support for Intel Kabylake)</li>\n<li>Enhanced virtualization support</li>\n<li>Support for hardware-accelerated virtualization (NVMM)</li>\n<li>Support for Performance Monitoring Counters</li>\n<li>Support for Kernel ASLR</li>\n<li>Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)</li>\n<li>Support for userland sanitizers</li>\n<li>Audit of the network stack</li>\n<li>Many improvements in NPF</li>\n<li>Updated ZFS</li>\n<li>Reworked error handling and NCQ support in the SATA subsystem</li>\n<li>Support a common framework for USB Ethernet drivers (usbnet)</li>\n</ul></li>\n<li><p>You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: <a href=\"https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/\" rel=\"nofollow\">https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/</a></p></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-20-1-keen-kingfisher-released/\" rel=\"nofollow\">OPNsense 20.1 Keen Kingfisher released</a></h3>\n\n<blockquote>\n<p>For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p>\n\n<p>20.1, nicknamed &quot;Keen Kingfisher&quot;, is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd\" rel=\"nofollow\">Idealistic Future for HardenedBSD</a></h3>\n\n<blockquote>\n<p>Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year&#39;s death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!</p>\n\n<p>HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system&#39;s security posture will increase, especially with our focus on exploit mitigations.</p>\n\n<p>Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD&#39;s 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://fosdem.org/2020/interviews/warner-losh/\" rel=\"nofollow\">Warner Losh&#39;s FOSDEM talk</a></li>\n<li><a href=\"https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml\" rel=\"nofollow\">Relational Pipes v0.15</a></li>\n<li><a href=\"http://www.armbsd.org/arm/\" rel=\"nofollow\">A reminder for where to find NetBSD ARM images</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html\" rel=\"nofollow\">New Safe Memory Reclamation feature in UMA</a></li>\n<li><a href=\"https://twitter.com/niclaszeising/status/1216667359831842817\" rel=\"nofollow\">BSD Users Stockholm Meetup</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>ZFS - <a href=\"http://dpaste.com/13EK8YH#wrap\" rel=\"nofollow\">Rosetta Stone Document?</a></li>\n<li>Pat - <a href=\"http://dpaste.com/2DN5RA4#wrap\" rel=\"nofollow\">Question</a></li>\n<li>Sigflup - <a href=\"http://dpaste.com/03Y4FQ7#wrap\" rel=\"nofollow\">Wayland on the BSDs</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0337.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.","date_published":"2020-02-13T11:30:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4a814adb-1ea5-41e3-baee-5645c60315d2.mp3","mime_type":"audio/mp3","size_in_bytes":57168584,"duration_in_seconds":4764}]},{"id":"3f404c97-d972-4734-9152-420ea4263317","title":"336: Archived Knowledge","url":"https://www.bsdnow.tv/336","content_text":"Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.\n\nHeadlines\n\nOpenBSD has to be a BSD Unix and you couldn't duplicate it with Linux\n\n\nOpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it's right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.\n\nLinux and the *BSDs have a significantly different model of what they are. BSDs have a 'base system' that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.\n\nMaking global changes is an important part of what makes OpenBSD's approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it's possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.\n\nThis goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it's not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don't fit into what OpenBSD will accept, they just lose out.\n\n\n\n\nFreeBSD Quarterly Status Report 2019Q4\n\n\nHere is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.\n\nIf you thought that the FreeBSD community was less active in the Christmas' quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.\n\nHave a nice read!\n\n\n\n\nNews Roundup\n\nOPNsense 19.7.9 released\n\n\nAs 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.\n\nFor now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.\n\n\n\n\nArchives are important to retain and pass on knowledge\n\n\nArchives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.\n\n\n\n\nHardenedBSD Tor Onion Service v3 Nodes\n\n\nI've been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I'm happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.\n\n\n\nhardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion\nci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion\nci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion\nci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion\ngit-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion\n\n\n\n\nBeastie Bits\n\n\nThe Missing Semester of Your CS Education (MIT Course)\nAn old Unix Ad\nOpenBSD syscall call-from verification\nOpenBSD/arm64 on Pinebook\nReminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton.\nNYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes”\n8th Meetup of the Stockholm BUG: March 3 at 18:00\nPolish BSD User Group meets on Feb 11, 2020 at 18:15\n\n\n\n\nFeedback/Questions\n\n\nSean - ZFS and Creation Dates\nChristopher - Help on ZFS Disaster Recovery\nMike - Encrypted ZFS Send\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMustBeABSD?showcomments\" rel=\"nofollow\">OpenBSD has to be a BSD Unix and you couldn&#39;t duplicate it with Linux</a></h3>\n\n<blockquote>\n<p>OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it&#39;s right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.</p>\n\n<p>Linux and the *BSDs have a significantly different model of what they are. BSDs have a &#39;base system&#39; that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.</p>\n\n<p>Making global changes is an important part of what makes OpenBSD&#39;s approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it&#39;s possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.</p>\n\n<p>This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it&#39;s not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don&#39;t fit into what OpenBSD will accept, they just lose out.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2020-January/001923.html\" rel=\"nofollow\">FreeBSD Quarterly Status Report 2019Q4</a></h3>\n\n<blockquote>\n<p>Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.</p>\n\n<p>If you thought that the FreeBSD community was less active in the Christmas&#39; quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.</p>\n\n<p>Have a nice read!</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://opnsense.org/opnsense-19-7-9-released/\" rel=\"nofollow\">OPNsense 19.7.9 released</a></h3>\n\n<blockquote>\n<p>As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.</p>\n\n<p>For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dan.langille.org/2020/01/07/archives-are-important-to-retain-and-pass-on-knowledge/\" rel=\"nofollow\">Archives are important to retain and pass on knowledge</a></h3>\n\n<blockquote>\n<p>Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2020-01-30/hardenedbsd-tor-onion-service-v3-nodes\" rel=\"nofollow\">HardenedBSD Tor Onion Service v3 Nodes</a></h3>\n\n<blockquote>\n<p>I&#39;ve been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I&#39;m happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.</p>\n</blockquote>\n\n<ul>\n<li>hardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion</li>\n<li>ci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion</li>\n<li>ci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion</li>\n<li>ci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion</li>\n<li>git-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion</li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://missing.csail.mit.edu/\" rel=\"nofollow\">The Missing Semester of Your CS Education (MIT Course)</a></li>\n<li><a href=\"https://i.redd.it/503390rf7md41.png\" rel=\"nofollow\">An old Unix Ad</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-tech&m=157488907117170&w=2\" rel=\"nofollow\">OpenBSD syscall call-from verification</a></li>\n<li><a href=\"https://twitter.com/bluerise/status/1220963106563579909\" rel=\"nofollow\">OpenBSD/arm64 on Pinebook</a></li>\n<li><a href=\"http://studybsd.com/\" rel=\"nofollow\">Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton.</a></li>\n<li><a href=\"https://www.nycbug.org/\" rel=\"nofollow\">NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes”</a></li>\n<li><a href=\"https://www.meetup.com/de-DE/BSD-Users-Stockholm/events/267873938/\" rel=\"nofollow\">8th Meetup of the Stockholm BUG: March 3 at 18:00</a></li>\n<li><a href=\"https://bsd-pl.org/en\" rel=\"nofollow\">Polish BSD User Group meets on Feb 11, 2020 at 18:15</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Sean - <a href=\"http://dpaste.com/3W5WBV0#wrap\" rel=\"nofollow\">ZFS and Creation Dates</a></li>\n<li>Christopher - <a href=\"http://dpaste.com/3SE43PW\" rel=\"nofollow\">Help on ZFS Disaster Recovery</a></li>\n<li>Mike - <a href=\"http://dpaste.com/00J5JZG#wrap\" rel=\"nofollow\">Encrypted ZFS Send</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0336.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.","date_published":"2020-02-06T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3f404c97-d972-4734-9152-420ea4263317.mp3","mime_type":"audio/mp3","size_in_bytes":41728650,"duration_in_seconds":3477}]},{"id":"12678787-276e-4471-a8a3-115404afed57","title":"335: FreeBSD Down Under","url":"https://www.bsdnow.tv/335","content_text":"Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.\n\nHeadlines\n\nFreeBSD is an amazing operating System\n\n\nUpdate 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD \"fanboy\". I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It's about why I like FreeBSD and that I recommend you try it out if you're into messing with operating systems.\n\nI think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.\n\nI had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.\n\nWhen I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, \"The Free Version of Berkeley UNIX\" and \"Rock Solid Stability\", and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.\n\n\n\n\nHyperbola Dev Interview\n\n\nIn late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).\n\nHyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.\n\nTo get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.\n\n\n\n\nNews Roundup\n\nImproving the ptrace(2) API and preparing for LLVM-10.0\n\n\nThis month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.\n\nAs LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).\n\n\n\n\nThe first FreeBSD conference in Australia\n\n\nFreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.\n\nWhile there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.\n\nAnd on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.\n\n\n\n\nA practical guide to containers on FreeNAS for a depraved psychopath\n\n\nThis is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.\n\n\nBut muh jails?\n\n\nYou know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… \n\n\nSo jails are dead then?\n\n\nNo, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.\n\n\n\n\nWhy you should migrate everything from Linux to BSD\n\n\nAs an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.\n\n\n\nResponse Should you migrate from Linux to BSD? It depends.\n\n\nBeastie Bits\n\n\nUsing the OpenBSD ports tree with dedicated users\nbroot on FreeBSD\nA Trip down Memory Lane\nRunning syslog-ng in BastilleBSD\nNASA : Using Software Packages in pkgsrc\n\n\n\n\nFeedback/Questions\n\n\nAll of our questions this week were pretty technical in nature so I'm going to save those for the next episode so Allan can weigh in on them, since if we cover them now we're basically going to be deferring to Allan anyway.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.unixsheikh.com/articles/freebsd-is-an-amazing-operating-system.html\" rel=\"nofollow\">FreeBSD is an amazing operating System</a></h3>\n\n<blockquote>\n<p>Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD &quot;fanboy&quot;. I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It&#39;s about why I like FreeBSD and that I recommend you try it out if you&#39;re into messing with operating systems.</p>\n\n<p>I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.</p>\n\n<p>I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.</p>\n\n<p>When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, &quot;The Free Version of Berkeley UNIX&quot; and &quot;Rock Solid Stability&quot;, and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://itsfoss.com/hyperbola-linux-bsd/\" rel=\"nofollow\">Hyperbola Dev Interview</a></h3>\n\n<blockquote>\n<p>In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).</p>\n\n<p>Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.</p>\n\n<p>To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/improving_the_ptrace_2_api\" rel=\"nofollow\">Improving the ptrace(2) API and preparing for LLVM-10.0</a></h3>\n\n<blockquote>\n<p>This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.</p>\n\n<p>As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://rubenerd.com/the-first-freebsd-conference-in-australia/\" rel=\"nofollow\">The first FreeBSD conference in Australia</a></h3>\n\n<blockquote>\n<p>FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.</p>\n\n<p>While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.</p>\n\n<p>And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394\" rel=\"nofollow\">A practical guide to containers on FreeNAS for a depraved psychopath</a></h3>\n\n<blockquote>\n<p>This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.</p>\n</blockquote>\n\n<p>But muh jails?</p>\n\n<blockquote>\n<p>You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… </p>\n</blockquote>\n\n<p>So jails are dead then?</p>\n\n<blockquote>\n<p>No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.unixsheikh.com/articles/why-you-should-migrate-everything-from-linux-to-bsd.html\" rel=\"nofollow\">Why you should migrate everything from Linux to BSD</a></h3>\n\n<blockquote>\n<p>As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.</p>\n</blockquote>\n\n<ul>\n<li>Response <a href=\"https://fediverse.blog/%7E/AllGoodThings/should-you-migrate-from-linux-to-bsd-it-depends\" rel=\"nofollow\">Should you migrate from Linux to BSD? It depends.</a></li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://dataswamp.org/%7Esolene/2020-01-11-privsep.html\" rel=\"nofollow\">Using the OpenBSD ports tree with dedicated users</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2020/01/10/run-broot-on-freebsd/\" rel=\"nofollow\">broot on FreeBSD</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base/head/share/misc/bsd-family-tree?view=co\" rel=\"nofollow\">A Trip down Memory Lane</a></li>\n<li><a href=\"https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-bastillebsd\" rel=\"nofollow\">Running syslog-ng in BastilleBSD</a></li>\n<li><a href=\"https://www.nas.nasa.gov/hecc/support/kb/using-software-packages-in-pkgsrc_493.html\" rel=\"nofollow\">NASA : Using Software Packages in pkgsrc</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>All of our questions this week were pretty technical in nature so I&#39;m going to save those for the next episode so Allan can weigh in on them, since if we cover them now we&#39;re basically going to be deferring to Allan anyway.</li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0335.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.","date_published":"2020-01-30T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/12678787-276e-4471-a8a3-115404afed57.mp3","mime_type":"audio/mp3","size_in_bytes":38818086,"duration_in_seconds":3234}]},{"id":"695d1b03-3bc3-485f-90ba-c6d905189b36","title":"334: Distrowatch Running FreeBSD","url":"https://www.bsdnow.tv/334","content_text":"Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.\n\nHeadlines\n\nUpgrading FreeBSD from 11.3 to 12.1\n\n\nNow here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.\n\nOur source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.\n\n\n\n\nSwitching Distrowatch over to BSD\n\n\nThis may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I'm one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.\n\nThe primary \"something else\" option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.\n\nSince the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.\n\n\n\n\nNews Roundup\n\niked(8) automatic IPv6 blocking removed\n\n\niked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.\n\nIf you previously used iked(8)'s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.\n\n\n\n\nLinus says dont run ZFS\n\n\n“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”\n\nThis is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.\n\nTo avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.\n\n\n\n\nGSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD\n\n\nWe successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.\n\nThe Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.\n\n\n\n\nWorking towards LLDB on i386 NetBSD\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n\nIn February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.\n\nThroughout December I've continued working on our build bot maintenance, in particular enabling compiler-rt tests. I've revived and finished my old patch for extended register state (XState) in core dumps. I've started working on bringing proper i386 support to LLDB.\n\n\n\n\nBeastie Bits\n\n\nAn open source Civilization V\nBSD Groups in Italy\nWhy is Wednesday, November 17, 1858 the base time for OpenVMS?\nBenchmarking shell pipelines and the Unix “tools” philosophy\nLPI and BSD working together\n\n\n\n\nFeedback/Questions\n\n\nPat - March Meeting\nMadhukar - Overheating Laptop\nWarren - R vs S\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.bimajority.org/2020/01/13/upgrading-freebsd-from-11-3-to-12-1/\" rel=\"nofollow\">Upgrading FreeBSD from 11.3 to 12.1</a></h3>\n\n<blockquote>\n<p>Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.</p>\n\n<p>Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.reddit.com/r/freebsd/comments/eodhit/switching_distrowatch_over_to_freebsd_ama/\" rel=\"nofollow\">Switching Distrowatch over to BSD</a></h3>\n\n<blockquote>\n<p>This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I&#39;m one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.</p>\n\n<p>The primary &quot;something else&quot; option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.</p>\n\n<p>Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.openbsd.org/faq/current.html#r20200114\" rel=\"nofollow\">iked(8) automatic IPv6 blocking removed</a></h3>\n\n<blockquote>\n<p>iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.</p>\n\n<p>If you previously used iked(8)&#39;s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://itsfoss.com/linus-torvalds-zfs/\" rel=\"nofollow\">Linus says dont run ZFS</a></h3>\n\n<blockquote>\n<p>“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”</p>\n\n<p>This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.</p>\n\n<p>To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2019_final_report_incorporating\" rel=\"nofollow\">GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD</a></h3>\n\n<blockquote>\n<p>We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.</p>\n\n<p>The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/working_towards_lldb_on_i386\" rel=\"nofollow\">Working towards LLDB on i386 NetBSD</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>\n\n<p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p>\n\n<p>Throughout December I&#39;ve continued working on our build bot maintenance, in particular enabling compiler-rt tests. I&#39;ve revived and finished my old patch for extended register state (XState) in core dumps. I&#39;ve started working on bringing proper i386 support to LLDB.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://github.com/yairm210/UnCiv\" rel=\"nofollow\">An open source Civilization V</a></li>\n<li><a href=\"https://bsdnotizie.blogspot.com/2020/01/gruppi-bsd-in-italia.html\" rel=\"nofollow\">BSD Groups in Italy</a></li>\n<li><a href=\"https://www.slac.stanford.edu/%7Erkj/crazytime.txt\" rel=\"nofollow\">Why is Wednesday, November 17, 1858 the base time for OpenVMS?</a></li>\n<li><a href=\"https://blog.plover.com/Unix/tools.html\" rel=\"nofollow\">Benchmarking shell pipelines and the Unix “tools” philosophy</a></li>\n<li><a href=\"https://youtu.be/QItb5aoj7Oc\" rel=\"nofollow\">LPI and BSD working together</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Pat - <a href=\"http://dpaste.com/2BMGZVV#wrap\" rel=\"nofollow\">March Meeting</a></li>\n<li>Madhukar - <a href=\"http://dpaste.com/17WNVM8#wrap\" rel=\"nofollow\">Overheating Laptop</a></li>\n<li>Warren - <a href=\"http://dpaste.com/3AZYFB1#wrap\" rel=\"nofollow\">R vs S</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0334.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.","date_published":"2020-01-23T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/695d1b03-3bc3-485f-90ba-c6d905189b36.mp3","mime_type":"audio/mp3","size_in_bytes":34652078,"duration_in_seconds":2887}]},{"id":"9f3dffa3-f888-4af3-8a0a-3a236e130b4f","title":"333: Unix Keyboard Joy","url":"https://www.bsdnow.tv/333","content_text":"Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.\n\nHeadlines\n\nYour Impact on FreeBSD in 2019\n\n\nIt’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.\n\nIn 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.\n\nOur advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.\n\nOur travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.\n\n\n\n\nWireguard on OpenBSD Router\n\n\nwireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.\n\nmodern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.\n\nmy setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.\n\nrunning : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat'ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.\n\n\n\n\nNews Roundup\n\nAmazon now has FreeBSD/ARM 12\n\n\nAWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.\n\nCompared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.\n\nThe company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.\n\n\nGeneral-purpose instances (M6g and M6gd)\nCompute-optimized instances (C6g and C6gd)\nMemory-optimized instances (R6g and R6gd)\n\n\nYou can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.\n\nAnd you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.\n\nAWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).\n\n\n\nCoverage of AWS Announcement \n\n\n\n\nAnnouncing the pkgsrc-2019Q4 release\n\n\nThe pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at https://www.pkgsrc.org/\n\nIn total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc's tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.\n\n\n\n\nThe Joys of UNIX Keyboards\n\n\nI fell in love with a dead keyboard layout.\n\nA decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.\n\nWe never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.\n\nI never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.\n\n\n\n\nOpenBSD on Digital Ocean\n\n\nLast night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don't support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.\n\nThey are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn't support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.\n\nThankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.\n\n\n\n\nBeastie Bits\n\n\nFreeBSD defaults to LLVM on PPC\nTheo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019\nBastille Poll about what people would like to see in 2020\nNotes on the classic book : The Design of the UNIX Operating System\nMultics History\nFirst meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St\n\n\n\n\nFeedback/Questions\n\n\nBill - 1.1 CDROM\nGreg - More 50 Year anniversary information\nDave - Question time for Allan\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsdfoundation.org/blog/your-impact-on-freebsd-in-2019/\" rel=\"nofollow\">Your Impact on FreeBSD in 2019</a></h3>\n\n<blockquote>\n<p>It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.</p>\n\n<p>In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.</p>\n\n<p>Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.</p>\n\n<p>Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://obscurity.xyz/bsd/open/wireguard.html\" rel=\"nofollow\">Wireguard on OpenBSD Router</a></h3>\n\n<blockquote>\n<p>wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.</p>\n\n<p>modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.</p>\n\n<p>my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.</p>\n\n<p>running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat&#39;ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://aws.amazon.com/marketplace/pp/B081NF7BY7\" rel=\"nofollow\">Amazon now has FreeBSD/ARM 12</a></h3>\n\n<blockquote>\n<p>AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.</p>\n\n<p>Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.</p>\n\n<p>The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.</p>\n\n<ul>\n<li><p>General-purpose instances (M6g and M6gd)</p></li>\n<li><p>Compute-optimized instances (C6g and C6gd)</p></li>\n<li><p>Memory-optimized instances (R6g and R6gd)</p></li>\n</ul>\n\n<p>You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.</p>\n\n<p>And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.</p>\n\n<p>AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://techcrunch.com/2019/12/03/aws-announces-new-arm-based-instances-with-graviton2-processors/\" rel=\"nofollow\">Coverage of AWS Announcement </a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://mail-index.netbsd.org/pkgsrc-users/2020/01/06/msg030130.html\" rel=\"nofollow\">Announcing the pkgsrc-2019Q4 release</a></h3>\n\n<blockquote>\n<p>The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at <a href=\"https://www.pkgsrc.org/\" rel=\"nofollow\">https://www.pkgsrc.org/</a></p>\n\n<p>In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc&#39;s tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://donatstudios.com/UNIX-Keyboards\" rel=\"nofollow\">The Joys of UNIX Keyboards</a></h3>\n\n<blockquote>\n<p>I fell in love with a dead keyboard layout.</p>\n\n<p>A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.</p>\n\n<p>We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.</p>\n\n<p>I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.going-flying.com/blog/openbsd-on-digitalocean.html\" rel=\"nofollow\">OpenBSD on Digital Ocean</a></h3>\n\n<blockquote>\n<p>Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don&#39;t support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.</p>\n\n<p>They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn&#39;t support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.</p>\n\n<p>Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=356111\" rel=\"nofollow\">FreeBSD defaults to LLVM on PPC</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20191231214356\" rel=\"nofollow\">Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019</a></li>\n<li><a href=\"https://twitter.com/BastilleBSD/status/1211475103143251968\" rel=\"nofollow\">Bastille Poll about what people would like to see in 2020</a></li>\n<li><a href=\"https://github.com/suvratapte/Maurice-Bach-Notes\" rel=\"nofollow\">Notes on the classic book : The Design of the UNIX Operating System</a></li>\n<li><a href=\"https://www.multicians.org/\" rel=\"nofollow\">Multics History</a></li>\n<li><a href=\"http://studybsd.com/\" rel=\"nofollow\">First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Bill - <a href=\"http://dpaste.com/2H9CW6R\" rel=\"nofollow\">1.1 CDROM</a></li>\n<li>Greg - <a href=\"http://dpaste.com/2SGA3KY\" rel=\"nofollow\">More 50 Year anniversary information</a></li>\n<li>Dave - <a href=\"http://dpaste.com/3ZAEKHD#wrap\" rel=\"nofollow\">Question time for Allan</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0333.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.","date_published":"2020-01-16T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9f3dffa3-f888-4af3-8a0a-3a236e130b4f.mp3","mime_type":"audio/mp3","size_in_bytes":29159154,"duration_in_seconds":2429}]},{"id":"34cc6ce3-e7ed-41bf-880e-e77f6a27fe3c","title":"332: The BSD Hyperbole","url":"https://www.bsdnow.tv/332","content_text":"Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.\n\nHeadlines\n\nHyperbolaBSD Announcement\n\n\nDue to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.\n\nThis was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.\n\nThis will not be a \"distro\", but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.\n\n\n\nReasons for this include:\n\n\nLinux kernel forcing adaption of DRM, including HDCP.\nLinux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)\nLinux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)\nMany GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)\nAs such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.\n\n\n\n\nFuture versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.\n\nHyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.\n\n\n\nForum Post \n\n\n\n\nA simple IPFW In-Kernel NAT setup on FreeBSD\n\n\nAfter graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.\n\nWhy IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.\n\nBut since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.\n\n\n\n\nNews Roundup\n\nHEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux\n\n\nThis is just a heads up that the Wayland option is now turned on by\n\n\ndefault for NetBSD 9 and Linux in cases where it peacefully coexists\nwith X11. \n\n\nRight now, this effects the following packages: \n\n\ngraphics/MesaLib\ndevel/SDL2\nwww/webkit-gtk\nx11/gtk3\n\n\n\n\nThe WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68\n\nPlease keep me informed of any fallout. Hopefully, there will be none.\n\nIf you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.\n\n\n\n\nLLDB Threading support now ready for mainline\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.\n\nSo far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.\n\n\n\n\nOpenSSH U2F/FIDO support in base\n\n\nHardware backed keys can be generated using \"ssh-keygen -t ecdsa-sk\" (or \"ed25519-sk\" if your token supports it). Many tokens require to be touched/tapped to confirm this step.\n\nYou'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a \"key handle\" that is used by the security key to derive the real private key at signing time.\n\nSo, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.\n\n\n\n\ndrm/i915: Update to Linux 4.8.17\n\n\n drm/i915: Update to Linux 4.8.17\n\n\nBroxton, Valleyview and Cherryview support improvements\nBroadwell and Gen9/Skylake support improvements\nBroadwell brightness fixes from OpenBSD\nAtomic modesetting improvements\nVarious bug fixes and performance enhancements\n\n\n\n\n\nBeastie Bits\n\n\nVisual Studio Code port for FreeBSD\nOpenBSD syscall call-from verification\nPeertube on OpenBSD\nFuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski\nTwitter Bot for Prop65\nInteractive vim tutorial\nFirst BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St\n***\n\n\nFeedback/Questions\n\n\nSamir - cgit\nRussell - R\nWolfgang - Question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/\" rel=\"nofollow\">HyperbolaBSD Announcement</a></h3>\n\n<blockquote>\n<p>Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.</p>\n\n<p>This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.</p>\n\n<p>This will not be a &quot;distro&quot;, but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.</p>\n</blockquote>\n\n<ul>\n<li>Reasons for this include:\n\n<ul>\n<li>Linux kernel forcing adaption of DRM, including HDCP.</li>\n<li>Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)</li>\n<li>Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)</li>\n<li>Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)</li>\n<li>As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.</li>\n</ul></li>\n</ul>\n\n<blockquote>\n<p>Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.</p>\n\n<p>HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://forums.hyperbola.info/viewtopic.php?id=315\" rel=\"nofollow\">Forum Post</a> </li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.neelc.org/posts/freebsd-ipfw-nat/\" rel=\"nofollow\">A simple IPFW In-Kernel NAT setup on FreeBSD</a></h3>\n\n<blockquote>\n<p>After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.</p>\n\n<p>Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.</p>\n\n<p>But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://mail-index.netbsd.org/pkgsrc-users/2020/01/05/msg030124.html\" rel=\"nofollow\">HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux</a></h3>\n\n<blockquote>\n<p>This is just a heads up that the Wayland option is now turned on by</p>\n</blockquote>\n\n<p>default for NetBSD 9 and Linux in cases where it peacefully coexists<br>\nwith X11. </p>\n\n<ul>\n<li>Right now, this effects the following packages: \n\n<ul>\n<li>graphics/MesaLib</li>\n<li>devel/SDL2</li>\n<li>www/webkit-gtk</li>\n<li>x11/gtk3</li>\n</ul></li>\n</ul>\n\n<blockquote>\n<p>The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68</p>\n\n<p>Please keep me informed of any fallout. Hopefully, there will be none.</p>\n\n<p>If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready\" rel=\"nofollow\">LLDB Threading support now ready for mainline</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>\n\n<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>\n\n<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.undeadly.org/cgi?action=article;sid=20191115064850\" rel=\"nofollow\">OpenSSH U2F/FIDO support in base</a></h3>\n\n<blockquote>\n<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>\n\n<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>\n\n<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-December/720257.html\" rel=\"nofollow\">drm/i915: Update to Linux 4.8.17</a></h3>\n\n<ul>\n<li> drm/i915: Update to Linux 4.8.17\n\n<ul>\n<li>Broxton, Valleyview and Cherryview support improvements</li>\n<li>Broadwell and Gen9/Skylake support improvements</li>\n<li>Broadwell brightness fixes from OpenBSD</li>\n<li>Atomic modesetting improvements</li>\n<li>Various bug fixes and performance enhancements</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://github.com/tagattie/FreeBSD-VSCode\" rel=\"nofollow\">Visual Studio Code port for FreeBSD</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-tech&m=157488907117170&w=2\" rel=\"nofollow\">OpenBSD syscall call-from verification</a></li>\n<li><a href=\"https://www.22decembre.eu/en/2019/12/09/peertube-14-openbsd/\" rel=\"nofollow\">Peertube on OpenBSD</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=bbNCqFdQEyk&feature=youtu.be\" rel=\"nofollow\">Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski</a></li>\n<li><a href=\"https://twitter.com/prop65bot/status/1199003319307558912\" rel=\"nofollow\">Twitter Bot for Prop65</a></li>\n<li><a href=\"https://www.openvim.com/\" rel=\"nofollow\">Interactive vim tutorial</a></li>\n<li><a href=\"http://studybsd.com/\" rel=\"nofollow\">First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Samir - <a href=\"http://dpaste.com/2B22M24#wrap\" rel=\"nofollow\">cgit</a></li>\n<li>Russell - <a href=\"http://dpaste.com/0J5TYY0#wrap\" rel=\"nofollow\">R</a></li>\n<li>Wolfgang - <a href=\"http://dpaste.com/3MQAH27#wrap\" rel=\"nofollow\">Question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0332.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.","date_published":"2020-01-09T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/34cc6ce3-e7ed-41bf-880e-e77f6a27fe3c.mp3","mime_type":"audio/mp3","size_in_bytes":32549325,"duration_in_seconds":2712}]},{"id":"aa8d58dd-a2a5-4c8a-9244-755d523fe855","title":"331: Why Computers Suck","url":"https://www.bsdnow.tv/331","content_text":"How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.\n\nHeadlines\n\nWhy computers suck and how learning from OpenBSD can make them marginally less horrible\n\n\nHow much better could things actually be if we abandoned the enterprise development model? \n\nNext I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.\n\nOne of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. \n\nTo prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.\n\n\n\n\nHow Unix Works: Become a Better Software Engineer\n\n\nUnix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.\n\nEvery fancy thing you want done is one google search away.\n\nBut understanding why the solution does what you want is not the same.\n\nThat’s what gives you real power, the power to not be afraid.\n\nAnd since it rhymes, it must be true.\n\n\n\n\nNews Roundup\n\nFreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X\n\n\nFor those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.\n\nIt was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.\n\nWhile the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1.\n\nFreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.\n\n\n\n\nBSDCan 2020 CFP\n\n\nBSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).\n\nNOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.\n\nWe are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.\n\n\n\nSee http://www.bsdcan.org/2020/\n\n\n\nIf you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:\n\n\n\nHow we manage a giant installation with respect to handling spam.\nand/or sysadmin.\nand/or networking.\nCool new stuff in BSD\nTell us about your project which runs on BSD\nother topics (see next paragraph)\n\n\n\nFrom the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.\n\nBoth users and developers are encouraged to share their experiences.\n\n\n\n\nHardenedBSD Infrastructure Goals\n\n\n2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.\n\nThe last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.\n\nMy available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them.\n\nMy primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.\n\nAs I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.\n\nTransparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.\n\nIntegrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.\n\nI hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.\n\nSo, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.\n\n\n\n\nBeastie Bits\n\n\nFuryBSD - KDE plasma flavor now available\nDragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud\nLPI is looking for BSD Specialist learning material writers\nZFS sync/async + ZIL/SLOG, explained\nBSD-Licensed Combinatorics library/utility\nSSL client vs server certificates and bacula-fd\nMaxxDesktop planning to come to FreeBSD  Project Page\n\n\n\n\nFeedback/Questions\n\n\nTom - ZFS Mirror with different speeds\nJeff - Knowledge is power\nJohnny - Episode 324 response to Jacob\nPat - NYC*BUG meeting Jan Meeting Location\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05\" rel=\"nofollow\">Why computers suck and how learning from OpenBSD can make them marginally less horrible</a></h3>\n\n<blockquote>\n<p>How much better could things actually be if we abandoned the enterprise development model? </p>\n\n<p>Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.</p>\n\n<p>One of the most commonly referred to pillars of the project&#39;s philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. </p>\n\n<p>To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://neilkakkar.com/unix.html\" rel=\"nofollow\">How Unix Works: Become a Better Software Engineer</a></h3>\n\n<blockquote>\n<p>Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.</p>\n\n<p>Every fancy thing you want done is one google search away.</p>\n\n<p>But understanding why the solution does what you want is not the same.</p>\n\n<p>That’s what gives you real power, the power to not be afraid.</p>\n\n<p>And since it rhymes, it must be true.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&item=freebsd-amd-3970x&num=1\" rel=\"nofollow\">FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X</a></h3>\n\n<blockquote>\n<p>For those of you interested in AMD&#39;s new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.</p>\n\n<p>It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.</p>\n\n<p>While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn&#39;t tested for this Threadripper 3970X comparison but just FreeBSD 12.1.</p>\n\n<p>FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week&#39;s Windows 10 vs. Linux benchmarks with the same system.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html\" rel=\"nofollow\">BSDCan 2020 CFP</a></h3>\n\n<blockquote>\n<p>BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).</p>\n\n<p>NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.</p>\n\n<p>We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>\n</blockquote>\n\n<ul>\n<li>See <a href=\"http://www.bsdcan.org/2020/\" rel=\"nofollow\">http://www.bsdcan.org/2020/</a></li>\n</ul>\n\n<blockquote>\n<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:</p>\n</blockquote>\n\n<ul>\n<li>How we manage a giant installation with respect to handling spam.</li>\n<li>and/or sysadmin.</li>\n<li>and/or networking.</li>\n<li>Cool new stuff in BSD</li>\n<li>Tell us about your project which runs on BSD</li>\n<li>other topics (see next paragraph)</li>\n</ul>\n\n<blockquote>\n<p>From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.</p>\n\n<p>Both users and developers are encouraged to share their experiences.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md\" rel=\"nofollow\">HardenedBSD Infrastructure Goals</a></h3>\n\n<blockquote>\n<p>2019 has been an extremely productive year with regards to HardenedBSD&#39;s infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.</p>\n\n<p>The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.</p>\n\n<p>My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I&#39;m structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I&#39;ll review the code, and deploy it after a successful review. Users/contributors don&#39;t need access to our servers in order to improve them.</p>\n\n<p>My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.</p>\n\n<p>As I develop this infrastructure, I&#39;m doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.</p>\n\n<p>Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.</p>\n\n<p>Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.</p>\n\n<p>I hope to migrate HardenedBSD&#39;s site away from Drupal to a static site generator. We don&#39;t really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.</p>\n\n<p>So, that&#39;s about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I&#39;m excited to see how the project grows.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.furybsd.org/kde-plasma-flavor-now-available/\" rel=\"nofollow\">FuryBSD - KDE plasma flavor now available</a></li>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html\" rel=\"nofollow\">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>\n<li><a href=\"https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0\" rel=\"nofollow\">LPI is looking for BSD Specialist learning material writers</a></li>\n<li><a href=\"https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/\" rel=\"nofollow\">ZFS sync/async + ZIL/SLOG, explained</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html\" rel=\"nofollow\">BSD-Licensed Combinatorics library/utility</a></li>\n<li><a href=\"https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/\" rel=\"nofollow\">SSL client vs server certificates and bacula-fd</a></li>\n<li><a href=\"https://www.facebook.com/maxxdesktop/posts/2761326693888282\" rel=\"nofollow\">MaxxDesktop planning to come to FreeBSD</a>  <a href=\"https://www.facebook.com/maxxdesktop/\" rel=\"nofollow\">Project Page</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Tom - <a href=\"http://dpaste.com/3ZGYNS3#wrap\" rel=\"nofollow\">ZFS Mirror with different speeds</a></li>\n<li>Jeff - <a href=\"http://dpaste.com/1H9QDCR#wrap\" rel=\"nofollow\">Knowledge is power</a></li>\n<li>Johnny - <a href=\"http://dpaste.com/1A7Q9EV\" rel=\"nofollow\">Episode 324 response to Jacob</a></li>\n<li>Pat - <a href=\"http://dpaste.com/0QPZ2GC\" rel=\"nofollow\">NYC*BUG meeting Jan Meeting Location</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0331.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.","date_published":"2020-01-02T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/aa8d58dd-a2a5-4c8a-9244-755d523fe855.mp3","mime_type":"audio/mp3","size_in_bytes":50254703,"duration_in_seconds":4187}]},{"id":"af84425c-c562-4d3b-b28c-cce7a148a3ad","title":"330: Happy Holidays, All(an)","url":"https://www.bsdnow.tv/330","content_text":"Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.\n\nHeadlines\n\nAuthentication vulnerabilities in OpenBSD\n\n\nWe discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.\nFrom the manual page of login.conf:\n\n\n\nOpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:\n         passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).\n         skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).\n         yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).\n         For any given style, the program /usr/libexec/auth/login_style is used to\n         perform the authentication.  The synopsis of this program is:\n         /usr/libexec/auth/login_style [-v name=value] [-s service] username class\n\n\n\nThis is the first piece of the puzzle: if an attacker specifies a username of the form \"-option\", they can influence the behavior of the authentication program in unexpected ways.\n\n\n\n login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).\n\n\n\n\nThis is the second piece of the puzzle: if an attacker specifies the username \"-schallenge\" (or \"-schallenge:passwd\" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.\nCase study: smtpd\nCase study: ldapd\nCase study: radiusd\nCase study: sshd\nAcknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.\n\n\n\n\nFirst release candidate for NetBSD 9.0 available!\n\n\nSince the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!\nThis includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.\nWe hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).\nHere are a few highlights of the new release:\n\n\nSupport for Arm AArch64 (64-bit Armv8-A) machines, including \"Arm ServerReady\"\ncompliant machines (SBBR+SBSA)\nEnhanced hardware support for Armv7-A\nUpdated GPU drivers (e.g. support for Intel Kabylake)\nEnhanced virtualization support\nSupport for hardware-accelerated virtualization (NVMM)\nSupport for Performance Monitoring Counters\nSupport for Kernel ASLR\nSupport several kernel sanitizers (KLEAK, KASAN, KUBSAN)\nSupport for userland sanitizers\nAudit of the network stack\nMany improvements in NPF\nUpdated ZFS\nReworked error handling and NCQ support in the SATA subsystem\nSupport a common framework for USB Ethernet drivers (usbnet)\n\nMore information on the RC can be found on the NetBSD 9 release page\n\n\n\n\nNews Roundup\n\nRunning FreeNAS on a Digitalocean droplet\n\n\nZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead.\nI've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :)\nBefore we begin, here's the gist of what we're going to do:\n\n\n\nBase of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device. \n\n\n\nPart 1: re-image our boot block device to boot FreeNAS install media.\nPart 2: Install FreeNAS on the second block-device\nPart 3: Re-image the boot block device using the FreeNAS-installed block device\n\n\n\n\nNomadBSD 1.3 is now available\n\n\nFrom the release notes:\n\n\n\nThe base system has been changed to FreeBSD 12.1-RELEASE-p1\n Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse\n The GPT layout has been changed to MBR. This prevents problems with Lenovo\n systems that refuse to boot from GPT if \"lenovofix\" is not set, and systems that\n hang on boot if \"lenovofix\" is set.\n Support for ZFS installations has been added to the NomadBSD installer.\n The rc-script for setting up the network interfaces has been fixed and improved.\n Support for setting the country code for the wlan device has been added.\n Auto configuration for running in VirtualBox has been added.\n A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.\n NVIDIA driver version 440 has been added.\n nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the\ndefault user and autologin has been added.\n nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.\n Martin Orszulik added Czech translations to the setup and installation wizard.\n The NomadBSD logo, designed by Ian Grindley, has been changed.\n Support for localized error messages has been added.\n Support for localizing the password prompts has been added.\n Some templates for starting other DEs have been added to ~/.xinitrc.\n The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.\n A script that helps users to configure a multihead systems has been added.\n The Xorg driver for newer Intel GPUs has been changed from \"intel\" to \"modesetting\".\n /proc has been added to /etc/fstab\n A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.\n DSBBg which allows users to change and manage wallpapers has been added.\n The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.\n\nSupport for multiple keyboard layouts has been added.\n www/palemoon has been removed.\n mail/thunderbird has been removed.\n audio/audacity has been added.\n deskutils/orage has been added.\n the password manager fpm2 has been replaced by KeePassXC\n mail/sylpheed has been replaced by mail/claws-mail\n multimedia/simplescreenrecorder has been added.\n DSBMC has been changed to DSBMC-Qt\n Many small improvements and bug fixes.\n\n\n\n\nAt e2k19 nobody can hear you scream\n\n\nAfter 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.\nI did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.\nLucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.\nOur next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).\nI did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.\nIn case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!\nThanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.\n\n\n\n\nBeastie Bits\n\n\nFOSDEM 2020 BSD Devroom schedule\nEasy Minecraft Server on FreeBSD Howto\nstats(3) framework in the TCP stack\n4017 days of uptime\nsysget - A front-end for every package manager\nPlayOnBSD’s Cross-BSD Shopping Guide\n\n\n\n\nFeedback/Questions\n\n\nPat asks about the proper disk drive type for ZFS\nBrad asks about a ZFS rosetta stone\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\nSpecial Guest: Mariusz Zaborski.","content_html":"<p>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openwall.com/lists/oss-security/2019/12/04/5\" rel=\"nofollow\">Authentication vulnerabilities in OpenBSD</a></h3>\n\n<ul>\n<li>We discovered an authentication-bypass vulnerability in OpenBSD&#39;s authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.</li>\n<li>From the manual page of login.conf:</li>\n</ul>\n\n<blockquote>\n<p>OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:<br>\n         passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).<br>\n         skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).<br>\n         yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).<br>\n         For any given style, the program /usr/libexec/auth/login_style is used to<br>\n         perform the authentication.  The synopsis of this program is:<br>\n         /usr/libexec/auth/login_style [-v name=value] [-s service] username class</p>\n</blockquote>\n\n<ul>\n<li>This is the first piece of the puzzle: if an attacker specifies a username of the form &quot;-option&quot;, they can influence the behavior of the authentication program in unexpected ways.</li>\n</ul>\n\n<blockquote>\n<pre><code> login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).\n</code></pre>\n</blockquote>\n\n<ul>\n<li>This is the second piece of the puzzle: if an attacker specifies the username &quot;-schallenge&quot; (or &quot;-schallenge:passwd&quot; to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.</li>\n<li>Case study: smtpd</li>\n<li>Case study: ldapd</li>\n<li>Case study: radiusd</li>\n<li>Case study: sshd</li>\n<li>Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE&#39;s CVE Assignment Team.</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd\" rel=\"nofollow\">First release candidate for NetBSD 9.0 available!</a></h3>\n\n<ul>\n<li>Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!</li>\n<li>This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.</li>\n<li>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</li>\n<li><p>Here are a few highlights of the new release:</p>\n\n<blockquote>\n<p>Support for Arm AArch64 (64-bit Armv8-A) machines, including &quot;Arm ServerReady&quot;<br>\ncompliant machines (SBBR+SBSA)<br>\nEnhanced hardware support for Armv7-A<br>\nUpdated GPU drivers (e.g. support for Intel Kabylake)<br>\nEnhanced virtualization support<br>\nSupport for hardware-accelerated virtualization (NVMM)<br>\nSupport for Performance Monitoring Counters<br>\nSupport for Kernel ASLR<br>\nSupport several kernel sanitizers (KLEAK, KASAN, KUBSAN)<br>\nSupport for userland sanitizers<br>\nAudit of the network stack<br>\nMany improvements in NPF<br>\nUpdated ZFS<br>\nReworked error handling and NCQ support in the SATA subsystem<br>\nSupport a common framework for USB Ethernet drivers (usbnet)</p>\n</blockquote></li>\n<li><p>More information on the RC can be found on the <a href=\"https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html\" rel=\"nofollow\">NetBSD 9 release page</a></p></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet\" rel=\"nofollow\">Running FreeNAS on a Digitalocean droplet</a></h3>\n\n<ul>\n<li>ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you&#39;re here, reading this, you probably know all that already and we can skip ahead.</li>\n<li>I&#39;ve needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I&#39;m trying to do. Since I&#39;m using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can&#39;t. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn&#39;t a supported feature, at least not in the traditional way :)</li>\n<li>Before we begin, here&#39;s the gist of what we&#39;re going to do:</li>\n</ul>\n\n<blockquote>\n<p>Base of a FreeBSD droplet, we&#39;ll re-image our boot block device with FreeNAS iso. We&#39;ll then install FreeNAS on the second block device. Once done we&#39;re going to do the ol&#39; switcheroo: we&#39;re going to re-image our original boot block device using the now FreeNAS-installed second block device. </p>\n</blockquote>\n\n<ul>\n<li>Part 1: re-image our boot block device to boot FreeNAS install media.</li>\n<li>Part 2: Install FreeNAS on the second block-device</li>\n<li>Part 3: Re-image the boot block device using the FreeNAS-installed block device</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://nomadbsd.org/\" rel=\"nofollow\">NomadBSD 1.3 is now available</a></h3>\n\n<ul>\n<li>From the release notes:</li>\n</ul>\n\n<blockquote>\n<p>The base system has been changed to FreeBSD 12.1-RELEASE-p1<br>\n Due to a deadlock problem, FreeBSD&#39;s unionfs has been replaced by unionfs-fuse<br>\n The GPT layout has been changed to MBR. This prevents problems with Lenovo<br>\n systems that refuse to boot from GPT if &quot;lenovofix&quot; is not set, and systems that<br>\n hang on boot if &quot;lenovofix&quot; is set.<br>\n Support for ZFS installations has been added to the NomadBSD installer.<br>\n The rc-script for setting up the network interfaces has been fixed and improved.<br>\n Support for setting the country code for the wlan device has been added.<br>\n Auto configuration for running in VirtualBox has been added.<br>\n A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.<br>\n NVIDIA driver version 440 has been added.<br>\n nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the<br>\ndefault user and autologin has been added.<br>\n nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.<br>\n Martin Orszulik added Czech translations to the setup and installation wizard.<br>\n The NomadBSD logo, designed by Ian Grindley, has been changed.<br>\n Support for localized error messages has been added.<br>\n Support for localizing the password prompts has been added.<br>\n Some templates for starting other DEs have been added to ~/.xinitrc.<br>\n The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.<br>\n A script that helps users to configure a multihead systems has been added.<br>\n The Xorg driver for newer Intel GPUs has been changed from &quot;intel&quot; to &quot;modesetting&quot;.<br>\n /proc has been added to /etc/fstab<br>\n A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.<br>\n DSBBg which allows users to change and manage wallpapers has been added.<br>\n The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.</p>\n\n<p>Support for multiple keyboard layouts has been added.<br>\n www/palemoon has been removed.<br>\n mail/thunderbird has been removed.<br>\n audio/audacity has been added.<br>\n deskutils/orage has been added.<br>\n the password manager fpm2 has been replaced by KeePassXC<br>\n mail/sylpheed has been replaced by mail/claws-mail<br>\n multimedia/simplescreenrecorder has been added.<br>\n DSBMC has been changed to DSBMC-Qt<br>\n Many small improvements and bug fixes.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20191204170908\" rel=\"nofollow\">At e2k19 nobody can hear you scream</a></h3>\n\n<ul>\n<li>After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.</li>\n<li>I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.</li>\n<li>Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.</li>\n<li>Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).</li>\n<li>I did not plan to spend most of my week hacking on rpki-client but in the end I&#39;m happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.</li>\n<li>In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!</li>\n<li>Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.</li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://fosdem.org/2020/schedule/track/bsd/\" rel=\"nofollow\">FOSDEM 2020 BSD Devroom schedule</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/\" rel=\"nofollow\">Easy Minecraft Server on FreeBSD Howto</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=355304\" rel=\"nofollow\">stats(3) framework in the TCP stack</a></li>\n<li><a href=\"https://twitter.com/EdwinKremer/status/1203071684535889921\" rel=\"nofollow\">4017 days of uptime</a></li>\n<li><a href=\"https://github.com/emilengler/sysget\" rel=\"nofollow\">sysget - A front-end for every package manager</a></li>\n<li><a href=\"https://www.playonbsd.com/shopping_guide/\" rel=\"nofollow\">PlayOnBSD’s Cross-BSD Shopping Guide</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li><a href=\"http://dpaste.com/2FDN26X#wrap\" rel=\"nofollow\">Pat asks about the proper disk drive type for ZFS</a></li>\n<li><a href=\"http://dpaste.com/2X8PBMC#wrap\" rel=\"nofollow\">Brad asks about a ZFS rosetta stone</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0330.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video><p>Special Guest: Mariusz Zaborski.</p>","summary":"Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.","date_published":"2019-12-26T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/af84425c-c562-4d3b-b28c-cce7a148a3ad.mp3","mime_type":"audio/mp3","size_in_bytes":54074955,"duration_in_seconds":4506}]},{"id":"ca9f1431-2af7-48ad-98d6-e68c253ec75b","title":"329: Lucas’ Arts","url":"https://www.bsdnow.tv/329","content_text":"In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.\n\nInterview - Michael Lucas\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n  \n  Your browser does not support the HTML5 video tag.\nSpecial Guest: Michael W Lucas.","content_html":"<p>In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.</p>\n\n<h3>Interview - Michael Lucas</h3>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n  <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0329.mp4\">\n  Your browser does not support the HTML5 video tag.\n</video><p>Special Guest: Michael W Lucas.</p>","summary":"In this episode, we interview Michael W. Lucas about his latest book projects, including the upcoming SNMP Mastery book.","date_published":"2019-12-19T08:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca9f1431-2af7-48ad-98d6-e68c253ec75b.mp3","mime_type":"audio/mp3","size_in_bytes":36780535,"duration_in_seconds":3065}]},{"id":"be8ded86-58b0-46af-ba11-af5a748bc3d8","title":"328: EPYC Netflix Stack","url":"https://www.bsdnow.tv/328","content_text":"LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.\n\nHeadlines\n\nLLDB Threading support now ready for mainline\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.\n\nSo far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.\n\n\n\n\nMultiple IPSec VPN tunnels with FreeBSD\n\n\nThe FreeBSD handbook describes an IPSec VPN tunnel between 2 FreeBSD hosts (see https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html)\n\n\nBut it is also possible to have multiple, 2 or more, IPSec VPN tunnels created and running on a FreeBSD host. How to implement and configure this is described below.\n\n\nThe requirements is to have 3 locations (A, B and C) connected with IPSec VPN tunnels using FreeBSD (11.3-RELEASE).\n\nEach location has 1 IPSec VPN host running FreeBSD (VPN host A, B and C).\n\nVPN host A has 2 IPSec VPN tunnels: 1 to location B (VPN host B) and 1 to location C (VPN host C).\n\n\n\n\nNews Roundup\n\nNetflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance\n\n\nDrew Gallatin of Netflix presented at the recent EuroBSDcon 2019 conference in Norway on the company's network stack optimizations to FreeBSD. Netflix was working on being able to deliver 200Gb/s network performance for video streaming out of Intel Xeon and AMD EPYC servers, to which they are now at 190Gb/s+ and in the process that doubled the potential of EPYC Naples/Rome servers and also very hefty upgrades too for Intel.\n\nNetflix has long been known to be using FreeBSD in their data centers particularly where network performance is concerned. But in wanting to deliver 200Gb/s throughput from individual servers led them to making NUMA optimizations to the FreeBSD network stack. Allocating NUMA local memory for kernel TLS crypto buffers and for backing files sent via sentfile were among their optimizations. Changes to network connection handling and dealing with incoming connections to Nginx were also made.\n\nFor those just wanting the end result, Netflix's NUMA optimizations to FreeBSD resulted in their Intel Xeon servers going from 105Gb/s to 191Gb/s while the NUMA fabric utilization dropped from 40% to 13%.\n\n\n\n\nunwind(8); \"happy eyeballs\"\n\n\nIn case you are wondering why happy eyeballs: It's a variation on this:\nhttps://en.wikipedia.org/wiki/Happy_Eyeballs\n\nunwind has a concept of a best nameserver type. It considers a configured DoT nameserver to be better than doing it's own recursive resolving. Recursive resolving is considered to be better than asking the dhcp provided nameservers.\n\nThis diff sorts the nameserver types by quality, as above (validation, resolving, dead...), and as a tie breaker it adds the median of the round trip time of previous queries into the mix. \n\nOne other interesting thing about this is that it gets us past captive portals without a check URL, that's why this diff is so huge, it rips out all the captive portal stuff (please apply with patch -E):\n 17 files changed, 385 insertions(+), 1683 deletions(-)\n\nPlease test this. I'm particularly interested in reports from people who move between networks and need to get past captive portals.\n\n\n\n\nAmazon now has FreeBSD ARM 12\n\n\nProduct Overview\n\nFreeBSD is an operating system used to power servers, desktops, and embedded systems. Derived from BSD, the version of UNIX developed at the University of California, Berkeley, FreeBSD has been continually developed by a large community for more than 30 years.\n\nFreeBSD's networking, security, storage, and monitoring features, including the pf firewall, the Capsicum and CloudABI capability frameworks, the ZFS filesystem, and the DTrace dynamic tracing framework, make FreeBSD the platform of choice for many of the busiest web sites and most pervasive embedded networking and storage systems.\n\n\n\n\nOpenSSH U2F/FIDO support in base\n\n\nI just committed all the dependencies for OpenSSH security key (U2F) support to base and tweaked OpenSSH to use them directly. This means there will be no additional configuration hoops to jump through to use U2F/FIDO2 security keys.\n\nHardware backed keys can be generated using \"ssh-keygen -t ecdsa-sk\" (or \"ed25519-sk\" if your token supports it). Many tokens require to be touched/tapped to confirm this step.\n\nYou'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a \"key handle\" that is used by the security key to derive the real private key at signing time.\n\nSo, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything. \n\nOnce you have generated a key, you can use it normally - i.e. add it to an agent, copy it to your destination's authorized_keys files (assuming they are running -current too), etc. At authentication time, you will be prompted to tap your security key to confirm the signature operation - this makes theft-of-access attacks against security keys more difficult too.\n\nPlease test this thoroughly - it's a big change that we want to have stable before the next release.\n\n\n\n\nBeastie Bits\n\n\nDragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud\nReally fast Markov chains in ~20 lines of sh, grep, cut and awk\nFreeBSD Journal Sept/Oct 2019\nMichael Dexter is raising money for Bhyve development\nsyscall call-from verification\nFreeBSD Forums Howto Section\n\n\n\n\nFeedback/Questions\n\n\nJeroen - Feedback\nSavo - pfsense ports\nTin - I want to learn C\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready\" rel=\"nofollow\">LLDB Threading support now ready for mainline</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>\n\n<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>\n\n<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.socruel.nu/text-only/how-to-multiple-ipsec-vpn-tunnels-on-freebsd.txt\" rel=\"nofollow\">Multiple IPSec VPN tunnels with FreeBSD</a></h3>\n\n<blockquote>\n<p>The FreeBSD handbook describes an IPSec VPN tunnel between 2 FreeBSD hosts (see <a href=\"https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html\" rel=\"nofollow\">https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html</a>)</p>\n</blockquote>\n\n<p>But it is also possible to have multiple, 2 or more, IPSec VPN tunnels created and running on a FreeBSD host. How to implement and configure this is described below.</p>\n\n<blockquote>\n<p>The requirements is to have 3 locations (A, B and C) connected with IPSec VPN tunnels using FreeBSD (11.3-RELEASE).</p>\n\n<p>Each location has 1 IPSec VPN host running FreeBSD (VPN host A, B and C).</p>\n\n<p>VPN host A has 2 IPSec VPN tunnels: 1 to location B (VPN host B) and 1 to location C (VPN host C).</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=Netflix-NUMA-FreeBSD-Optimized\" rel=\"nofollow\">Netflix Optimized FreeBSD&#39;s Network Stack More Than Doubled AMD EPYC Performance</a></h3>\n\n<blockquote>\n<p>Drew Gallatin of Netflix presented at the recent EuroBSDcon 2019 conference in Norway on the company&#39;s network stack optimizations to FreeBSD. Netflix was working on being able to deliver 200Gb/s network performance for video streaming out of Intel Xeon and AMD EPYC servers, to which they are now at 190Gb/s+ and in the process that doubled the potential of EPYC Naples/Rome servers and also very hefty upgrades too for Intel.</p>\n\n<p>Netflix has long been known to be using FreeBSD in their data centers particularly where network performance is concerned. But in wanting to deliver 200Gb/s throughput from individual servers led them to making NUMA optimizations to the FreeBSD network stack. Allocating NUMA local memory for kernel TLS crypto buffers and for backing files sent via sentfile were among their optimizations. Changes to network connection handling and dealing with incoming connections to Nginx were also made.</p>\n\n<p>For those just wanting the end result, Netflix&#39;s NUMA optimizations to FreeBSD resulted in their Intel Xeon servers going from 105Gb/s to 191Gb/s while the NUMA fabric utilization dropped from 40% to 13%.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://marc.info/?l=openbsd-tech&m=157475113130337&w=2\" rel=\"nofollow\">unwind(8); &quot;happy eyeballs&quot;</a></h3>\n\n<blockquote>\n<p>In case you are wondering why happy eyeballs: It&#39;s a variation on this:<br>\n<a href=\"https://en.wikipedia.org/wiki/Happy_Eyeballs\" rel=\"nofollow\">https://en.wikipedia.org/wiki/Happy_Eyeballs</a></p>\n\n<p>unwind has a concept of a best nameserver type. It considers a configured DoT nameserver to be better than doing it&#39;s own recursive resolving. Recursive resolving is considered to be better than asking the dhcp provided nameservers.</p>\n\n<p>This diff sorts the nameserver types by quality, as above (validation, resolving, dead...), and as a tie breaker it adds the median of the round trip time of previous queries into the mix. </p>\n\n<p>One other interesting thing about this is that it gets us past captive portals without a check URL, that&#39;s why this diff is so huge, it rips out all the captive portal stuff (please apply with patch -E):<br>\n 17 files changed, 385 insertions(+), 1683 deletions(-)</p>\n\n<p>Please test this. I&#39;m particularly interested in reports from people who move between networks and need to get past captive portals.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://aws.amazon.com/marketplace/pp/B081NF7BY7\" rel=\"nofollow\">Amazon now has FreeBSD ARM 12</a></h3>\n\n<blockquote>\n<p>Product Overview</p>\n\n<p>FreeBSD is an operating system used to power servers, desktops, and embedded systems. Derived from BSD, the version of UNIX developed at the University of California, Berkeley, FreeBSD has been continually developed by a large community for more than 30 years.</p>\n\n<p>FreeBSD&#39;s networking, security, storage, and monitoring features, including the pf firewall, the Capsicum and CloudABI capability frameworks, the ZFS filesystem, and the DTrace dynamic tracing framework, make FreeBSD the platform of choice for many of the busiest web sites and most pervasive embedded networking and storage systems.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.undeadly.org/cgi?action=article;sid=20191115064850\" rel=\"nofollow\">OpenSSH U2F/FIDO support in base</a></h3>\n\n<blockquote>\n<p>I just committed all the dependencies for OpenSSH security key (U2F) support to base and tweaked OpenSSH to use them directly. This means there will be no additional configuration hoops to jump through to use U2F/FIDO2 security keys.</p>\n\n<p>Hardware backed keys can be generated using &quot;ssh-keygen -t ecdsa-sk&quot; (or &quot;ed25519-sk&quot; if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p>\n\n<p>You&#39;ll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a &quot;key handle&quot; that is used by the security key to derive the real private key at signing time.</p>\n\n<p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything. </p>\n\n<p>Once you have generated a key, you can use it normally - i.e. add it to an agent, copy it to your destination&#39;s authorized_keys files (assuming they are running -current too), etc. At authentication time, you will be prompted to tap your security key to confirm the signature operation - this makes theft-of-access attacks against security keys more difficult too.</p>\n\n<p>Please test this thoroughly - it&#39;s a big change that we want to have stable before the next release.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html\" rel=\"nofollow\">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li>\n<li><a href=\"https://0x0f0f0f.github.io/posts/2019/11/really-fast-markov-chains-in-%7E20-lines-of-sh-grep-cut-and-awk/\" rel=\"nofollow\">Really fast Markov chains in ~20 lines of sh, grep, cut and awk</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/past-issues/security-3/\" rel=\"nofollow\">FreeBSD Journal Sept/Oct 2019</a></li>\n<li><a href=\"https://twitter.com/michaeldexter/status/1201231729228308480\" rel=\"nofollow\">Michael Dexter is raising money for Bhyve development</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-tech&m=157488907117170\" rel=\"nofollow\">syscall call-from verification</a></li>\n<li><a href=\"https://forums.freebsd.org/forums/howtos-and-faqs-moderated.39/\" rel=\"nofollow\">FreeBSD Forums Howto Section</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Jeroen - <a href=\"http://dpaste.com/0PK1EG2#wrap\" rel=\"nofollow\">Feedback</a></li>\n<li>Savo - <a href=\"http://dpaste.com/0PZ03B7#wrap\" rel=\"nofollow\">pfsense ports</a></li>\n<li>Tin - <a href=\"http://dpaste.com/2GVNCYB#wrap\" rel=\"nofollow\">I want to learn C</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0328.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"LLDB Threading support now ready, Multiple IPSec VPN tunnels with FreeBSD, Netflix Optimized FreeBSD's Network Stack More Than Doubled AMD EPYC Performance, happy eyeballs with unwind(8), AWS got FreeBSD ARM 12, OpenSSH U2F/FIDO support, and more.","date_published":"2019-12-12T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/be8ded86-58b0-46af-ba11-af5a748bc3d8.mp3","mime_type":"audio/mp3","size_in_bytes":41556868,"duration_in_seconds":3463}]},{"id":"18bee756-2b2e-45ed-bcf1-403549bf6a32","title":"327: ZFS Rename Repo","url":"https://www.bsdnow.tv/327","content_text":"We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.\n\nHeadlines\n\nFreeBSD third quarterly status report for 2019\n\n\nThis quarter the reports team has been more active than usual thanks to a better organization: calls for reports and reminders have been sent regularly, reports have been reviewed and merged quickly (I would like to thank debdrup@ in particular for his reviewing work).\n\nEfficiency could still be improved with the help of our community. In particular, the quarterly team has found that many reports have arrived in the last days before the deadline or even after. I would like to invite the community to follow the guidelines below that can help us sending out the reports sooner.\n\nStarting from next quarter, all quarterly status reports will be prepared the last month of the quarter itself, instead of the first month after the quarter's end. This means that deadlines for submitting reports will be the 1st of January, April, July and October.\n\nNext quarter will then be a short one, covering the months of November and December only and the report will probably be out in mid January.\n\n\n\n\nOpenBSD on Sparc64\n\n\nOpenBSD, huh? Yes, I usually write about FreeBSD and that’s in fact what I tried installing on the machine first. But I ran into problems with it very early on (never even reached single user mode) and put it aside for later. Since I powered up the SunFire again last month, I needed an OS now and chose OpenBSD for the simple reason that I have it available.\n\nFirst I wanted to call this article simply “OpenBSD on SPARC” – but that would have been misleading since OpenBSD used to support 32-bit SPARC processors, too. The platform was just put to rest after the 5.9 release.\n\nVersion 6.0 was the last release of OpenBSD that came on CD-ROM. When I bought it, I thought that I’d never use the SPARC CD. But here was the chance! While it is an obsolete release, it comes with the cryptographic signatures to verify the next release. So the plan is to start at 6.0 as I can trust the original CDs and then update to the latest release. This will also be an opportunity to recap on some of the things that changed over the various versions.\n\n\n\n\nNews Roundup\n\nZoL repo move to OpenZFS\n\n\nBecause it will contain the ZFS source code for both Linux and FreeBSD, we will rename the \"ZFSonLinux\" code repository to \"OpenZFS\".  Specifically, the repo at http://github.com/ZFSonLinux/zfs will be moved to the OpenZFS organization, at http://github.com/OpenZFS/zfs.\n\nThe next major release of ZFS for Linux and FreeBSD will be \"OpenZFS 2.0\", and is expected to ship in 2020.\n\n\n\n\nMcclure111 Sun Thread\n\n\nA long time ago— like 15 years ago— I worked at Sun Microsystems. The company was nearly dead at the time (it died a couple years later) because they didn't make anything that anyone wanted to buy anymore. So they had a lot of strange ideas about how they'd make their comeback.\n\n\n\n\nGEOM NOP\n\n\nSometimes while testing file systems or applications you want to simulate some errors on the disk level. The first time I heard about this need was from Baptiste Daroussin during his presentation at AsiaBSDCon 2016. He mentioned how they had built a test lab with it. The same need was recently discussed during the PGCon 2019, to test a PostgreSQL instance. If you are FreeBSD user, I have great news for you: there is a GEOM provider which allows you to simulate a failing device.\n\nGNOP allows us to configure transparent providers from existing ones. The first interesting option of it is that we can slice the device into smaller pieces, thanks to the ‘offset option’ and ‘stripsesize’. This allows us to observe how the data on the disk is changing. Let’s assume that we want to observe the changes in the GPT table when the GPT flags are added or removed (for example the bootme flags which are described here). We can use dd every time and analyze it using absolute values from the disks.\n\n\n\n\nKeeping NetBSD up-to-date with pkg_comp 2.0\n\n\nThis is a tutorial to guide you through the shiny new pkg_comp 2.0 on NetBSD.\n\nGoals: to use pkg_comp 2.0 to build a binary repository of all the packages you are interested in; to keep the repository fresh on a daily basis; and to use that repository with pkgin to maintain your NetBSD system up-to-date and secure.\n\nThis tutorial is specifically targeted at NetBSD but should work on other platforms with some small changes. Expect, at the very least, a macOS-specific tutorial as soon as I create a pkg_comp standalone installer for that platform.\n\n\n\n\nBeastie Bits\n\n\nDragonFly - Radeon Improvements\nNomadBSD review\nSpongebob OpenBSD Security Comic\nForth : The Early Years\nLCM+L PDP-7 booting and running UNIX Version 0\n\n\n\n\nFeedback/Questions\n\n\nChris - Ctrl-T\n\n\nImproved Ctrl+t that shows kernel backtrace\n\nBrian - Migrating NexentaStore to FreeBSD/FreeNAS\nAvery - How to get involved\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2019-07-2019-09.html\" rel=\"nofollow\">FreeBSD third quarterly status report for 2019</a></h3>\n\n<blockquote>\n<p>This quarter the reports team has been more active than usual thanks to a better organization: calls for reports and reminders have been sent regularly, reports have been reviewed and merged quickly (I would like to thank debdrup@ in particular for his reviewing work).</p>\n\n<p>Efficiency could still be improved with the help of our community. In particular, the quarterly team has found that many reports have arrived in the last days before the deadline or even after. I would like to invite the community to follow the guidelines below that can help us sending out the reports sooner.</p>\n\n<p>Starting from next quarter, all quarterly status reports will be prepared the last month of the quarter itself, instead of the first month after the quarter&#39;s end. This means that deadlines for submitting reports will be the 1st of January, April, July and October.</p>\n\n<p>Next quarter will then be a short one, covering the months of November and December only and the report will probably be out in mid January.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2019/10/10/openbsd-on-sparc64-6-0-to-6-5/\" rel=\"nofollow\">OpenBSD on Sparc64</a></h3>\n\n<blockquote>\n<p>OpenBSD, huh? Yes, I usually write about FreeBSD and that’s in fact what I tried installing on the machine first. But I ran into problems with it very early on (never even reached single user mode) and put it aside for later. Since I powered up the SunFire again last month, I needed an OS now and chose OpenBSD for the simple reason that I have it available.</p>\n\n<p>First I wanted to call this article simply “OpenBSD on SPARC” – but that would have been misleading since OpenBSD used to support 32-bit SPARC processors, too. The platform was just put to rest after the 5.9 release.</p>\n\n<p>Version 6.0 was the last release of OpenBSD that came on CD-ROM. When I bought it, I thought that I’d never use the SPARC CD. But here was the chance! While it is an obsolete release, it comes with the cryptographic signatures to verify the next release. So the plan is to start at 6.0 as I can trust the original CDs and then update to the latest release. This will also be an opportunity to recap on some of the things that changed over the various versions.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://zfsonlinux.topicbox.com/groups/zfs-discuss/T13eedc32607dab41/zol-repo-move-to-openzfs\" rel=\"nofollow\">ZoL repo move to OpenZFS</a></h3>\n\n<blockquote>\n<p>Because it will contain the ZFS source code for both Linux and FreeBSD, we will rename the &quot;ZFSonLinux&quot; code repository to &quot;OpenZFS&quot;.  Specifically, the repo at <a href=\"http://github.com/ZFSonLinux/zfs\" rel=\"nofollow\">http://github.com/ZFSonLinux/zfs</a> will be moved to the OpenZFS organization, at <a href=\"http://github.com/OpenZFS/zfs\" rel=\"nofollow\">http://github.com/OpenZFS/zfs</a>.</p>\n\n<p>The next major release of ZFS for Linux and FreeBSD will be &quot;OpenZFS 2.0&quot;, and is expected to ship in 2020.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://twitter.com/mcclure111/status/1196557401710837762\" rel=\"nofollow\">Mcclure111 Sun Thread</a></h3>\n\n<blockquote>\n<p>A long time ago— like 15 years ago— I worked at Sun Microsystems. The company was nearly dead at the time (it died a couple years later) because they didn&#39;t make anything that anyone wanted to buy anymore. So they had a lot of strange ideas about how they&#39;d make their comeback.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://oshogbo.vexillium.org/blog/71/\" rel=\"nofollow\">GEOM NOP</a></h3>\n\n<blockquote>\n<p>Sometimes while testing file systems or applications you want to simulate some errors on the disk level. The first time I heard about this need was from Baptiste Daroussin during his presentation at AsiaBSDCon 2016. He mentioned how they had built a test lab with it. The same need was recently discussed during the PGCon 2019, to test a PostgreSQL instance. If you are FreeBSD user, I have great news for you: there is a GEOM provider which allows you to simulate a failing device.</p>\n\n<p>GNOP allows us to configure transparent providers from existing ones. The first interesting option of it is that we can slice the device into smaller pieces, thanks to the ‘offset option’ and ‘stripsesize’. This allows us to observe how the data on the disk is changing. Let’s assume that we want to observe the changes in the GPT table when the GPT flags are added or removed (for example the bootme flags which are described here). We can use dd every time and analyze it using absolute values from the disks.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://jmmv.dev/2017/02/pkg_comp-2.0-tutorial-netbsd.html\" rel=\"nofollow\">Keeping NetBSD up-to-date with pkg_comp 2.0</a></h3>\n\n<blockquote>\n<p>This is a tutorial to guide you through the shiny new pkg_comp 2.0 on NetBSD.</p>\n\n<p>Goals: to use pkg_comp 2.0 to build a binary repository of all the packages you are interested in; to keep the repository fresh on a daily basis; and to use that repository with pkgin to maintain your NetBSD system up-to-date and secure.</p>\n\n<p>This tutorial is specifically targeted at NetBSD but should work on other platforms with some small changes. Expect, at the very least, a macOS-specific tutorial as soon as I create a pkg_comp standalone installer for that platform.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-November/720070.html\" rel=\"nofollow\">DragonFly - Radeon Improvements</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=7DglP7SbnlA&feature=share\" rel=\"nofollow\">NomadBSD review</a></li>\n<li><a href=\"https://files.yukiisbo.red/openbsd_claim.png\" rel=\"nofollow\">Spongebob OpenBSD Security Comic</a></li>\n<li><a href=\"https://colorforth.github.io/HOPL.html\" rel=\"nofollow\">Forth : The Early Years</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=pvaPaWyiuLA\" rel=\"nofollow\">LCM+L PDP-7 booting and running UNIX Version 0</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Chris - <a href=\"http://dpaste.com/284E5BV\" rel=\"nofollow\">Ctrl-T</a>\n\n<ul>\n<li><a href=\"https://asciinema.org/a/xfSpvPT61Cnd9iRgbfIjT6kYj\" rel=\"nofollow\">Improved Ctrl+t that shows kernel backtrace</a></li>\n</ul></li>\n<li>Brian - <a href=\"http://dpaste.com/05GDK8H#wrap\" rel=\"nofollow\">Migrating NexentaStore to FreeBSD/FreeNAS</a></li>\n<li>Avery - <a href=\"http://dpaste.com/26KW801#wrap\" rel=\"nofollow\">How to get involved</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0327.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"We read FreeBSD’s third quarterly status report, OpenBSD on Sparc64, ZoL repo move to OpenZFS, GEOM NOP, keeping NetBSD up-to-date, and more.","date_published":"2019-12-05T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/18bee756-2b2e-45ed-bcf1-403549bf6a32.mp3","mime_type":"audio/mp3","size_in_bytes":60093881,"duration_in_seconds":5007}]},{"id":"4d6f5084-1255-44ce-a255-5f969e18e44d","title":"326: Certified BSD","url":"https://www.bsdnow.tv/326","content_text":"LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.\n\nHeadlines\n\nLinux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group\n\n\nLinux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.\n\nG. Matthew Rice, the Executive Director of Linux Professional Institute says that \"the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”\n\n\n\n\nOpenZFS Trip Report\n\n\nThe seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.\n\n\n\n\nNews Roundup\n\nUsing FreeBSD with Ports (2/2): Tool-assisted updating\n\n\nPart 1 here: https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/\n\n\n\nIn the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.\n\nIn this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.\n\n\n\n\nLLDB Threading support now ready for mainline\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.\n\nSo far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.\n\n\n\n\nLinux VS open source UNIX\n\n\n\nBeastie Bits\n\n\nSupport for Realtek RTL8125 2.5Gb Ethernet controller\nComputer Files Are Going Extinct\nFreeBSD kernel hacking\nModern BSD Computing for Fun on a VAX! Trying to use a VAX in today's world by Jeff Armstrong\nMidnightBSD 1.2 Released\n\n\n\n\nFeedback/Questions\n\n\nPaulo - Zfs snapshots\nPhillip - GCP\nA Listener - Old episodes?\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.lpi.org/articles/linux-professional-institute-releases-bsd-specialist-certification\" rel=\"nofollow\">Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group</a></h3>\n\n<blockquote>\n<p>Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.</p>\n\n<p>G. Matthew Rice, the Executive Director of Linux Professional Institute says that &quot;the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/openzfs-dev-summit-2019/\" rel=\"nofollow\">OpenZFS Trip Report</a></h3>\n\n<blockquote>\n<p>The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2019/09/12/using-freebsd-with-ports-2-2-tool-assisted-updating/\" rel=\"nofollow\">Using FreeBSD with Ports (2/2): Tool-assisted updating</a></h3>\n\n<ul>\n<li>Part 1 here: <a href=\"https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/\" rel=\"nofollow\">https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/</a></li>\n</ul>\n\n<blockquote>\n<p>In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.</p>\n\n<p>In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready\" rel=\"nofollow\">LLDB Threading support now ready for mainline</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p>\n\n<p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I&#39;ve started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p>\n\n<p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I&#39;ve finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/\" rel=\"nofollow\">Linux VS open source UNIX</a></h3>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://marc.info/?l=openbsd-tech&m=157380442230074&w=2\" rel=\"nofollow\">Support for Realtek RTL8125 2.5Gb Ethernet controller</a></li>\n<li><a href=\"https://onezero.medium.com/the-death-of-the-computer-file-doc-43cb028c0506\" rel=\"nofollow\">Computer Files Are Going Extinct</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=4FUub_UtF3c\" rel=\"nofollow\">FreeBSD kernel hacking</a></li>\n<li><a href=\"https://youtu.be/e7cJ7v2lYdE\" rel=\"nofollow\">Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today&#39;s world by Jeff Armstrong</a></li>\n<li><a href=\"https://www.justjournal.com/users/mbsd/entry/33779\" rel=\"nofollow\">MidnightBSD 1.2 Released</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Paulo - <a href=\"http://dpaste.com/0WQRP43#wrap\" rel=\"nofollow\">Zfs snapshots</a></li>\n<li>Phillip - <a href=\"http://dpaste.com/075ZQE1#wrap\" rel=\"nofollow\">GCP</a></li>\n<li>A Listener - <a href=\"http://dpaste.com/3YJ4119#wrap\" rel=\"nofollow\">Old episodes?</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0326.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.","date_published":"2019-11-28T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4d6f5084-1255-44ce-a255-5f969e18e44d.mp3","mime_type":"audio/mp3","size_in_bytes":43280010,"duration_in_seconds":3606}]},{"id":"a971b40e-d33a-44ac-9cf8-dfaf7e4aaff7","title":"325: Cracking Rainbows","url":"https://www.bsdnow.tv/325","content_text":"FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.\n\nHeadlines\n\nFreeBSD 12.1\n\n\nSome of the highlights:\n\n\nBearSSL has been imported to the base system.\nThe clang, llvm, lld, lldb, compiler-rt utilities and libc++ have been updated to version 8.0.1.\nOpenSSL has been updated to version 1.1.1d.\nSeveral userland utility updates.\n\nFor a complete list of new features and known problems, please see the online release notes and errata list, available at: https://www.FreeBSD.org/releases/12.1R/relnotes.html\n\n\n\n\nA History of UNIX before Berkeley: UNIX Evolution: 1975-1984.\n\n\nNobody needs to be told that UNIX is popular today. In this article we will show you a little of where it was yesterday and over the past decade. And, without meaning in the least to minimise the incredible contributions of Ken Thompson and Dennis Ritchie, we will bring to light many of the others who worked on early versions, and try to show where some of the key ideas came from, and how they got into the UNIX of today.\n\nOur title says we are talking about UNIX evolution. Evolution means different things to different people. We use the term loosely, to describe the change over time among the many different UNIX variants in use both inside and outside Bell Labs. Ideas, code, and useful programs seem to have made their way back and forth - like mutant genes - among all the many UNIXes living in the phone company over the decade in question.\n\nPart One looks at some of the major components of the current UNIX system - the text formatting tools, the compilers and program development tools, and so on. Most of the work described in Part One took place at Research'', a part of Bell Laboratories (now AT&amp;T Bell Laboratories, then as nowthe Labs''), and the ancestral home of UNIX. In planned (but not written) later parts, we would have looked at some of the myriad versions of UNIX - there are far more than one might suspect. This includes a look at Columbus and USG and at Berkeley Unix. You'll begin to get a glimpse inside the history of the major streams of development of the system during that time.\n\n\n\n\nNews Roundup\n\nMy FreeBSD Development Setup\n\n\nI do my FreeBSD development using git, tmux, vim and cscope.\n\nI keep a FreeBSD fork on my github, I have forked https://github.com/freebsd/freebsd to https://github.com/adventureloop/freebsd\n\n\n\n\nOPNsense 19.7.6 released\n\n\nAs we are experiencing the Suricata community first hand in Amsterdam we thought to release this version a bit earlier than planned. Included is the latest Suricata 5.0.0 release in the development version. That means later this November we will releasing version 5 to the production version as we finish up tweaking the integration and maybe pick up 5.0.1 as it becomes available.\n\nLDAP TLS connectivity is now integrated into the system trust store, which ensures that all required root and intermediate certificates will be seen by the connection setup when they have been added to the authorities section. The same is true for trusting self-signed certificates. On top of this, IPsec now supports public key authentication as contributed by Pascal Mathis.\n\n\n\n\nHardenedBSD November 2019 Status Report.\n\n\nWe at HardenedBSD have a lot of news to share. On 05 Nov 2019, Oliver Pinter resigned amicably from the project. All of us at HardenedBSD owe Oliver our gratitude and appreciation. This humble project, named by Oliver, was born out of his thesis work and the collaboration with Shawn Webb. Oliver created the HardenedBSD repo on GitHub in April 2013. The HardenedBSD Foundation was formed five years later to carry on this great work. \n\n\n\n\nDNSSEC enabled in default unbound(8) configuration.\n\n\nDNSSEC validation has been enabled in the default unbound.conf(5) in -current. The relevant commits were from Job Snijders (job@)\n\n\n\n\nHow to Install Shopware with NGINX and Let's Encrypt on FreeBSD 12\n\n\nShopware is the next generation of open source e-commerce software. Based on bleeding edge technologies like Symfony 3, Doctrine2 and Zend Framework Shopware comes as the perfect platform for your next e-commerce project. This tutorial will walk you through the Shopware Community Edition (CE) installation on FreeBSD 12 system by using NGINX as a web server.\n\n\n\nRequirements\n\n\n\nMake sure your system meets the following minimum requirements:\n\n\nLinux-based operating system with NGINX or Apache 2.x (with mod_rewrite) web server installed. \nPHP 5.6.4 or higher with ctype, gd, curl, dom, hash, iconv, zip, json, mbstring, openssl, session, simplexml, xml, zlib, fileinfo, and pdo/mysql extensions. PHP 7.1 or above is strongly recommended.\nMySQL 5.5.0 or higher.\nPossibility to set up cron jobs.\nMinimum 4 GB available hard disk space.\nIonCube Loader version 5.0.0 or higher (optional).\n\n\n\n\n\nHow to Compile RainbowCrack on OpenBSD\n\n\nProject RainbowCrack was originally Zhu Shuanglei's implementation, it's not clear to me if the project is still just his or if it's even been maintained for a while. His page seems to have been last updated in August 2007.\n\nThe Project RainbowCrack web page now has just binaries for Windows XP and Linux, both 32-bit and 64-bit versions.\n\nEarlier versions were available as source code. The version 1.2 source code does not compile on OpenBSD, and in my experience it doesn't compile on Linux, either. It seems to date from 2004 at the earliest, and I think it makes some version-2.4 assumptions about Linux kernel headers.\n\n\n\nYou might also look at ophcrack, a more modern tool, although it seems to be focused on cracking Windows XP/Vista/7/8/10 password hashes\n\n\n\n\nFeedback/Questions\n\n\nReese - Amature radio info\nChris - VPN\nMalcolm - NAT\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/12.1R/announce.html\" rel=\"nofollow\">FreeBSD 12.1</a></h3>\n\n<ul>\n<li><p>Some of the highlights:</p>\n\n<ul>\n<li>BearSSL has been imported to the base system.</li>\n<li>The clang, llvm, lld, lldb, compiler-rt utilities and libc++ have been updated to version 8.0.1.</li>\n<li>OpenSSL has been updated to version 1.1.1d.</li>\n<li>Several userland utility updates.</li>\n</ul></li>\n<li><p>For a complete list of new features and known problems, please see the online release notes and errata list, available at: <a href=\"https://www.FreeBSD.org/releases/12.1R/relnotes.html\" rel=\"nofollow\">https://www.FreeBSD.org/releases/12.1R/relnotes.html</a></p></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"http://www.darwinsys.com/history/hist.html\" rel=\"nofollow\">A History of UNIX before Berkeley: UNIX Evolution: 1975-1984.</a></h3>\n\n<blockquote>\n<p>Nobody needs to be told that UNIX is popular today. In this article we will show you a little of where it was yesterday and over the past decade. And, without meaning in the least to minimise the incredible contributions of Ken Thompson and Dennis Ritchie, we will bring to light many of the others who worked on early versions, and try to show where some of the key ideas came from, and how they got into the UNIX of today.</p>\n\n<p>Our title says we are talking about UNIX evolution. Evolution means different things to different people. We use the term loosely, to describe the change over time among the many different UNIX variants in use both inside and outside Bell Labs. Ideas, code, and useful programs seem to have made their way back and forth - like mutant genes - among all the many UNIXes living in the phone company over the decade in question.</p>\n\n<p>Part One looks at some of the major components of the current UNIX system - the text formatting tools, the compilers and program development tools, and so on. Most of the work described in Part One took place at <code>Research&#39;&#39;, a part of Bell Laboratories (now AT&amp;T Bell Laboratories, then as now</code>the Labs&#39;&#39;), and the ancestral home of UNIX. In planned (but not written) later parts, we would have looked at some of the myriad versions of UNIX - there are far more than one might suspect. This includes a look at Columbus and USG and at Berkeley Unix. You&#39;ll begin to get a glimpse inside the history of the major streams of development of the system during that time.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://adventurist.me/posts/00296\" rel=\"nofollow\">My FreeBSD Development Setup</a></h3>\n\n<blockquote>\n<p>I do my FreeBSD development using git, tmux, vim and cscope.</p>\n\n<p>I keep a FreeBSD fork on my github, I have forked <a href=\"https://github.com/freebsd/freebsd\" rel=\"nofollow\">https://github.com/freebsd/freebsd</a> to <a href=\"https://github.com/adventureloop/freebsd\" rel=\"nofollow\">https://github.com/adventureloop/freebsd</a></p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-19-7-6-released/\" rel=\"nofollow\">OPNsense 19.7.6 released</a></h3>\n\n<blockquote>\n<p>As we are experiencing the Suricata community first hand in Amsterdam we thought to release this version a bit earlier than planned. Included is the latest Suricata 5.0.0 release in the development version. That means later this November we will releasing version 5 to the production version as we finish up tweaking the integration and maybe pick up 5.0.1 as it becomes available.</p>\n\n<p>LDAP TLS connectivity is now integrated into the system trust store, which ensures that all required root and intermediate certificates will be seen by the connection setup when they have been added to the authorities section. The same is true for trusting self-signed certificates. On top of this, IPsec now supports public key authentication as contributed by Pascal Mathis.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2019-11-09/hardenedbsd-status-report\" rel=\"nofollow\">HardenedBSD November 2019 Status Report.</a></h3>\n\n<blockquote>\n<p>We at HardenedBSD have a lot of news to share. On 05 Nov 2019, Oliver Pinter resigned amicably from the project. All of us at HardenedBSD owe Oliver our gratitude and appreciation. This humble project, named by Oliver, was born out of his thesis work and the collaboration with Shawn Webb. Oliver created the HardenedBSD repo on GitHub in April 2013. The HardenedBSD Foundation was formed five years later to carry on this great work. </p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20191110123908\" rel=\"nofollow\">DNSSEC enabled in default unbound(8) configuration.</a></h3>\n\n<blockquote>\n<p>DNSSEC validation has been enabled in the default unbound.conf(5) in -current. The relevant commits were from Job Snijders (job@)</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.howtoforge.com/how-to-install-shopware-with-nginx-and-lets-encrypt-on-freebsd-12/\" rel=\"nofollow\">How to Install Shopware with NGINX and Let&#39;s Encrypt on FreeBSD 12</a></h3>\n\n<blockquote>\n<p>Shopware is the next generation of open source e-commerce software. Based on bleeding edge technologies like Symfony 3, Doctrine2 and Zend Framework Shopware comes as the perfect platform for your next e-commerce project. This tutorial will walk you through the Shopware Community Edition (CE) installation on FreeBSD 12 system by using NGINX as a web server.</p>\n</blockquote>\n\n<ul>\n<li>Requirements</li>\n</ul>\n\n<blockquote>\n<p>Make sure your system meets the following minimum requirements:</p>\n\n<ul>\n<li>Linux-based operating system with NGINX or Apache 2.x (with mod_rewrite) web server installed. </li>\n<li>PHP 5.6.4 or higher with ctype, gd, curl, dom, hash, iconv, zip, json, mbstring, openssl, session, simplexml, xml, zlib, fileinfo, and pdo/mysql extensions. PHP 7.1 or above is strongly recommended.</li>\n<li>MySQL 5.5.0 or higher.</li>\n<li>Possibility to set up cron jobs.</li>\n<li>Minimum 4 GB available hard disk space.</li>\n<li>IonCube Loader version 5.0.0 or higher (optional).</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://cromwell-intl.com/open-source/compiling-rainbowcrack-on-openbsd.html\" rel=\"nofollow\">How to Compile RainbowCrack on OpenBSD</a></h3>\n\n<blockquote>\n<p>Project RainbowCrack was originally Zhu Shuanglei&#39;s implementation, it&#39;s not clear to me if the project is still just his or if it&#39;s even been maintained for a while. His page seems to have been last updated in August 2007.</p>\n\n<p>The Project RainbowCrack web page now has just binaries for Windows XP and Linux, both 32-bit and 64-bit versions.</p>\n\n<p>Earlier versions were available as source code. The version 1.2 source code does not compile on OpenBSD, and in my experience it doesn&#39;t compile on Linux, either. It seems to date from 2004 at the earliest, and I think it makes some version-2.4 assumptions about Linux kernel headers.</p>\n</blockquote>\n\n<ul>\n<li>You might also look at ophcrack, a more modern tool, although it seems to be focused on cracking Windows XP/Vista/7/8/10 password hashes</li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Reese - <a href=\"http://dpaste.com/2RDG9K4#wrap\" rel=\"nofollow\">Amature radio info</a></li>\n<li>Chris - <a href=\"http://dpaste.com/2K4T2FQ#wrap\" rel=\"nofollow\">VPN</a></li>\n<li>Malcolm - <a href=\"http://dpaste.com/138NEMA\" rel=\"nofollow\">NAT</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0325.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD 12.1 is here, A history of Unix before Berkeley, FreeBSD development setup, HardenedBSD 2019 Status Report, DNSSEC, compiling RainbowCrack on OpenBSD, and more.","date_published":"2019-11-21T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a971b40e-d33a-44ac-9cf8-dfaf7e4aaff7.mp3","mime_type":"audio/mp3","size_in_bytes":41526775,"duration_in_seconds":3460}]},{"id":"e82a766b-37c4-4d16-896b-6fcfcfdef480","title":"324: Emergency Space Mode","url":"https://www.bsdnow.tv/324","content_text":"Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.\n\n\n\nHeadlines\n\nMigrating drives and the zpool from one host to another.\n\n\nToday is the day.\n\nToday I move a zpool from an R710 into an R720. The goal: all services on that zpool start running on the new host.\n\nFortunately, that zpool is dedicated to jails, more or less. I have done some planning about this, including moving a poudriere on the R710 into a jail.\n\nNow it is almost noon on Saturday, I am sitting in the basement (just outside the server room), and I’m typing this up.\n\n\n\nIn this post:\n\n\nFreeBSD 12.0\nDell R710 (r710-01)\nDell R720 (r720-01)\ndrive caddies from eBay and now I know the difference between SATA and SATAu\n\nPLEASE READ THIS first: Migrating ZFS Storage Pools\n\n\n\n\nOpenBSD in 2019\n\n\nI’ve used OpenBSD on and off since 2.1. More back then than in the last 10 years or so though, so I thought I’d try it again.\n\nWhat triggered this was me finding a silly bug in GNU cpio that has existed with a “FIXME” comment since at least 1994. I checked OpenBSD to see if it had a related bug, but as expected no it was just fine.\n\nI don’t quite remember why I stopped using OpenBSD for servers, but I do remember filesystem corruption on “unexpected power disconnections” (even with softdep turned on), which I’ve never really seen on Linux.\n\nThat and that fewer things “just worked” than with Linux, which matters more when I installed more random things than I do now. I’ve become a lot more minimalist. Probably due to less spare time. Life is better when you don’t run things like PHP (not that OpenBSD doesn’t support PHP, just an example) or your own email server with various antispam tooling, and other things.\n\nThis is all experience from running OpenBSD on a server. On my next laptop I intend to try running OpenBSD on the dektop, and will see if that more ad-hoc environment works well. E.g. will gnuradio work? Lack of other-OS VM support may be a problem.\n\n\n\nVerdict\n\n\n\nOuch, that’s a long list of bad stuff. Still, I like it. I’ll continue to run it, and will make sure my stuff continues working on OpenBSD.\n\nAnd maybe in a year I’ll have a review of OpenBSD on a laptop.\n\n\n\n\nNews Roundup\n\nNew zlib, new dhcpcd\n\n\nzlib and dhcpcd are both updated in DragonFly… but my quick perusal of the commits makes it sound like bugfix only; no usage changes needed.\n\n\n\nDHCPCD Commit: http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html\nZLIB Commit: http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html\n\n\n\n\nBatch renaming images, including image resolution, with awk\n\n\nThe most recent item on my list of “Geeky things I did that made me feel pretty awesome” is an hour’s adventure that culminated in this code:\n\n\n$ file IMG* | awk 'BEGIN{a=0} {print substr($1, 1, length($1)-5),a++\"_\"substr($8,1, length($8)-1)}' | while read fn fr; do echo $(rename -v \"s/$fn/img_$fr/g\" *); done\nIMG_20170808_172653_425.jpg renamed as img_0_4032x3024.jpg\nIMG_20170808_173020_267.jpg renamed as img_1_3024x3506.jpg\nIMG_20170808_173130_616.jpg renamed as img_2_3024x3779.jpg\nIMG_20170808_173221_425.jpg renamed as img_3_3024x3780.jpg\nIMG_20170808_173417_059.jpg renamed as img_4_2956x2980.jpg\nIMG_20170808_173450_971.jpg renamed as img_5_3024x3024.jpg\nIMG_20170808_173536_034.jpg renamed as img_6_4032x3024.jpg\nIMG_20170808_173602_732.jpg renamed as img_7_1617x1617.jpg\nIMG_20170808_173645_339.jpg renamed as img_8_3024x3780.jpg\nIMG_20170909_170146_585.jpg renamed as img_9_3036x3036.jpg\nIMG_20170911_211522_543.jpg renamed as img_10_3036x3036.jpg\nIMG_20170913_071608_288.jpg renamed as img_11_2760x2760.jpg\nIMG_20170913_073205_522.jpg renamed as img_12_2738x2738.jpg\n// ... etc etc\n\n\n\nThe last item on the aforementioned list is “TODO: come up with a shorter title for this list.”\n\n\n\n\nI hate the X11 ICCCM selection system, and you should too - A Rant\n\n\nd00d, that document is devilspawn. I've recently spent my nights in pain\nimplementing the selection mechanism. WHY OH WHY OH WHY? why me?  why did I choose to do this? and what sick evil twisted mind wrote this damn spec? I don't know why I'm working with it, I just wanted to make a useful program.\n\nI didn't know what I was getting myself in to. Nobody knows until they try it. And once you start, you're unable to stop. You can't stop, if you stop then you haven't completed it to spec. You can't fail on this, it's just a few pages of text, how can that be so hard? So what if they use Atoms for everything. So what if there's no explicit correlation between the target type of a SelectionNotify event and the type of the property it indicates?\n\nSo what if the distinction is ambiguous? So what if the document is littered with such atrocities? It's not the spec's fault, the spec is authoritative. It's obviously YOUR (the implementor's) fault for misunderstanding it. If you didn't misunderstand it, you wouldn't be here complaining about it would you?\n\n\n\n\nHAMMER2 emergency space mode\n\n\nAs anyone who has been running HAMMER1 or HAMMER2 has noticed, snapshots and copy on write and infinite history can eat a lot of disk space, even if the actual file volume isn’t changing much.  There’s now an ‘emergency mode‘ for HAMMER2, where disk operations can happen even if there isn’t space for the normal history activity.  It’s dangerous, in that the normal protections against data loss if power is cut go away, and snapshots created while in this mode will be mangled.  So definitely don’t leave it on!\n\n\n\n\nBeastie Bits\n\n\nThe BastilleBSD community has started work on over 100 automation templates\nPAM perturbed\nOpenBSD T-Shirts now available\nFastoCloud (Opensource Media Service) now available on FreeBSD\nUnix: A History and a Memoir by Brian Kernighan now available\nOpenBSD Moonlight game streaming client from a Windows + Nvidia PC\n***\n\n\nFeedback/Questions\n\n\nTim - Release Notes for Lumina 1.5\n\n\nAnswer Here\n\nBrad - vBSDcon Trip Report\nJacob - Using terminfo on FreeBSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.</p>\n\n<hr>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://dan.langille.org/2019/10/26/migrating-drives-and-the-zpool-from-one-host-to-another/\" rel=\"nofollow\">Migrating drives and the zpool from one host to another.</a></h3>\n\n<blockquote>\n<p>Today is the day.</p>\n\n<p>Today I move a zpool from an R710 into an R720. The goal: all services on that zpool start running on the new host.</p>\n\n<p>Fortunately, that zpool is dedicated to jails, more or less. I have done some planning about this, including moving a poudriere on the R710 into a jail.</p>\n\n<p>Now it is almost noon on Saturday, I am sitting in the basement (just outside the server room), and I’m typing this up.</p>\n</blockquote>\n\n<ul>\n<li><p>In this post:</p>\n\n<ul>\n<li>FreeBSD 12.0</li>\n<li>Dell R710 (r710-01)</li>\n<li>Dell R720 (r720-01)</li>\n<li>drive caddies from eBay and now I know the difference between SATA and SATAu</li>\n</ul></li>\n<li><p><a href=\"https://docs.oracle.com/cd/E19253-01/819-5461/gbchy/index.html\" rel=\"nofollow\">PLEASE READ THIS first: Migrating ZFS Storage Pools</a></p></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://blog.habets.se/2019/10/OpenBSD-in-2019.html\" rel=\"nofollow\">OpenBSD in 2019</a></h3>\n\n<blockquote>\n<p>I’ve used OpenBSD on and off since 2.1. More back then than in the last 10 years or so though, so I thought I’d try it again.</p>\n\n<p>What triggered this was me finding a silly bug in GNU cpio that has existed with a “FIXME” comment since at least 1994. I checked OpenBSD to see if it had a related bug, but as expected no it was just fine.</p>\n\n<p>I don’t quite remember why I stopped using OpenBSD for servers, but I do remember filesystem corruption on “unexpected power disconnections” (even with softdep turned on), which I’ve never really seen on Linux.</p>\n\n<p>That and that fewer things “just worked” than with Linux, which matters more when I installed more random things than I do now. I’ve become a lot more minimalist. Probably due to less spare time. Life is better when you don’t run things like PHP (not that OpenBSD doesn’t support PHP, just an example) or your own email server with various antispam tooling, and other things.</p>\n\n<p>This is all experience from running OpenBSD on a server. On my next laptop I intend to try running OpenBSD on the dektop, and will see if that more ad-hoc environment works well. E.g. will gnuradio work? Lack of other-OS VM support may be a problem.</p>\n</blockquote>\n\n<ul>\n<li>Verdict</li>\n</ul>\n\n<blockquote>\n<p>Ouch, that’s a long list of bad stuff. Still, I like it. I’ll continue to run it, and will make sure my stuff continues working on OpenBSD.</p>\n\n<p>And maybe in a year I’ll have a review of OpenBSD on a laptop.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/10/29/23683.html\" rel=\"nofollow\">New zlib, new dhcpcd</a></h3>\n\n<blockquote>\n<p>zlib and dhcpcd are both updated in DragonFly… but my quick perusal of the commits makes it sound like bugfix only; no usage changes needed.</p>\n</blockquote>\n\n<ul>\n<li>DHCPCD Commit: <a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html\" rel=\"nofollow\">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719768.html</a></li>\n<li>ZLIB Commit: <a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html\" rel=\"nofollow\">http://lists.dragonflybsd.org/pipermail/commits/2019-October/719772.html</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://victoria.dev/verbose/batch-renaming-images-including-image-resolution-with-awk/\" rel=\"nofollow\">Batch renaming images, including image resolution, with awk</a></h3>\n\n<blockquote>\n<p>The most recent item on my list of “Geeky things I did that made me feel pretty awesome” is an hour’s adventure that culminated in this code:</p>\n</blockquote>\n\n<pre><code>$ file IMG* | awk &#39;BEGIN{a=0} {print substr($1, 1, length($1)-5),a++&quot;_&quot;substr($8,1, length($8)-1)}&#39; | while read fn fr; do echo $(rename -v &quot;s/$fn/img_$fr/g&quot; *); done\nIMG_20170808_172653_425.jpg renamed as img_0_4032x3024.jpg\nIMG_20170808_173020_267.jpg renamed as img_1_3024x3506.jpg\nIMG_20170808_173130_616.jpg renamed as img_2_3024x3779.jpg\nIMG_20170808_173221_425.jpg renamed as img_3_3024x3780.jpg\nIMG_20170808_173417_059.jpg renamed as img_4_2956x2980.jpg\nIMG_20170808_173450_971.jpg renamed as img_5_3024x3024.jpg\nIMG_20170808_173536_034.jpg renamed as img_6_4032x3024.jpg\nIMG_20170808_173602_732.jpg renamed as img_7_1617x1617.jpg\nIMG_20170808_173645_339.jpg renamed as img_8_3024x3780.jpg\nIMG_20170909_170146_585.jpg renamed as img_9_3036x3036.jpg\nIMG_20170911_211522_543.jpg renamed as img_10_3036x3036.jpg\nIMG_20170913_071608_288.jpg renamed as img_11_2760x2760.jpg\nIMG_20170913_073205_522.jpg renamed as img_12_2738x2738.jpg\n// ... etc etc\n</code></pre>\n\n<blockquote>\n<p>The last item on the aforementioned list is “TODO: come up with a shorter title for this list.”</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://www.call-with-current-continuation.org/rants/icccm.txt\" rel=\"nofollow\">I hate the X11 ICCCM selection system, and you should too - A Rant</a></h3>\n\n<blockquote>\n<p>d00d, that document is devilspawn. I&#39;ve recently spent my nights in pain<br>\nimplementing the selection mechanism. WHY OH WHY OH WHY? why me?  why did I choose to do this? and what sick evil twisted mind wrote this damn spec? I don&#39;t know why I&#39;m working with it, I just wanted to make a useful program.</p>\n\n<p>I didn&#39;t know what I was getting myself in to. Nobody knows until they try it. And once you start, you&#39;re unable to stop. You can&#39;t stop, if you stop then you haven&#39;t completed it to spec. You can&#39;t fail on this, it&#39;s just a few pages of text, how can that be so hard? So what if they use Atoms for everything. So what if there&#39;s no explicit correlation between the target type of a SelectionNotify event and the type of the property it indicates?</p>\n\n<p>So what if the distinction is ambiguous? So what if the document is littered with such atrocities? It&#39;s not the spec&#39;s fault, the spec is authoritative. It&#39;s obviously YOUR (the implementor&#39;s) fault for misunderstanding it. If you didn&#39;t misunderstand it, you wouldn&#39;t be here complaining about it would you?</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/10/22/23652.html\" rel=\"nofollow\">HAMMER2 emergency space mode</a></h3>\n\n<blockquote>\n<p>As anyone who has been running HAMMER1 or HAMMER2 has noticed, snapshots and copy on write and infinite history can eat a lot of disk space, even if the actual file volume isn’t changing much.  There’s now an ‘emergency mode‘ for HAMMER2, where disk operations can happen even if there isn’t space for the normal history activity.  It’s dangerous, in that the normal protections against data loss if power is cut go away, and snapshots created while in this mode will be mangled.  So definitely don’t leave it on!</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/BastilleBSD/status/1186659762458501120\" rel=\"nofollow\">The BastilleBSD community has started work on over 100 automation templates</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/10/23/23654.html\" rel=\"nofollow\">PAM perturbed</a></li>\n<li><a href=\"https://teespring.com/stores/openbsd\" rel=\"nofollow\">OpenBSD T-Shirts now available</a></li>\n<li><a href=\"https://old.reddit.com/r/freebsd/comments/dlyqtq/fastocloud_opensource_media_service_now_available/\" rel=\"nofollow\">FastoCloud (Opensource Media Service) now available on FreeBSD</a></li>\n<li><a href=\"https://www.cs.princeton.edu/%7Ebwk/\" rel=\"nofollow\">Unix: A History and a Memoir by Brian Kernighan now available</a></li>\n<li><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/d6xboo/openbsd_moonlight_game_streaming_client_from_a/\" rel=\"nofollow\">OpenBSD Moonlight game streaming client from a Windows + Nvidia PC</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Tim - <a href=\"http://dpaste.com/38DNSXT#wrap\" rel=\"nofollow\">Release Notes for Lumina 1.5</a>\n\n<ul>\n<li><a href=\"http://dpaste.com/3QJX8G3#wrap\" rel=\"nofollow\">Answer Here</a></li>\n</ul></li>\n<li>Brad - <a href=\"http://dpaste.com/316MGVX#wrap\" rel=\"nofollow\">vBSDcon Trip Report</a></li>\n<li>Jacob - <a href=\"http://dpaste.com/131N05J#wrap\" rel=\"nofollow\">Using terminfo on FreeBSD</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0324.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Migrating drives and zpool between hosts, OpenBSD in 2019, Dragonfly’s new zlib and dhcpcd, Batch renaming images and resolution with awk, a rant on the X11 ICCCM selection system, hammer 2 emergency space mode, and more.","date_published":"2019-11-14T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e82a766b-37c4-4d16-896b-6fcfcfdef480.mp3","mime_type":"audio/mp3","size_in_bytes":33490674,"duration_in_seconds":2790}]},{"id":"cf54c1fe-70ba-49a3-9b13-1ceb64ab896a","title":"323: OSI Burrito Guy","url":"https://www.bsdnow.tv/323","content_text":"The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.\n\nHeadlines\n\nThe Earliest Unix Code: An Anniversary Source Code Release\n\n\nWhat is it that runs the servers that hold our online world, be it the web or the cloud? What enables the mobile apps that are at the center of increasingly on-demand lives in the developed world and of mobile banking and messaging in the developing world? The answer is the operating system Unix and its many descendants: Linux, Android, BSD Unix, MacOS, iOS—the list goes on and on. Want to glimpse the Unix in your Mac? Open a Terminal window and enter “man roff” to view the Unix manual entry for an early text formatting program that lives within your operating system.\n\n2019 marks the 50th anniversary of the start of Unix. In the summer of 1969, that same summer that saw humankind’s first steps on the surface of the Moon, computer scientists at the Bell Telephone Laboratories—most centrally Ken Thompson and Dennis Ritchie—began the construction of a new operating system, using a then-aging DEC PDP-7 computer at the labs.\n\n\n\n\nThis man sent the first online message 50 years ago\n\n\nAs many of you have heard in the past, the first online message ever sent between two computers was \"lo\", just over 50 years ago, on Oct. 29, 1969. \n\n\n\nIt was supposed to say \"log,\" but the computer sending the message — based at UCLA — crashed before the letter \"g\" was typed. A computer at Stanford 560 kilometres away was supposed to fill in the remaining characters \"in,\" as in \"log in.\"\n\n\n\nThe CBC Radio show, “The Current” has a half-hour interview with the man who sent that message, Leonard Kleinrock, distinguished professor of computer science at UCLA\n\n\n\n\"The idea of the network was you could sit at one computer, log on through the network to a remote computer and use its services there,\"\n\n50 years later, the internet has become so ubiquitous that it has almost been rendered invisible. There's hardly an aspect in our daily lives that hasn't been touched and transformed by it.\n\nQ: Take us back to that day 50 years ago. Did you have the sense that this was going to be something you'd be talking about a half a century later?\n\nA: Well, yes and no. Four months before that message was sent, there was a press release that came out of UCLA in which it quotes me as describing what my vision for this network would become. Basically what it said is that this network would be always on, always available. Anybody with any device could get on at anytime from any location, and it would be invisible.\n\nWell, what I missed ... was that this is going to become a social network. People talking to people. Not computers talking to computers, but [the] human element.\n\nQ: Can you briefly explain what you were working on in that lab? Why were you trying to get computers to actually talk to one another?\n\nA: As an MIT graduate student, years before, I recognized I was surrounded by computers and I realized there was no effective [or efficient] way for them to communicate. I did my dissertation, my research, on establishing a mathematical theory of how these networks would work. But there was no such network existing. AT&amp;T said it won't work and, even if it does, we want nothing to do with it.\n\nSo I had to wait around for years until the Advanced Research Projects Agency within the Department of Defence decided they needed a network to connect together the computer scientists they were supervising and supporting.\n\nQ: For all the promise of the internet, it has also developed some dark sides that I'm guessing pioneers like yourselves never anticipated.\n\nA: We did not. I knew everybody on the internet at that time, and they were all well-behaved and they all believed in an open, shared free network. So we did not put in any security controls.\n\nWhen the first spam email occurred, we began to see the dark side emerge as this network reached nefarious people sitting in basements with a high-speed connection, reaching out to millions of people instantaneously, at no cost in time or money, anonymously until all sorts of unpleasant events occurred, which we called the dark side.\n\nBut in those early days, I considered the network to be going through its teenage years. Hacking to spam, annoying kinds of effects. I thought that one day this network would mature and grow up. Well, in fact, it took a turn for the worse when nation states, organized crime and extremists came in and began to abuse the network in severe ways.\n\nQ: Is there any part of you that regrets giving birth to this?\n\nA: Absolutely not. The greater good is much more important.\n\n\n\n\nNews Roundup\n\nHow to use blacklistd(8) with NPF as a fail2ban replacement\n\n\nblacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.\n\nThe interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf\n\nNow, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use.\n\nUnfortunately (dont' ask me why ??) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen.\n\n\n\nFreeBSD’s handbook chapter on blacklistd\n\n\n\n\nOpenBSD crossed 400,000 commits\n\n\nSometime in the last week OpenBSD crossed 400,000 commits (*) upon all our repositories since starting at 1995/10/18 08:37:01 Canada/Mountain. That's a lot of commits by a lot of amazing people.\n\n(*) by one measure.  Since the repository is so large and old, there are a variety of quirks including ChangeLog missing entries and branches not convertible to other repo forms, so measuring is hard.  If you think you've got a great way of measuring, don't be so sure of yourself -- you may have overcounted or undercounted.\n\n\n\nSubject to the notes Theo made about under and over counting, FreeBSD should hit 1 million commits (base + ports + docs) some time in 2020\nNetBSD + pkgsrc are approaching 600,000, but of course pkgsrc covers other operating systems too\n\n\n\n\nHow to Install Bolt CMS with Nginx and Let's Encrypt on FreeBSD 12\n\n\nBolt is a sophisticated, lightweight and simple CMS built with PHP. It is released under the open-source MIT-license and source code is hosted as a public repository on Github. A bolt is a tool for Content Management, which strives to be as simple and straightforward as possible. It is quick to set up, easy to configure, uses elegant templates. Bolt is created using modern open-source libraries and is best suited to build sites in HTML5 with modern markup. In this tutorial, we will go through the Bolt CMS installation on FreeBSD 12 system by using Nginx as a web server, MySQL as a database server, and optionally you can secure the transport layer by using acme.sh client and Let's Encrypt certificate authority to add SSL support.\n\n\n\nRequirements\nThe system requirements for Bolt are modest, and it should run on any fairly modern web server:\n\n\nPHP version 5.5.9 or higher with the following common PHP extensions: pdo, mysqlnd, pgsql, openssl, curl, gd, intl, json, mbstring, opcache, posix, xml, fileinfo, exif, zip.\nAccess to SQLite (which comes bundled with PHP), or MySQL or PostgreSQL.\nApache with mod_rewrite enabled (.htaccess files) or Nginx (virtual host configuration covered below).\nA minimum of 32MB of memory allocated to PHP.\n\n\n\n\n\nhammer2 - Optimize hammer2 support threads and dispatch\n\n\nRefactor the XOP groups in order to be able to queue strategy calls, whenever possible, to the same CPU as the issuer.  This optimizes several cases and reduces unnecessary IPI traffic between cores.  The next best thing to do would be to not queue certain XOPs to an H2 support thread at all, but I would like to keep the threads intact for later clustering work.\nThe best scaling case for this is when one has a large number of user threads doing I/O.  One instance of a single-threaded program on an otherwise idle machine might see a slightly reduction in performance but at the same time we completely avoid unnecessarily spamming all cores in the system on the behalf of a single program, so overhead is also significantly lower.\n\nThis will tend to increase the number of H2 support threads since we need a certain degree of multiplication for domain separation.\n\nThis should significantly increase I/O performance for multi-threaded workloads.\n\n\n\n\nYou know, we might as well just run every network service over HTTPS/2 and build another six layers on top of that to appease the OSI 7-layer burrito guys\n\n\nI've seen the writing on the wall, and while for now you can configure Firefox not to use DoH, I'm not confident enough to think it will remain that way. To that end, I've finally set up my own DoH server for use at Chez Boca. It only involved setting up my own CA to generate the appropriate certificates, install my CA certificate into Firefox, configure Apache to run over HTTP/2 (THANK YOU SO VERY XXXXX­XX MUCH GOOGLE FOR SHOVING THIS HTTP/2 XXXXX­XXX DOWN OUR THROATS!—no, I'm not bitter) and write a 150 line script that just queries my own local DNS, because, you know, it's more XXXXX­XX secure or some XXXXX­XXX reason like that.\n\nSigh.\n\n\n\n\nBeastie Bits\n\n\nAn Oral History of Unix\nNUMA Siloing in the FreeBSD Network Stack [pdf]\nEuroBSDCon 2019 videos available\nBarbie knows best\nFor the #OpenBSD #e2k19 attendees.  I did a pre visit today.\nDrawer Find\nSlides - Removing ROP Gadgets from OpenBSD - AsiaBSDCon 2019\n\n\n\n\nFeedback/Questions\n\n\nBostjan - Open source doesn't mean secure\nMalcolm - Allan is Correct.\nMichael - FreeNAS inside a Jail\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://computerhistory.org/blog/the-earliest-unix-code-an-anniversary-source-code-release/\" rel=\"nofollow\">The Earliest Unix Code: An Anniversary Source Code Release</a></h3>\n\n<blockquote>\n<p>What is it that runs the servers that hold our online world, be it the web or the cloud? What enables the mobile apps that are at the center of increasingly on-demand lives in the developed world and of mobile banking and messaging in the developing world? The answer is the operating system Unix and its many descendants: Linux, Android, BSD Unix, MacOS, iOS—the list goes on and on. Want to glimpse the Unix in your Mac? Open a Terminal window and enter “man roff” to view the Unix manual entry for an early text formatting program that lives within your operating system.</p>\n\n<p>2019 marks the 50th anniversary of the start of Unix. In the summer of 1969, that same summer that saw humankind’s first steps on the surface of the Moon, computer scientists at the Bell Telephone Laboratories—most centrally Ken Thompson and Dennis Ritchie—began the construction of a new operating system, using a then-aging DEC PDP-7 computer at the labs.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.cbc.ca/radio/thecurrent/the-current-for-oct-29-2019-1.5339212/this-man-sent-the-first-online-message-50-years-ago-he-s-since-seen-the-web-s-dark-side-emerge-1.5339244\" rel=\"nofollow\">This man sent the first online message 50 years ago</a></h3>\n\n<ul>\n<li>As many of you have heard in the past, the first online message ever sent between two computers was &quot;lo&quot;, just over 50 years ago, on Oct. 29, 1969. </li>\n</ul>\n\n<blockquote>\n<p>It was supposed to say &quot;log,&quot; but the computer sending the message — based at UCLA — crashed before the letter &quot;g&quot; was typed. A computer at Stanford 560 kilometres away was supposed to fill in the remaining characters &quot;in,&quot; as in &quot;log in.&quot;</p>\n</blockquote>\n\n<ul>\n<li>The CBC Radio show, “The Current” has a half-hour interview with the man who sent that message, Leonard Kleinrock, distinguished professor of computer science at UCLA</li>\n</ul>\n\n<blockquote>\n<p>&quot;The idea of the network was you could sit at one computer, log on through the network to a remote computer and use its services there,&quot;</p>\n\n<p>50 years later, the internet has become so ubiquitous that it has almost been rendered invisible. There&#39;s hardly an aspect in our daily lives that hasn&#39;t been touched and transformed by it.</p>\n\n<p>Q: Take us back to that day 50 years ago. Did you have the sense that this was going to be something you&#39;d be talking about a half a century later?</p>\n\n<p>A: Well, yes and no. Four months before that message was sent, there was a press release that came out of UCLA in which it quotes me as describing what my vision for this network would become. Basically what it said is that this network would be always on, always available. Anybody with any device could get on at anytime from any location, and it would be invisible.</p>\n\n<p>Well, what I missed ... was that this is going to become a social network. People talking to people. Not computers talking to computers, but [the] human element.</p>\n\n<p>Q: Can you briefly explain what you were working on in that lab? Why were you trying to get computers to actually talk to one another?</p>\n\n<p>A: As an MIT graduate student, years before, I recognized I was surrounded by computers and I realized there was no effective [or efficient] way for them to communicate. I did my dissertation, my research, on establishing a mathematical theory of how these networks would work. But there was no such network existing. AT&amp;T said it won&#39;t work and, even if it does, we want nothing to do with it.</p>\n\n<p>So I had to wait around for years until the Advanced Research Projects Agency within the Department of Defence decided they needed a network to connect together the computer scientists they were supervising and supporting.</p>\n\n<p>Q: For all the promise of the internet, it has also developed some dark sides that I&#39;m guessing pioneers like yourselves never anticipated.</p>\n\n<p>A: We did not. I knew everybody on the internet at that time, and they were all well-behaved and they all believed in an open, shared free network. So we did not put in any security controls.</p>\n\n<p>When the first spam email occurred, we began to see the dark side emerge as this network reached nefarious people sitting in basements with a high-speed connection, reaching out to millions of people instantaneously, at no cost in time or money, anonymously until all sorts of unpleasant events occurred, which we called the dark side.</p>\n\n<p>But in those early days, I considered the network to be going through its teenage years. Hacking to spam, annoying kinds of effects. I thought that one day this network would mature and grow up. Well, in fact, it took a turn for the worse when nation states, organized crime and extremists came in and began to abuse the network in severe ways.</p>\n\n<p>Q: Is there any part of you that regrets giving birth to this?</p>\n\n<p>A: Absolutely not. The greater good is much more important.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement\" rel=\"nofollow\">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>\n\n<blockquote>\n<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.</p>\n\n<p>The interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf</p>\n\n<p>Now, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use.</p>\n\n<p>Unfortunately (dont&#39; ask me why ??) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-blacklistd.html\" rel=\"nofollow\">FreeBSD’s handbook chapter on blacklistd</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://marc.info/?l=openbsd-tech&m=157059352620659&w=2\" rel=\"nofollow\">OpenBSD crossed 400,000 commits</a></h3>\n\n<blockquote>\n<p>Sometime in the last week OpenBSD crossed 400,000 commits (*) upon all our repositories since starting at 1995/10/18 08:37:01 Canada/Mountain. That&#39;s a lot of commits by a lot of amazing people.</p>\n\n<p>(*) by one measure.  Since the repository is so large and old, there are a variety of quirks including ChangeLog missing entries and branches not convertible to other repo forms, so measuring is hard.  If you think you&#39;ve got a great way of measuring, don&#39;t be so sure of yourself -- you may have overcounted or undercounted.</p>\n</blockquote>\n\n<ul>\n<li>Subject to the notes Theo made about under and over counting, FreeBSD should hit 1 million commits (base + ports + docs) some time in 2020</li>\n<li>NetBSD + pkgsrc are approaching 600,000, but of course pkgsrc covers other operating systems too</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.howtoforge.com/how-to-install-bolt-cms-nginx-ssl-on-freebsd-12/\" rel=\"nofollow\">How to Install Bolt CMS with Nginx and Let&#39;s Encrypt on FreeBSD 12</a></h3>\n\n<blockquote>\n<p>Bolt is a sophisticated, lightweight and simple CMS built with PHP. It is released under the open-source MIT-license and source code is hosted as a public repository on Github. A bolt is a tool for Content Management, which strives to be as simple and straightforward as possible. It is quick to set up, easy to configure, uses elegant templates. Bolt is created using modern open-source libraries and is best suited to build sites in HTML5 with modern markup. In this tutorial, we will go through the Bolt CMS installation on FreeBSD 12 system by using Nginx as a web server, MySQL as a database server, and optionally you can secure the transport layer by using acme.sh client and Let&#39;s Encrypt certificate authority to add SSL support.</p>\n</blockquote>\n\n<ul>\n<li>Requirements</li>\n<li>The system requirements for Bolt are modest, and it should run on any fairly modern web server:\n\n<ul>\n<li>PHP version 5.5.9 or higher with the following common PHP extensions: pdo, mysqlnd, pgsql, openssl, curl, gd, intl, json, mbstring, opcache, posix, xml, fileinfo, exif, zip.</li>\n<li>Access to SQLite (which comes bundled with PHP), or MySQL or PostgreSQL.</li>\n<li>Apache with mod_rewrite enabled (.htaccess files) or Nginx (virtual host configuration covered below).</li>\n<li>A minimum of 32MB of memory allocated to PHP.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-September/719632.html\" rel=\"nofollow\">hammer2 - Optimize hammer2 support threads and dispatch</a></h3>\n\n<blockquote>\n<p>Refactor the XOP groups in order to be able to queue strategy calls, whenever possible, to the same CPU as the issuer.  This optimizes several cases and reduces unnecessary IPI traffic between cores.  The next best thing to do would be to not queue certain XOPs to an H2 support thread at all, but I would like to keep the threads intact for later clustering work.<br><br>\nThe best scaling case for this is when one has a large number of user threads doing I/O.  One instance of a single-threaded program on an otherwise idle machine might see a slightly reduction in performance but at the same time we completely avoid unnecessarily spamming all cores in the system on the behalf of a single program, so overhead is also significantly lower.</p>\n\n<p>This will tend to increase the number of H2 support threads since we need a certain degree of multiplication for domain separation.</p>\n\n<p>This should significantly increase I/O performance for multi-threaded workloads.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://boston.conman.org/2019/10/17.1\" rel=\"nofollow\">You know, we might as well just run every network service over HTTPS/2 and build another six layers on top of that to appease the OSI 7-layer burrito guys</a></h3>\n\n<blockquote>\n<p>I&#39;ve seen the writing on the wall, and while for now you can configure Firefox not to use DoH, I&#39;m not confident enough to think it will remain that way. To that end, I&#39;ve finally set up my own DoH server for use at Chez Boca. It only involved setting up my own CA to generate the appropriate certificates, install my CA certificate into Firefox, configure Apache to run over HTTP/2 (THANK YOU SO VERY XXXXX­XX MUCH GOOGLE FOR SHOVING THIS HTTP/2 XXXXX­XXX DOWN OUR THROATS!—no, I&#39;m not bitter) and write a 150 line script that just queries my own local DNS, because, you know, it&#39;s more XXXXX­XX secure or some XXXXX­XXX reason like that.</p>\n\n<p>Sigh.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.princeton.edu/%7Ehos/Mahoney/unixhistory\" rel=\"nofollow\">An Oral History of Unix</a></li>\n<li><a href=\"https://people.freebsd.org/%7Egallatin/talks/euro2019.pdf\" rel=\"nofollow\">NUMA Siloing in the FreeBSD Network Stack [pdf]</a></li>\n<li><a href=\"https://www.youtube.com/playlist?list=PLskKNopggjc6NssLc8GEGSiFYJLYdlTQx\" rel=\"nofollow\">EuroBSDCon 2019 videos available</a></li>\n<li><a href=\"https://twitter.com/eksffa/status/1188638425567682560\" rel=\"nofollow\">Barbie knows best</a></li>\n<li><a href=\"https://twitter.com/bob_beck/status/1188226661684301824\" rel=\"nofollow\">For the #OpenBSD #e2k19 attendees.  I did a pre visit today.</a></li>\n<li><a href=\"https://twitter.com/pasha_sh/status/1187877745499561985\" rel=\"nofollow\">Drawer Find</a></li>\n<li><a href=\"https://www.openbsd.org/papers/asiabsdcon2019-rop-slides.pdf\" rel=\"nofollow\">Slides - Removing ROP Gadgets from OpenBSD - AsiaBSDCon 2019</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Bostjan - <a href=\"http://dpaste.com/1M5MVCX#wrap\" rel=\"nofollow\">Open source doesn&#39;t mean secure</a></li>\n<li>Malcolm - <a href=\"http://dpaste.com/2RFNR94\" rel=\"nofollow\">Allan is Correct.</a></li>\n<li><p>Michael - <a href=\"http://dpaste.com/28YW3BB#wrap\" rel=\"nofollow\">FreeNAS inside a Jail</a></p>\n\n<hr></li>\n<li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0323.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"The earliest Unix code, how to replace fail2ban with blacklistd, OpenBSD crossed 400k commits, how to install Bolt CMS on FreeBSD, optimized hammer2, appeasing the OSI 7-layer burrito guys, and more.","date_published":"2019-11-07T07:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/cf54c1fe-70ba-49a3-9b13-1ceb64ab896a.mp3","mime_type":"audio/mp3","size_in_bytes":35547347,"duration_in_seconds":2962}]},{"id":"9f37f100-02f4-4b71-9eeb-3e9fa09f147c","title":"322: Happy Birthday, Unix","url":"https://www.bsdnow.tv/322","content_text":"Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.\n\nHeadlines\n\nUnix is 50\n\n\nIn the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more \"portable\". Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.\n\n\n\n\nHunting down Ken's PDP-7: video footage found\n\n\nIn my prior blog post, I traced Ken's scrounged PDP-7 to SN 34. In this post I'll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.\n\n\n\n\nNews Roundup\n\nOpenBSD 6.6 Released\n\n\nAnnounce: https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2\nUpgrade Guide: https://openbsd.org/faq/upgrade66.html\nChangelog: https://openbsd.org/plus66.html\n\n\n\n\nOPNsense 19.7.5 released\n\n\nHello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version\n\n\n12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.\n\nHere are the full patch notes:\n\n\nsystem: show all swap partitions in system information widget\nsystem: flatten services_get() in preparation for removal\nsystem: pin Syslog-ng version to specific package name\nsystem: fix LDAP/StartTLS with user import page\nsystem: fix a PHP warning on authentication server page\nsystem: replace most subprocess.call use\ninterfaces: fix devd handling of carp devices (contributed by stumbaumr)\nfirewall: improve firewall rules inline toggles\nfirewall: only allow TCP flags on TCP protocol\nfirewall: simplify help text for direction setting\nfirewall: make protocol log summary case insensitive\nreporting: ignore malformed flow records\ncaptive portal: fix type mismatch for timeout read\ndhcp: add note for static lease limitation with lease registration (contributed by Northguy)\nipsec: add margintime and rekeyfuzz options\nipsec: clear $dpdline correctly if not set\nui: fix tokenizer reorder on multiple saves\nplugins: os-acme-client 1.26[1]\nplugins: os-bind will reload bind on record change (contributed by blablup)\nplugins: os-etpro-telemetry minor subprocess.call replacement\nplugins: os-freeradius 1.9.4[2]\nplugins: os-frr 1.12[3]\nplugins: os-haproxy 2.19[4]\nplugins: os-mailtrail 1.2[5]\nplugins: os-postfix 1.11[6]\nplugins: os-rspamd 1.8[7]\nplugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)\nplugins: os-telegraf 1.7.6[8]\nplugins: os-theme-cicada 1.21 (contributed by Team Rebellion)\nplugins: os-theme-tukan 1.21 (contributed by Team Rebellion)\nplugins: os-tinc minor subprocess.call replacement\nplugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)\nplugins: os-virtualbox 1.0 (contributed by andrewhotlab)\n\n\n\n\nDealing with the misunderstandings of what is GhostBSD\n\n\nSince the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package's system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.\n\nOur official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.\n\nThere is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram https://t.me/ghostbsd, but you can also reach us on the forum.\n\n\n\n\nSHUTTLE – VPN over SSH | VPN Alternative\n\n\nLooking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.\n\n\n\nVPN over SSH – sshuttle\n\n\n\nsshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.\n\n\n\n\nOpenSSH 8.1 Released\n\n\nSecurity\n\n\nssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam's SSD program.\nssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large \"prekey\" consisting of random data (currently 16KB).\n\nThis release includes a number of changes that may affect existing configurations:\n\n\nssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using \"ssh-keygen -t ssh-rsa -s ...\").\n\nNew Features\n\n\nssh(1): Allow %n to be expanded in ProxyCommand strings\nssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the '' character, E.g. \"HostKeyAlgorithms ssh-ed25519\"\nssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).\nssh-keygen(1): print key comment when extracting public key from a private key.\nssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. \"ssh-keygen -vF host\") to print the matching host's random-art signature too.\nAll: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM's.\n\n\n\n\n\nBeastie Bits\n\n\nSay goodbye to the 32 CPU limit in NetBSD/aarch64\nvBSDcon 2019 videos\nBrowse the web in the terminal - W3M\nNetBSD 9 and GSoC\nBSDCan 2019 Videos\nNYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders\nFreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open\nFOSDEM 2020 - BSD Devroom Call for Participation\nUniversity of Cambridge looking for Research Assistants/Associates\n\n\n\n\nFeedback/Questions\n\n\nTrenton - Beeping Thinkpad\nAlex - Per user ZFS Datasets\n\n\nAllan’s old patch from 2015\n\nJavier - FBSD 12.0 + ZFS + encryption\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Unix is 50, Hunting down Ken&#39;s PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.bell-labs.com/unix50/\" rel=\"nofollow\">Unix is 50</a></h3>\n\n<blockquote>\n<p>In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more &quot;portable&quot;. Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2019/10/video-footage-of-first-pdp-7-to-run-unix.html\" rel=\"nofollow\">Hunting down Ken&#39;s PDP-7: video footage found</a></h3>\n\n<blockquote>\n<p>In my prior blog post, I traced Ken&#39;s scrounged PDP-7 to SN 34. In this post I&#39;ll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://openbsd.org/66.html\" rel=\"nofollow\">OpenBSD 6.6 Released</a></h3>\n\n<ul>\n<li>Announce: <a href=\"https://marc.info/?l=openbsd-tech&m=157132024225971&w=2\" rel=\"nofollow\">https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2</a></li>\n<li>Upgrade Guide: <a href=\"https://openbsd.org/faq/upgrade66.html\" rel=\"nofollow\">https://openbsd.org/faq/upgrade66.html</a></li>\n<li>Changelog: <a href=\"https://openbsd.org/plus66.html\" rel=\"nofollow\">https://openbsd.org/plus66.html</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-19-7-5-released/\" rel=\"nofollow\">OPNsense 19.7.5 released</a></h3>\n\n<blockquote>\n<p>Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version</p>\n</blockquote>\n\n<p>12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.</p>\n\n<p>Here are the full patch notes:</p>\n\n<ul>\n<li>system: show all swap partitions in system information widget</li>\n<li>system: flatten services_get() in preparation for removal</li>\n<li>system: pin Syslog-ng version to specific package name</li>\n<li>system: fix LDAP/StartTLS with user import page</li>\n<li>system: fix a PHP warning on authentication server page</li>\n<li>system: replace most subprocess.call use</li>\n<li>interfaces: fix devd handling of carp devices (contributed by stumbaumr)</li>\n<li>firewall: improve firewall rules inline toggles</li>\n<li>firewall: only allow TCP flags on TCP protocol</li>\n<li>firewall: simplify help text for direction setting</li>\n<li>firewall: make protocol log summary case insensitive</li>\n<li>reporting: ignore malformed flow records</li>\n<li>captive portal: fix type mismatch for timeout read</li>\n<li>dhcp: add note for static lease limitation with lease registration (contributed by Northguy)</li>\n<li>ipsec: add margintime and rekeyfuzz options</li>\n<li>ipsec: clear $dpdline correctly if not set</li>\n<li>ui: fix tokenizer reorder on multiple saves</li>\n<li>plugins: os-acme-client 1.26[1]</li>\n<li>plugins: os-bind will reload bind on record change (contributed by blablup)</li>\n<li>plugins: os-etpro-telemetry minor subprocess.call replacement</li>\n<li>plugins: os-freeradius 1.9.4[2]</li>\n<li>plugins: os-frr 1.12[3]</li>\n<li>plugins: os-haproxy 2.19[4]</li>\n<li>plugins: os-mailtrail 1.2[5]</li>\n<li>plugins: os-postfix 1.11[6]</li>\n<li>plugins: os-rspamd 1.8[7]</li>\n<li>plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)</li>\n<li>plugins: os-telegraf 1.7.6[8]</li>\n<li>plugins: os-theme-cicada 1.21 (contributed by Team Rebellion)</li>\n<li>plugins: os-theme-tukan 1.21 (contributed by Team Rebellion)</li>\n<li>plugins: os-tinc minor subprocess.call replacement</li>\n<li>plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)</li>\n<li>plugins: os-virtualbox 1.0 (contributed by andrewhotlab)</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"http://ghostbsd.org/node/194\" rel=\"nofollow\">Dealing with the misunderstandings of what is GhostBSD</a></h3>\n\n<blockquote>\n<p>Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package&#39;s system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.</p>\n\n<p>Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.</p>\n\n<p>There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram <a href=\"https://t.me/ghostbsd\" rel=\"nofollow\">https://t.me/ghostbsd</a>, but you can also reach us on the forum.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/\" rel=\"nofollow\">SHUTTLE – VPN over SSH | VPN Alternative</a></h3>\n\n<blockquote>\n<p>Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.</p>\n</blockquote>\n\n<ul>\n<li>VPN over SSH – sshuttle</li>\n</ul>\n\n<blockquote>\n<p>sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://www.openssh.com/txt/release-8.1\" rel=\"nofollow\">OpenSSH 8.1 Released</a></h3>\n\n<ul>\n<li><p>Security</p>\n\n<ul>\n<li>ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam&#39;s SSD program.</li>\n<li>ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large &quot;prekey&quot; consisting of random data (currently 16KB).</li>\n</ul></li>\n<li><p>This release includes a number of changes that may affect existing configurations:</p>\n\n<ul>\n<li>ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using &quot;ssh-keygen -t ssh-rsa -s ...&quot;).</li>\n</ul></li>\n<li><p>New Features</p>\n\n<ul>\n<li>ssh(1): Allow %n to be expanded in ProxyCommand strings</li>\n<li>ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the &#39;<sup>&#39;</sup> character, E.g. &quot;HostKeyAlgorithms <sup>ssh-ed25519&quot;</sup></li>\n<li>ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).</li>\n<li>ssh-keygen(1): print key comment when extracting public key from a private key.</li>\n<li>ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. &quot;ssh-keygen -vF host&quot;) to print the matching host&#39;s random-art signature too.</li>\n<li>All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM&#39;s.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/jmcwhatever/status/1185584719183962112\" rel=\"nofollow\">Say goodbye to the 32 CPU limit in NetBSD/aarch64</a></li>\n<li><a href=\"https://www.youtube.com/channel/UCvcdrOSlYOSzOzLjv_n1_GQ/videos\" rel=\"nofollow\">vBSDcon 2019 videos</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=3Hfda0Tjqsg&feature=youtu.be\" rel=\"nofollow\">Browse the web in the terminal - W3M</a></li>\n<li><a href=\"http://netbsd.org/%7Ekamil/GSoC2019.html#slide1\" rel=\"nofollow\">NetBSD 9 and GSoC</a></li>\n<li><a href=\"https://www.youtube.com/playlist?list=PLeF8ZihVdpFegPoAKppaDSoYmsBvpnSZv\" rel=\"nofollow\">BSDCan 2019 Videos</a></li>\n<li><a href=\"https://www.nycbug.org/index?action=view&id=10673\" rel=\"nofollow\">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/\" rel=\"nofollow\">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>\n<li><a href=\"https://people.freebsd.org/%7Erodrigo/fosdem20/\" rel=\"nofollow\">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>\n<li><a href=\"https://twitter.com/ed_maste/status/1184865668317007874\" rel=\"nofollow\">University of Cambridge looking for Research Assistants/Associates</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Trenton - <a href=\"http://dpaste.com/0ZEXNM6#wrap\" rel=\"nofollow\">Beeping Thinkpad</a></li>\n<li>Alex - <a href=\"http://dpaste.com/1K31A65#wrap\" rel=\"nofollow\">Per user ZFS Datasets</a>\n\n<ul>\n<li><a href=\"https://reviews.freebsd.org/D2272\" rel=\"nofollow\">Allan’s old patch from 2015</a></li>\n</ul></li>\n<li>Javier - <a href=\"http://dpaste.com/1XX4NNA#wrap\" rel=\"nofollow\">FBSD 12.0 + ZFS + encryption</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0322.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.","date_published":"2019-10-31T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9f37f100-02f4-4b71-9eeb-3e9fa09f147c.mp3","mime_type":"audio/mp3","size_in_bytes":49383869,"duration_in_seconds":4050}]},{"id":"fca983bf-93c9-460f-8c32-3b32663d463d","title":"321: The Robot OS","url":"https://www.bsdnow.tv/321","content_text":"An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.\n\nInterview - Trenton Schulz - freenas@norwegianrockcat.com\n\nRobot OS on FreeBSD\n\n\nBR: Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?\nAJ: You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?\nBR: Can you tell us more about the work you are doing with Robot OS on FreeBSD?\nAJ: Was EuroBSDcon your first BSD conference? How did you like it?\nBR: Do you have some tips or advice on how to get started with the BSDs?\nAJ: Is there anything else you’d like to tell us before we let you go?\n\n\n\n\nBeastie Bits\n\n\nFreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open\nPortland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza\nNYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders \nFOSDEM 2020 - BSD Devroom Call for Participation\nUniversity of Cambridge looking for Research Assistants/Associates\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\nSpecial Guest: Trenton Shulz.","content_html":"<p>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.</p>\n\n<h2>Interview - Trenton Schulz - <a href=\"mailto:freenas@norwegianrockcat.com\" rel=\"nofollow\">freenas@norwegianrockcat.com</a></h2>\n\n<p>Robot OS on FreeBSD</p>\n\n<ul>\n<li><strong>BR:</strong> Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?</li>\n<li><strong>AJ:</strong> You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?</li>\n<li><strong>BR:</strong> Can you tell us more about the work you are doing with Robot OS on FreeBSD?</li>\n<li><strong>AJ:</strong> Was EuroBSDcon your first BSD conference? How did you like it?</li>\n<li><strong>BR:</strong> Do you have some tips or advice on how to get started with the BSDs?</li>\n<li><strong>AJ:</strong> Is there anything else you’d like to tell us before we let you go?</li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/\" rel=\"nofollow\">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li>\n<li><a href=\"http://calagator.org/events/1250476319\" rel=\"nofollow\">Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza</a></li>\n<li><a href=\"https://www.nycbug.org/index?action=view&id=10673\" rel=\"nofollow\">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders </a></li>\n<li><a href=\"https://people.freebsd.org/%7Erodrigo/fosdem20/\" rel=\"nofollow\">FOSDEM 2020 - BSD Devroom Call for Participation</a></li>\n<li><a href=\"https://twitter.com/ed_maste/status/1184865668317007874\" rel=\"nofollow\">University of Cambridge looking for Research Assistants/Associates</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0321.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video><p>Special Guest: Trenton Shulz.</p>","summary":"An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.","date_published":"2019-10-23T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/fca983bf-93c9-460f-8c32-3b32663d463d.mp3","mime_type":"audio/mp3","size_in_bytes":39796738,"duration_in_seconds":3316}]},{"id":"11b9f24e-1789-4328-8396-4b9654aa2dfc","title":"320: Codebase: Neck Deep","url":"https://www.bsdnow.tv/320","content_text":"Headlines\n\nFreeBSD and custom firmware on the Google Pixelbook\n\n\nFreeBSD and custom firmware on the Google Pixelbook\n\n\n\nBack in 2015, I jumped on the ThinkPad bandwagon by getting an X240 to run FreeBSD on. Unlike most people in the ThinkPad crowd, I actually liked the clickpad and didn\\u2019t use the trackpoint much. But this summer I\\u2019ve decided that it was time for something newer. I wanted something..\n\n\n\nlighter and thinner (ha, turns out this is actually important, I got tired of carrying a T H I C C laptop - Apple was right all along);\nwith a 3:2 display (why is Lenovo making these Serious Work\\u2122 laptops 16:9 in the first place?? 16:9 is awful in below-13-inch sizes especially);\nwith a HiDPI display (and ideally with a good size for exact 2x scaling instead of fractional);\nwith USB-C ports;\nwithout a dGPU, especially without an NVIDIA GPU;\nassembled with screws and not glue (I don\\u2019t necessarily need expansion and stuff in a laptop all that much, but being able to replace the battery without dealing with a glued chassis is good);\nsupported by FreeBSD of course (\\u201csome development required\\u201d is okay but I\\u2019m not going to write big drivers);\nhow about something with open source firmware, that would be fun.\n\n\n\nI was considering a ThinkPad X1 Carbon from an old generation - the one from the same year as the X230 is corebootable, so that\\u2019s fun. But going back in processor generations just doesn\\u2019t feel great. I want something more efficient, not less!\n\nAnd then I discovered the Pixelbook. Other than the big huge large bezels around the screen, I liked everything about it. Thin aluminum design, a 3:2 HiDPI screen, rubber palm rests (why isn\\u2019t every laptop ever doing that?!), the \\u201cconvertibleness\\u201d (flip the screen around to turn it into.. something rather big for a tablet, but it is useful actually), a Wacom touchscreen that supports a pen, mostly reasonable hardware (Intel Wi-Fi), and that famous coreboot support (Chromebooks\\u2019 stock firmware is coreboot + depthcharge).\n\nSo here it is, my new laptop, a Google Pixelbook.\n\n\n\nConclusion\n\n\n\nPixelbook, FreeBSD, coreboot, EDK2 good.\n\nSeriously, I have no big words to say, other than just recommending this laptop to FOSS enthusiasts :)\n\n\n\n\nPorting NetBSD to the AMD x86-64: a case study in OS portability\n\n\nAbstract\n\n\n\nNetBSD is known as a very portable operating system, currently running on 44 different architectures (12 different types of CPU). This paper takes a look at what has been done to make it portable, and how this has decreased the amount of effort needed to port NetBSD to a new architecture. The new AMD x86-64 architecture, of which the specifications were published at the end of 2000, with hardware to follow in 2002, is used as an example.\n\n\n\nPortability\n\n\n\nSupporting multiple platforms was a primary goal of the NetBSD project from the start. As NetBSD was ported to more and more platforms, the NetBSD kernel code was adapted to become more portable along the way.\n\n\n\nGeneral\n\n\n\nGenerally, code is shared between ports as much as possible. In NetBSD, it should always be considered if the code can be assumed to be useful on other architectures, present or future. If so, it is machine-independent and put it in an appropriate place in the source tree. When writing code that is intended to be machine-independent, and it contains conditional preprocessor statements depending on the architecture, then the code is likely wrong, or an extra abstraction layer is needed to get rid of these statements.\n\n\n\nTypes\n\n\n\nAssumptions about the size of any type are not made. Assumptions made about type sizes on 32-bit platforms were a large problem when 64-bit platforms came around. Most of the problems of this kind had to be dealt with when NetBSD was ported to the DEC Alpha in 1994. A variation on this problem had to be dealt with with the UltraSPARC (sparc64) port in 1998, which is 64-bit, but big endian (vs. the little-endianness of the Alpha). When interacting with datastructures of a fixed size, such as on-disk metadata for filesystems, or datastructures directly interpreted by device hardware, explicitly sized types are used, such as uint32_t, int8_t, etc.\n\n\n\nConclusions and future work\n\n\n\nThe port of NetBSD to AMD's x86-64 architecture was done in six weeks, which confirms NetBSD's reputation as being a very portable operating system. One week was spent setting up the cross-toolchain and reading the x86-64 specifications, three weeks were spent writing the kernel code, one week was spent writing the userspace code, and one week testing and debugging it all. No problems were observed in any of the machine-independent parts of the kernel during test runs; all (simulated) device drivers, file systems, etc, worked without modification.\n\n\n\n\nNews Roundup\n\nZFS performance really does degrade as you approach quota limits\n\n\nEvery so often (currently monthly), there is an \"OpenZFS leadership meeting\". What this really means is 'lead developers from the various ZFS implementations get together to talk about things'. Announcements and meeting notes from these meetings get sent out to various mailing lists, including the ZFS on Linux ones. \n\n\n\nIn the September meeting notes, I read a very interesting (to me) agenda item: \n\n\nRelax quota semantics for improved performance (Allan Jude)\nProblem: As you approach quotas, ZFS performance degrades.\nProposal: Can we have a property like quota-policy=strict or loose, where we can optionally allow ZFS to run over the quota as long as performance is not decreased.\n\n\n\n\nThis is very interesting to me because of two reasons. First, in the past we have definitely seen significant problems on our OmniOS machines, both when an entire pool hits a quota limit and when a single filesystem hits a refquota limit. It's nice to know that this wasn't just our imagination and that there is a real issue here. Even better, it might someday be improved (and perhaps in a way that we can use at least some of the time).\n\nSecond, any number of people here run very close to and sometimes at the quota limits of both filesystems and pools, fundamentally because people aren't willing to buy more space. We have in the past assumed that this was relatively harmless and would only make people run out of space. If this is a known issue that causes serious performance degradation, well, I don't know if there's anything we can do, but at least we're going to have to think about it and maybe push harder at people. The first step will have to be learning the details of what's going on at the ZFS level to cause the slowdown. (It's apparently similar to what happens when the pool is almost full, but I don't know the specifics of that either.)\n\nWith that said, we don't seem to have seen clear adverse effects on our Linux fileservers, and they've definitely run into quota limits (repeatedly). One possible reason for this is that having lots of RAM and SSDs makes the effects mostly go away. Another possible reason is that we haven't been looking closely enough to see that we're experiencing global slowdowns that correlate to filesystems hitting quota limits. We've had issues before with somewhat subtle slowdowns that we didn't understand (cf), so I can't discount that we're having it happen again.\n\n\n\n\nFixing up KA9Q-unix, or \"neck deep in 30 year old codebases..\"\n\n\nI'll preface this by saying - yes, I'm still neck deep in FreeBSD's wifi stack and 802.11ac support, but it turns out it's slow work to fix 15 year old locking related issues that worked fine on 11abg cards, kinda worked ok on 11n cards, and are terrible for these 11ac cards. I'll .. get there.\n\nAnyhoo, I've finally been mucking around with AX.25 packet radio. I've been wanting to do this since I was a teenager and found out about its existence, but back in high school and .. well, until a few years ago really .. I didn't have my amateur radio licence. But, now I do, and I've done a bunch of other stuff with a bunch of other radios. The main stumbling block? All my devices are either Apple products or run FreeBSD - and none of them have useful AX.25 stacks. The main stacks of choice these days run on Linux, Windows or are a full hardware TNC.\n\nSo yes, I was avoiding hacking on AX.25 stuff because there wasn't a BSD compatible AX.25 stack. I'm 40 now, leave me be.\n\nBut! A few weeks ago I found that someone was still running a packet BBS out of San Francisco. And amazingly, his local node ran on FreeBSD! It turns out Jeremy (KK6JJJ) ported both an old copy of KA9Q and N0ARY-BBS to run on FreeBSD! Cool!\n\nI grabbed my 2m radio (which is already cabled up for digital modes), compiled up his KA9Q port, figured out how to get it to speak to Direwolf, and .. ok. Well, it worked. Kinda.\n\n\n\n\nHAMMER2 and fsck for review\n\n\nHAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there\\u2019s now a fsck command, useful if you want a report of data validity rather than any manual repair process.\n\n\n\n\n[The return of startx(1) for non-root users with some caveats\n\nMark Kettenis (kettenis@) has recently committed changes which restore a certain amount of startx(1)/xinit(1) functionality for non-root users. The commit messages explain the situation:\n\nCVSROOT:    /cvs\nModule name:    src\nChanges by:    kettenis@cvs.openbsd.org    2019/09/15 06:25:41\n\nModified files:\n    etc/etc.amd64  : fbtab \n    etc/etc.arm64  : fbtab \n    etc/etc.hppa   : fbtab \n    etc/etc.i386   : fbtab \n    etc/etc.loongson: fbtab \n    etc/etc.luna88k: fbtab \n    etc/etc.macppc : fbtab \n    etc/etc.octeon : fbtab \n    etc/etc.sgi    : fbtab \n    etc/etc.sparc64: fbtab \n\nLog message:\nAdd ttyC4 to lost of devices to change when logging in on ttyC0 (and in some cases also the serial console) such that X can use it as its VT when running without root privileges.\n\nok jsg@, matthieu@\nCVSROOT:    /cvs\nModule name:    xenocara\nChanges by:    kettenis@cvs.openbsd.org    2019/09/15 06:31:08\n\nModified files:\n    xserver/hw/xfree86/common: xf86AutoConfig.c \n\nLog message:\nAdd modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.\n\nThis makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).\n\nok jsg@, matthieu@\n\n\n\n\nBeastie Bits\n\n\nASCII table and history.  Or, why does Ctrl+i insert a Tab in my terminal?\nSourcehut makes BSD software better\nChaosnet for Unx\nThe Vim-Inspired Editor with a Linguistic Twist\nbhyvearm64: CPU and Memory Virtualization on Armv8.0-A\nDefCon25 - Are all BSD created Equally - A Survey of BSD Kernel vulnerabilities\n\n\n\n\nFeedback/Questions\n\n\nTim - GSoC project ideas for pf rule syntax translation\nBrad - Steam on FreeBSD\nRuslan - FreeBSD Quarterly Status Report - Q2 2019\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<h2>Headlines</h2>\n\n<h3><a href=\"https://unrelenting.technology/articles/FreeBSD-and-custom-firmware-on-the-Google-Pixelbook\" rel=\"nofollow\">FreeBSD and custom firmware on the Google Pixelbook</a></h3>\n\n<ul>\n<li>FreeBSD and custom firmware on the Google Pixelbook</li>\n</ul>\n\n<blockquote>\n<p>Back in 2015, I jumped on the ThinkPad bandwagon by getting an X240 to run FreeBSD on. Unlike most people in the ThinkPad crowd, I actually liked the clickpad and didn\\u2019t use the trackpoint much. But this summer I\\u2019ve decided that it was time for something newer. I wanted something..</p>\n</blockquote>\n\n<ul>\n<li>lighter and thinner (ha, turns out this is actually important, I got tired of carrying a T H I C C laptop - Apple was right all along);</li>\n<li>with a 3:2 display (why is Lenovo making these Serious Work\\u2122 laptops 16:9 in the first place?? 16:9 is awful in below-13-inch sizes especially);</li>\n<li>with a HiDPI display (and ideally with a good size for exact 2x scaling instead of fractional);</li>\n<li>with USB-C ports;</li>\n<li>without a dGPU, especially without an NVIDIA GPU;</li>\n<li>assembled with screws and not glue (I don\\u2019t necessarily need expansion and stuff in a laptop all that much, but being able to replace the battery without dealing with a glued chassis is good);</li>\n<li>supported by FreeBSD of course (\\u201csome development required\\u201d is okay but I\\u2019m not going to write big drivers);</li>\n<li>how about something with open source firmware, that would be fun.</li>\n</ul>\n\n<blockquote>\n<p>I was considering a ThinkPad X1 Carbon from an old generation - the one from the same year as the X230 is corebootable, so that\\u2019s fun. But going back in processor generations just doesn\\u2019t feel great. I want something more efficient, not less!</p>\n\n<p>And then I discovered the Pixelbook. Other than the big huge large bezels around the screen, I liked everything about it. Thin aluminum design, a 3:2 HiDPI screen, rubber palm rests (why isn\\u2019t every laptop ever doing that?!), the \\u201cconvertibleness\\u201d (flip the screen around to turn it into.. something rather big for a tablet, but it is useful actually), a Wacom touchscreen that supports a pen, mostly reasonable hardware (Intel Wi-Fi), and that famous coreboot support (Chromebooks\\u2019 stock firmware is coreboot + depthcharge).</p>\n\n<p>So here it is, my new laptop, a Google Pixelbook.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>Pixelbook, FreeBSD, coreboot, EDK2 good.</p>\n\n<p>Seriously, I have no big words to say, other than just recommending this laptop to FOSS enthusiasts :)</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.usenix.org/legacy/publications/library/proceedings/bsdcon02/full_papers/linden/linden_html/index.html\" rel=\"nofollow\">Porting NetBSD to the AMD x86-64: a case study in OS portability</a></h3>\n\n<ul>\n<li>Abstract</li>\n</ul>\n\n<blockquote>\n<p>NetBSD is known as a very portable operating system, currently running on 44 different architectures (12 different types of CPU). This paper takes a look at what has been done to make it portable, and how this has decreased the amount of effort needed to port NetBSD to a new architecture. The new AMD x86-64 architecture, of which the specifications were published at the end of 2000, with hardware to follow in 2002, is used as an example.</p>\n</blockquote>\n\n<ul>\n<li>Portability</li>\n</ul>\n\n<blockquote>\n<p>Supporting multiple platforms was a primary goal of the NetBSD project from the start. As NetBSD was ported to more and more platforms, the NetBSD kernel code was adapted to become more portable along the way.</p>\n</blockquote>\n\n<ul>\n<li>General</li>\n</ul>\n\n<blockquote>\n<p>Generally, code is shared between ports as much as possible. In NetBSD, it should always be considered if the code can be assumed to be useful on other architectures, present or future. If so, it is machine-independent and put it in an appropriate place in the source tree. When writing code that is intended to be machine-independent, and it contains conditional preprocessor statements depending on the architecture, then the code is likely wrong, or an extra abstraction layer is needed to get rid of these statements.</p>\n</blockquote>\n\n<ul>\n<li>Types</li>\n</ul>\n\n<blockquote>\n<p>Assumptions about the size of any type are not made. Assumptions made about type sizes on 32-bit platforms were a large problem when 64-bit platforms came around. Most of the problems of this kind had to be dealt with when NetBSD was ported to the DEC Alpha in 1994. A variation on this problem had to be dealt with with the UltraSPARC (sparc64) port in 1998, which is 64-bit, but big endian (vs. the little-endianness of the Alpha). When interacting with datastructures of a fixed size, such as on-disk metadata for filesystems, or datastructures directly interpreted by device hardware, explicitly sized types are used, such as uint32_t, int8_t, etc.</p>\n</blockquote>\n\n<ul>\n<li>Conclusions and future work</li>\n</ul>\n\n<blockquote>\n<p>The port of NetBSD to AMD&#39;s x86-64 architecture was done in six weeks, which confirms NetBSD&#39;s reputation as being a very portable operating system. One week was spent setting up the cross-toolchain and reading the x86-64 specifications, three weeks were spent writing the kernel code, one week was spent writing the userspace code, and one week testing and debugging it all. No problems were observed in any of the machine-independent parts of the kernel during test runs; all (simulated) device drivers, file systems, etc, worked without modification.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSFullQuotaPerformanceIssue\" rel=\"nofollow\">ZFS performance really does degrade as you approach quota limits</a></h3>\n\n<blockquote>\n<p>Every so often (currently monthly), there is an &quot;OpenZFS leadership meeting&quot;. What this really means is &#39;lead developers from the various ZFS implementations get together to talk about things&#39;. Announcements and meeting notes from these meetings get sent out to various mailing lists, including the ZFS on Linux ones. </p>\n</blockquote>\n\n<ul>\n<li>In the September meeting notes, I read a very interesting (to me) agenda item: \n\n<ul>\n<li>Relax quota semantics for improved performance (Allan Jude)</li>\n<li>Problem: As you approach quotas, ZFS performance degrades.</li>\n<li>Proposal: Can we have a property like quota-policy=strict or loose, where we can optionally allow ZFS to run over the quota as long as performance is not decreased.</li>\n</ul></li>\n</ul>\n\n<blockquote>\n<p>This is very interesting to me because of two reasons. First, in the past we have definitely seen significant problems on our OmniOS machines, both when an entire pool hits a quota limit and when a single filesystem hits a refquota limit. It&#39;s nice to know that this wasn&#39;t just our imagination and that there is a real issue here. Even better, it might someday be improved (and perhaps in a way that we can use at least some of the time).</p>\n\n<p>Second, any number of people here run very close to and sometimes at the quota limits of both filesystems and pools, fundamentally because people aren&#39;t willing to buy more space. We have in the past assumed that this was relatively harmless and would only make people run out of space. If this is a known issue that causes serious performance degradation, well, I don&#39;t know if there&#39;s anything we can do, but at least we&#39;re going to have to think about it and maybe push harder at people. The first step will have to be learning the details of what&#39;s going on at the ZFS level to cause the slowdown. (It&#39;s apparently similar to what happens when the pool is almost full, but I don&#39;t know the specifics of that either.)</p>\n\n<p>With that said, we don&#39;t seem to have seen clear adverse effects on our Linux fileservers, and they&#39;ve definitely run into quota limits (repeatedly). One possible reason for this is that having lots of RAM and SSDs makes the effects mostly go away. Another possible reason is that we haven&#39;t been looking closely enough to see that we&#39;re experiencing global slowdowns that correlate to filesystems hitting quota limits. We&#39;ve had issues before with somewhat subtle slowdowns that we didn&#39;t understand (cf), so I can&#39;t discount that we&#39;re having it happen again.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://adrianchadd.blogspot.com/2019/09/fixing-up-ka9q-unix-or-neck-deep-in-30.html\" rel=\"nofollow\">Fixing up KA9Q-unix, or &quot;neck deep in 30 year old codebases..&quot;</a></h3>\n\n<blockquote>\n<p>I&#39;ll preface this by saying - yes, I&#39;m still neck deep in FreeBSD&#39;s wifi stack and 802.11ac support, but it turns out it&#39;s slow work to fix 15 year old locking related issues that worked fine on 11abg cards, kinda worked ok on 11n cards, and are terrible for these 11ac cards. I&#39;ll .. get there.</p>\n\n<p>Anyhoo, I&#39;ve finally been mucking around with AX.25 packet radio. I&#39;ve been wanting to do this since I was a teenager and found out about its existence, but back in high school and .. well, until a few years ago really .. I didn&#39;t have my amateur radio licence. But, now I do, and I&#39;ve done a bunch of other stuff with a bunch of other radios. The main stumbling block? All my devices are either Apple products or run FreeBSD - and none of them have useful AX.25 stacks. The main stacks of choice these days run on Linux, Windows or are a full hardware TNC.</p>\n\n<p>So yes, I was avoiding hacking on AX.25 stuff because there wasn&#39;t a BSD compatible AX.25 stack. I&#39;m 40 now, leave me be.</p>\n\n<p>But! A few weeks ago I found that someone was still running a packet BBS out of San Francisco. And amazingly, his local node ran on FreeBSD! It turns out Jeremy (KK6JJJ) ported both an old copy of KA9Q and N0ARY-BBS to run on FreeBSD! Cool!</p>\n\n<p>I grabbed my 2m radio (which is already cabled up for digital modes), compiled up his KA9Q port, figured out how to get it to speak to Direwolf, and .. ok. Well, it worked. Kinda.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/09/24/23540.html\" rel=\"nofollow\">HAMMER2 and fsck for review</a></h3>\n\n<blockquote>\n<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there\\u2019s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>\n</blockquote>\n\n<hr>\n\n<h3>[The return of startx(1) for non-root users <a href=\"https://undeadly.org/cgi?action=article;sid=20190917091236\" rel=\"nofollow\">with some caveats</a></h3>\n\n<p>Mark Kettenis (kettenis@) has recently committed changes which restore a certain amount of startx(1)/xinit(1) functionality for non-root users. The commit messages explain the situation:</p>\n\n<pre><code>CVSROOT:    /cvs\nModule name:    src\nChanges by:    kettenis@cvs.openbsd.org    2019/09/15 06:25:41\n\nModified files:\n    etc/etc.amd64  : fbtab \n    etc/etc.arm64  : fbtab \n    etc/etc.hppa   : fbtab \n    etc/etc.i386   : fbtab \n    etc/etc.loongson: fbtab \n    etc/etc.luna88k: fbtab \n    etc/etc.macppc : fbtab \n    etc/etc.octeon : fbtab \n    etc/etc.sgi    : fbtab \n    etc/etc.sparc64: fbtab \n\nLog message:\nAdd ttyC4 to lost of devices to change when logging in on ttyC0 (and in some cases also the serial console) such that X can use it as its VT when running without root privileges.\n\nok jsg@, matthieu@\nCVSROOT:    /cvs\nModule name:    xenocara\nChanges by:    kettenis@cvs.openbsd.org    2019/09/15 06:31:08\n\nModified files:\n    xserver/hw/xfree86/common: xf86AutoConfig.c \n\nLog message:\nAdd modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.\n\nThis makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).\n\nok jsg@, matthieu@\n</code></pre>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://bestasciitable.com/\" rel=\"nofollow\">ASCII table and history.  Or, why does Ctrl+i insert a Tab in my terminal?</a></li>\n<li><a href=\"https://sourcehut.org/blog/2019-09-12-sourcehut-makes-bsd-software-better/\" rel=\"nofollow\">Sourcehut makes BSD software better</a></li>\n<li><a href=\"https://github.com/LM-3/chaos\" rel=\"nofollow\">Chaosnet for Unx</a></li>\n<li><a href=\"https://cosine.blue/2019-09-06-kakoune.html\" rel=\"nofollow\">The Vim-Inspired Editor with a Linguistic Twist</a></li>\n<li><a href=\"https://papers.freebsd.org/2019/bsdcan/elisei-bhyvearm64_cpu_and_memory_virtualization_on_armv8.0_a/\" rel=\"nofollow\">bhyvearm64: CPU and Memory Virtualization on Armv8.0-A</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=a2m56Yq-EIs\" rel=\"nofollow\">DefCon25 - Are all BSD created Equally - A Survey of BSD Kernel vulnerabilities</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Tim - <a href=\"http://dpaste.com/1RCSFK7#wrap\" rel=\"nofollow\">GSoC project ideas for pf rule syntax translation</a></li>\n<li>Brad - <a href=\"http://dpaste.com/2SKA9YB#wrap\" rel=\"nofollow\">Steam on FreeBSD</a></li>\n<li>Ruslan - <a href=\"http://dpaste.com/0DQM3Q1\" rel=\"nofollow\">FreeBSD Quarterly Status Report - Q2 2019</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0320.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD on the Google Pixelbook, Porting NetBSD to the AMD x86-64, ZFS performance really does degrade as you approach quota limits, Fixing up KA9Q-unix, HAMMER2 and fsck for review, the return of startx(1) for non-root users, and more.","date_published":"2019-10-16T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/11b9f24e-1789-4328-8396-4b9654aa2dfc.mp3","mime_type":"audio/mp3","size_in_bytes":40815513,"duration_in_seconds":3401}]},{"id":"19c9942c-0790-4157-af73-31faf1e2b8e4","title":"319: Lack Rack, Jack","url":"https://www.bsdnow.tv/319","content_text":"Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.\n\nHeadlines\n\nCausing ZFS corruption for fun and profit\n\n\nDatto backs up data, a lot of it. At the time of writing Datto has over 500 PB of data stored on ZFS. This count includes both backup appliances that are sent to customer sites, as well as cloud storage servers that are used for secondary and tertiary backup of those appliances. At this scale drive swaps are a daily occurrence, and data corruption is inevitable. How we handle this corruption when it happens determines whether we truly lose data, or successfully restore from secondary backup. In this post we'll be showing you how at Datto we intentionally cause corruption in our testing environments, to ensure we're building software that can properly handle these scenarios.\n\n\n\nCausing Corruption\n\n\n\nSince this is a mirror setup, a naive solution to cause corruption would be to randomly dd the same sectors of both /dev/sdb and /dev/sdc. This works, but is equally likely to just overwrite random unused space, or take down the zpool entirely. What we really want is to corrupt a specific snapshot, or even a specific file in that snapshot, to simulate a more realistic minor corruption event. Luckily we have a tool called zdb that lets us view some low level information about datasets.\n\n\n\nConclusion\n\n\n\nAt the 500 PB scale, it's not a matter of if data corruption will happen but when. Intentionally causing corruption is one of the strategies we use to ensure we're building software that can handle these rare (but inevitable) events.\n\nTo others out there using ZFS: I'm curious to hear how you've solved this problem. We did quite a bit of experimentation with zinject before going with this more brute force method. So I'd be especially interested if you've had luck simply simulating corruption with zinject.\n\n\n\n\nNetBSD Assembly Programming Tutorial\n\n\nA sparc64 version is also being prepared and will be added when done\n\nThis post describes how to write a simple hello world program in pure assembly on NetBSD/amd64. We will not use (nor link against) libc, nor use gcc to compile it. I will be using GNU as (gas), and therefore the AT&amp;T syntax instead of Intel.\n\n\n\nWhy assembly?\n\n\n\nWhy not? Because it's fun to program in assembly directly. Contrary to a popular belief assembly programs aren't always faster than what optimizing compilers produce. Nevertheless it's good to be able to read assembly, especially when debugging C programs\n\n\n\nDue to the nature of the guide, visit the site for the complete breakdown\n\n\n\n\nNews Roundup\n\nThe IKEA Lack Rack for Servers\n\n\nThe LackRack\n\n\n\nFirst occurrence on eth0:2010 Winterlan, the LackRack is the ultimate, low-cost, high shininess solution for your modular datacenter-in-the-living-room. Featuring the LACK (side table) from Ikea, the LackRack is an easy-to-implement, exact-fit datacenter building block. It's a little known fact that we have seen Google engineers tinker with Lack tables since way back in 2009.\n\nThe LackRack will certainly make its appearance again this summer at eth0:2010 Summer.\n\n\n\nSummary\n\n\n\nWhen temporarily not in use, multiple LackRacks can be stacked in a space-efficient way without disassembly, unlike competing 19\" server racks.\n\nThe LackRack was first seen on eth0:2010 Winterlan in the no-shoe Lounge area. Its low-cost and perfect fit are great for mounting up to 8 U of 19\" hardware, such as switches (see below), or perhaps other 19\" gear. It's very easy to assemble, and thanks to the design, they are stable enough to hold (for example) 19\" switches and you can put your bottle of Club-Mate on top! Multi-shiny LackRack can also be painted to your specific preferences and the airflow is unprecedented!\n\n\n\nHowto\n\n\n\nYou can find a howto on buying a LackRack on this page. This includes the proof that a 19\" switch can indeed be placed in the LackRack in its natural habitat!\n\n\n\n\nOmniOS Community Edition r151030 LTS - Published at May 6, 2019\n\n\nThe OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.\n\nOmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.\n\nThis is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.\n\nIf you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.\n\n\n\nFor full relase notes including upgrade instructions;\nrelease notes\nupgrade instructions\n\n\n\n\nList Block Devices on FreeBSD lsblk(8) Style\n\n\nWhen I have to work on Linux systems I usually miss many nice FreeBSD tools such as these for example to name the few: sockstat, gstat, top -b -o res, top -m io -o total, usbconfig, rcorder, beadm/bectl, idprio/rtprio,… but sometimes – which rarely happens – Linux has some very useful tool that is not available on FreeBSD. An example of such tool is lsblk(8) that does one thing and does it quite well – lists block devices and their contents. It has some problems like listing a disk that is entirely used under ZFS pool on which lsblk(8) displays two partitions instead of information about ZFS just being there – but we all know how much in some circles the CDDL licensed ZFS is unloved in that GPL world.\n\n\nExample lsblk(8) output from Linux system:\n\n$ lsblk\nNAME                         MAJ:MIN RM   SIZE RO TYPE   MOUNTPOINT\nsr0                           11:0    1  1024M  0 rom\nsda                            8:0    0 931.5G  0 disk\n|-sda1                         8:1    0   500M  0 part   /boot\n`-sda2                         8:2    0   931G  0 part\n  |-vg_local-lv_root (dm-0)  253:0    0    50G  0 lvm    /\n  |-vg_local-lv_swap (dm-1)  253:1    0  17.7G  0 lvm    [SWAP]\n  `-vg_local-lv_home (dm-2)  253:2    0   1.8T  0 lvm    /home\nsdc                            8:32   0 232.9G  0 disk\n`-sdc1                         8:33   0 232.9G  0 part\n  `-md1                        9:1    0 232.9G  0 raid10 /data\nsdd                            8:48   0 232.9G  0 disk\n`-sdd1                         8:49   0 232.9G  0 part\n  `-md1                        9:1    0 232.9G  0 raid10 /data\n\n\n\nWhat FreeBSD offers in this department? The camcontrol(8) and geom(8) commands are available. You can also use gpart(8) command to list partitions. Below you will find output of these commands from my single disk laptop. Please note that because of WordPress limitations I need to change all &gt; &lt; characters to ] [ ones in the commands outputs.\n\n\n\nSee the article for the rest of the guide\n\n\n\n\nProject Trident 19.10 Now Available\n\n\nThis is a general package update to the CURRENT release repository based upon TrueOS 19.10\n\n\n\nPACKAGE CHANGES FROM 19.08\n\n\nNew Packages: 601\nDeleted Packages: 165\nUpdated Packages: 3341\n\n\n\n\n\nBeastie Bits\n\n\nNetBSD building tools\nSponsorships open for SNMP Mastery\npkgsrc-2019Q3 release announcement (2019-10-03)\npfetch - A simple system information tool written in POSIX sh\nTaking NetBSD kernel bug roast to the next level: Kernel Fuzzers (quick A.D. 2019 overview)\nCracking Ken Thomson’s password\n\n\n\n\nFeedback/Questions\n\n\nEvilham - Couple Questions\nRob - APU2 alternatives and GPT partition types\nTom - FreeBSD journal article by A. Fengler\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://datto.engineering/post/causing-zfs-corruption\" rel=\"nofollow\">Causing ZFS corruption for fun and profit</a></h3>\n\n<blockquote>\n<p>Datto backs up data, a lot of it. At the time of writing Datto has over 500 PB of data stored on ZFS. This count includes both backup appliances that are sent to customer sites, as well as cloud storage servers that are used for secondary and tertiary backup of those appliances. At this scale drive swaps are a daily occurrence, and data corruption is inevitable. How we handle this corruption when it happens determines whether we truly lose data, or successfully restore from secondary backup. In this post we&#39;ll be showing you how at Datto we intentionally cause corruption in our testing environments, to ensure we&#39;re building software that can properly handle these scenarios.</p>\n</blockquote>\n\n<ul>\n<li>Causing Corruption</li>\n</ul>\n\n<blockquote>\n<p>Since this is a mirror setup, a naive solution to cause corruption would be to randomly dd the same sectors of both /dev/sdb and /dev/sdc. This works, but is equally likely to just overwrite random unused space, or take down the zpool entirely. What we really want is to corrupt a specific snapshot, or even a specific file in that snapshot, to simulate a more realistic minor corruption event. Luckily we have a tool called zdb that lets us view some low level information about datasets.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>At the 500 PB scale, it&#39;s not a matter of if data corruption will happen but when. Intentionally causing corruption is one of the strategies we use to ensure we&#39;re building software that can handle these rare (but inevitable) events.</p>\n\n<p>To others out there using ZFS: I&#39;m curious to hear how you&#39;ve solved this problem. We did quite a bit of experimentation with zinject before going with this more brute force method. So I&#39;d be especially interested if you&#39;ve had luck simply simulating corruption with zinject.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://polprog.net/blog/netbsdasmprog/\" rel=\"nofollow\">NetBSD Assembly Programming Tutorial</a></h3>\n\n<blockquote>\n<p>A sparc64 version is also being prepared and will be added when done</p>\n\n<p>This post describes how to write a simple hello world program in pure assembly on NetBSD/amd64. We will not use (nor link against) libc, nor use gcc to compile it. I will be using GNU as (gas), and therefore the AT&amp;T syntax instead of Intel.</p>\n</blockquote>\n\n<ul>\n<li>Why assembly?</li>\n</ul>\n\n<blockquote>\n<p>Why not? Because it&#39;s fun to program in assembly directly. Contrary to a popular belief assembly programs aren&#39;t always faster than what optimizing compilers produce. Nevertheless it&#39;s good to be able to read assembly, especially when debugging C programs</p>\n</blockquote>\n\n<ul>\n<li>Due to the nature of the guide, visit the site for the complete breakdown</li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://wiki.eth0.nl/index.php/LackRack\" rel=\"nofollow\">The IKEA Lack Rack for Servers</a></h3>\n\n<ul>\n<li>The LackRack</li>\n</ul>\n\n<blockquote>\n<p>First occurrence on eth0:2010 Winterlan, the LackRack is the ultimate, low-cost, high shininess solution for your modular datacenter-in-the-living-room. Featuring the LACK (side table) from Ikea, the LackRack is an easy-to-implement, exact-fit datacenter building block. It&#39;s a little known fact that we have seen Google engineers tinker with Lack tables since way back in 2009.</p>\n\n<p>The LackRack will certainly make its appearance again this summer at eth0:2010 Summer.</p>\n</blockquote>\n\n<ul>\n<li>Summary</li>\n</ul>\n\n<blockquote>\n<p>When temporarily not in use, multiple LackRacks can be stacked in a space-efficient way without disassembly, unlike competing 19&quot; server racks.</p>\n\n<p>The LackRack was first seen on eth0:2010 Winterlan in the no-shoe Lounge area. Its low-cost and perfect fit are great for mounting up to 8 U of 19&quot; hardware, such as switches (see below), or perhaps other 19&quot; gear. It&#39;s very easy to assemble, and thanks to the design, they are stable enough to hold (for example) 19&quot; switches and you can put your bottle of Club-Mate on top! Multi-shiny LackRack can also be painted to your specific preferences and the airflow is unprecedented!</p>\n</blockquote>\n\n<ul>\n<li>Howto</li>\n</ul>\n\n<blockquote>\n<p>You can find a howto on buying a LackRack on this page. This includes the proof that a 19&quot; switch can indeed be placed in the LackRack in its natural habitat!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://omniosce.org/article/release-030\" rel=\"nofollow\">OmniOS Community Edition r151030 LTS - Published at May 6, 2019</a></h3>\n\n<blockquote>\n<p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.</p>\n\n<p>OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.</p>\n\n<p>This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.</p>\n\n<p>If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.</p>\n</blockquote>\n\n<ul>\n<li>For full relase notes including upgrade instructions;</li>\n<li><a href=\"https://omniosce.org/releasenotes.html\" rel=\"nofollow\">release notes</a></li>\n<li><a href=\"https://omniosce.org/upgrade.html\" rel=\"nofollow\">upgrade instructions</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://vermaden.wordpress.com/2019/09/27/list-block-devices-on-freebsd-lsblk8-style/\" rel=\"nofollow\">List Block Devices on FreeBSD lsblk(8) Style</a></h3>\n\n<blockquote>\n<p>When I have to work on Linux systems I usually miss many nice FreeBSD tools such as these for example to name the few: sockstat, gstat, top -b -o res, top -m io -o total, usbconfig, rcorder, beadm/bectl, idprio/rtprio,… but sometimes – which rarely happens – Linux has some very useful tool that is not available on FreeBSD. An example of such tool is lsblk(8) that does one thing and does it quite well – lists block devices and their contents. It has some problems like listing a disk that is entirely used under ZFS pool on which lsblk(8) displays two partitions instead of information about ZFS just being there – but we all know how much in some circles the CDDL licensed ZFS is unloved in that GPL world.</p>\n</blockquote>\n\n<p>Example lsblk(8) output from Linux system:</p>\n\n<pre><code>$ lsblk\nNAME                         MAJ:MIN RM   SIZE RO TYPE   MOUNTPOINT\nsr0                           11:0    1  1024M  0 rom\nsda                            8:0    0 931.5G  0 disk\n|-sda1                         8:1    0   500M  0 part   /boot\n`-sda2                         8:2    0   931G  0 part\n  |-vg_local-lv_root (dm-0)  253:0    0    50G  0 lvm    /\n  |-vg_local-lv_swap (dm-1)  253:1    0  17.7G  0 lvm    [SWAP]\n  `-vg_local-lv_home (dm-2)  253:2    0   1.8T  0 lvm    /home\nsdc                            8:32   0 232.9G  0 disk\n`-sdc1                         8:33   0 232.9G  0 part\n  `-md1                        9:1    0 232.9G  0 raid10 /data\nsdd                            8:48   0 232.9G  0 disk\n`-sdd1                         8:49   0 232.9G  0 part\n  `-md1                        9:1    0 232.9G  0 raid10 /data\n</code></pre>\n\n<blockquote>\n<p>What FreeBSD offers in this department? The camcontrol(8) and geom(8) commands are available. You can also use gpart(8) command to list partitions. Below you will find output of these commands from my single disk laptop. Please note that because of WordPress limitations I need to change all &gt; &lt; characters to ] [ ones in the commands outputs.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest of the guide</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://project-trident.org/post/2019-10-05_19.10_available/\" rel=\"nofollow\">Project Trident 19.10 Now Available</a></h3>\n\n<blockquote>\n<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.10</p>\n</blockquote>\n\n<ul>\n<li>PACKAGE CHANGES FROM 19.08\n\n<ul>\n<li>New Packages: 601</li>\n<li>Deleted Packages: 165</li>\n<li>Updated Packages: 3341</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://imgur.com/gallery/0sG4b1K\" rel=\"nofollow\">NetBSD building tools</a></li>\n<li><a href=\"https://mwl.io/archives/4569\" rel=\"nofollow\">Sponsorships open for SNMP Mastery</a></li>\n<li><a href=\"http://mail-index.netbsd.org/pkgsrc-users/2019/10/03/msg029485.html\" rel=\"nofollow\">pkgsrc-2019Q3 release announcement (2019-10-03)</a></li>\n<li><a href=\"https://github.com/dylanaraps/pfetch\" rel=\"nofollow\">pfetch - A simple system information tool written in POSIX sh</a></li>\n<li><a href=\"https://netbsd.org/%7Ekamil/eurobsdcon2019_fuzzing/presentation.html#slide1\" rel=\"nofollow\">Taking NetBSD kernel bug roast to the next level: Kernel Fuzzers (quick A.D. 2019 overview)</a></li>\n<li><a href=\"https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html\" rel=\"nofollow\">Cracking Ken Thomson’s password</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Evilham - <a href=\"http://dpaste.com/2JC85WV\" rel=\"nofollow\">Couple Questions</a></li>\n<li>Rob - <a href=\"http://dpaste.com/0SDX9ZX\" rel=\"nofollow\">APU2 alternatives and GPT partition types</a></li>\n<li>Tom - <a href=\"http://dpaste.com/2B43MY1#wrap\" rel=\"nofollow\">FreeBSD journal article by A. Fengler</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0319.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Causing ZFS corruption for fun, NetBSD Assembly Programming Tutorial, The IKEA Lack Rack for Servers, a new OmniOS Community Edition LTS has been published, List Block Devices on FreeBSD lsblk(8) Style, Project Trident 19.10 available, and more.","date_published":"2019-10-09T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19c9942c-0790-4157-af73-31faf1e2b8e4.mp3","mime_type":"audio/mp3","size_in_bytes":48841583,"duration_in_seconds":4070}]},{"id":"a53fad97-5df2-4cd3-91a8-e75d5a2f38d7","title":"318: The TrueNAS Library","url":"https://www.bsdnow.tv/318","content_text":"DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.\n\nHeadlines\n\nDragonFlyBSD 5.6 vs. FreeBSD 12 vs. Linux - Ryzen 7 3700X\n\n\nFor those wondering how well FreeBSD and DragonFlyBSD are handling AMD's new Ryzen 3000 series desktop processors, here are some benchmarks on a Ryzen 7 3700X with MSI MEG X570 GODLIKE where both of these popular BSD operating systems were working out-of-the-box. For some fun mid-week benchmarking, here are those results of FreeBSD 12.0 and DragonFlyBSD 5.6.2 up against openSUSE Tumbleweed and Ubuntu 19.04.\n\nBack in July I looked at FreeBSD 12 on the Ryzen 9 3900X but at that time at least DragonFlyBSD had troubles booting on that system. When trying out the Ryzen 7 3700X + MSI GODLIKE X570 motherboard on the latest BIOS, everything \"just worked\" without any compatibility issues for either of these BSDs.\n\nWe've been eager to see how well DragonFlyBSD is performing on these new AMD Zen 2 CPUs with DragonFlyBSD lead developer Matthew Dillon having publicly expressed being impressed by the new AMD Ryzen 3000 series CPUs.\n\nFor comparison to those BSDs, Ubuntu 19.04 and openSUSE Tumbleweed were tested on the same hardware in their out-of-the-box configurations. While Clear Linux is normally the fastest, on this system Clear's power management defaults had caused issues in being unable to detect the Samsung 970 EVO Plus NVMe SSD used for testing and so we left it out this round.\n\nAll of the hardware was the same throughout testing as were the BIOS settings and running the Ryzen 7 3700X at stock speeds. (Any differences in the reported hardware for the system table just come down to differences in what is exposed by each OS for reporting.) All of the BSD/Linux benchmarks on this eight core / sixteen thread processor were run via the Phoronix Test Suite. In the case of FreeBSD 12.0, we benchmarked both with its default LLVM Clang 6.0 compiler as well as with GCC 9.1 so that it would match the GCC compiler being the default on the other operating systems under test.\n\n\n\n\nJFK Presidential Library Chooses iXsystems TrueNAS to Preserve Precious Digital Archives\n\n\niXsystems is honored to have the TrueNAS® M-Series unified storage selected to store, serve, and protect the entire digital archive for the John F. Kennedy Library Foundation. This is in support of the collection at the John F. Kennedy Presidential Library and Museum (JFK Library). Over the next several years, the Foundation hopes to grow the digital collection from hundreds of terabytes today to cover much more of the Archives at the Kennedy Library. Overall there is a total of 25 million documents, audio recordings, photos, and videos once the project is complete.\n\nHaving first deployed the TrueNAS M50-HA earlier in 2019, the JFK Library has now completed the migration of its existing digital collection and is now in the process of digitizing much of the rest of its vast collection. \n\nNot only is the catalog of material vast, it is also diverse, with files being copied to the storage system from a variety of sources in numerous file types. To achieve this ambitious goal, the library required a high-end NAS system capable of sharing with a variety of systems throughout the digitization process.  The digital archive will be served from the TrueNAS M50 and made available to both in-person and online visitors.\n\nWith precious material and information comes robust demands. The highly-available TrueNAS M-Series has multiple layers of protection to help keep data safe, including data scrubs, checksums, unlimited snapshots, replication, and more. TrueNAS is also inherently scalable with data shares only limited by the number of drives connected to the pool. Perfect for archival storage, the deployed TrueNAS M50 will grow with the library’s content, easily expanding its storage capacity over time as needed. Supporting a variety of protocols, multi-petabyte scalability in a single share, and anytime, uninterrupted capacity expansion, the TrueNAS M-Series ticked all the right boxes. \n\n\n\nYoutube Video\n\n\n\n\nNews Roundup\n\nFreeBSD 12.1-beta available\n\n\nFreeBSD 12.0 is already approaching one year old while FreeBSD 12.1 is now on the way as the next installment with various bug/security fixes and other alterations to this BSD operating system.\n\nFreeBSD 12.1 has many security/bug fixes throughout, no longer enables \"-Werror\" by default as a compiler flag (Update: This change is just for the GCC 4.2 compiler), has imported BearSSL into the FreeBSD base system as a lightweight TLS/SSL implementation, bzip2recover has been added, and a variety of mostly lower-level changes. More details can be found via the in-progress release notes.\n\nFor those with time to test this weekend, FreeBSD 12.1 Beta 1 is available for all prominent architectures.\n\nThe FreeBSD release team is planning for at least another beta or two and around three release candidates. If all goes well, FreeBSD 12.1 will be out in early November.\n\n\n\nAnnouncement Link\n\n\n\n\nCool, but obscure X11 tools.  More suggestions in the source link\n\n\nASClock\nFree42\nFSV2\nGLXGears\nGMixer\nGVIM\nMicropolis\nSunclock\nTed\nTiEmu\nX026\nX48\nXAbacus\nXAntfarm\nXArchiver\nXASCII\nXBiff\nXBill\nXBoard\nXCalc\nXCalendar\nXCHM\nXChomp\nXClipboard\nXClock\nXClock/Cat Clock\nXColorSel\nXConsole\nXDiary\nXEarth\nXEdit\nXev\nXEyes\nXFontSel\nXGalaga\nXInvaders 3D\nXKill\nXLennart\nXLoad\nXLock\nXLogo\nXMahjongg\nXMan\nXMessage\nXmGrace\nXMixer\nXmMix\nXMore\nXMosaic\nXMOTD\nXMountains\nXNeko\nXOdometer\nXOSView\nXplore\nXPostIt\nXRoach\nXScreenSaver\nXSnow\nXSpread\nXTerm\nXTide\nXv\nXvkbd\nXWPE\nXZoom\n\n\n\n\nvBSDCon 2019 trip report from iXSystems\n\n\nThe fourth biennial vBSDCon was held in Reston, VA on September 5th through 7th and attracted attendees and presenters from not only the Washington, DC area, but also Canada, Germany, Kenya, and beyond. While MeetBSD caters to Silicon Valley BSD enthusiasts on even years, vBSDcon caters to East Coast and DC area enthusiasts on odd years. Verisign was again the key sponsor of vBSDcon 2019 but this year made a conscious effort to entrust the organization of the event to a team of community members led by Dan Langille, who you probably know as the lead BSDCan organizer. The result of this shift was a low key but professional event that fostered great conversation and brainstorming at every turn.\n\n\n\n\nProject Trident 12-U7 now available\n\n\nPackage Summary\n\n\nNew Packages: 130\nDeleted Packages: 72\nUpdated Packages: 865\n\nStable ISO - https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso\n\n\n\n\nA Couple new Unix Artifacts\n\n\nI fear we're drifting a bit here and the S/N ratio is dropping a bit w.r.t the actual history of Unix. Please no more on the relative merits of version control systems or alternative text processing systems.\n\nSo I'll try to distract you by saying this. I'm sitting on two artifacts that have recently been given to me:\n\n\n\nby two large organisations\nof great significance to Unix history\nwho want me to keep \"mum\" about them\nas they are going to make announcements about them soon*\n\n\n\nand I am going slowly crazy as I wait for them to be offically released. Now you have a new topic to talk about :-)\n\nCheers, Warren\n\n\n* for some definition of \"soon\"\n\n\n\nBeastie Bits\n\n\nNetBSD machines at Open Source Conference 2019 Hiroshima\nHyperbola a GNU/Linux OS is using OpenBSD's Xenocara\nTalos is looking for a FreeBSD Engineer\nGitHub - dylanaraps/pure-sh-bible: A collection of pure POSIX sh alternatives to external processes.\ndsynth: you’re building it\nPercy Ludgate, the missing link between Babbage’s machine and everything else\n\n\n\n\nFeedback/Questions\n\n\nBruce - Down the expect rabbithole\nBruce - Expect (update)\nDavid - Netgraph answer\nMason - Beeps?\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&item=bsd-linux-3700x\" rel=\"nofollow\">DragonFlyBSD 5.6 vs. FreeBSD 12 vs. Linux - Ryzen 7 3700X</a></h3>\n\n<blockquote>\n<p>For those wondering how well FreeBSD and DragonFlyBSD are handling AMD&#39;s new Ryzen 3000 series desktop processors, here are some benchmarks on a Ryzen 7 3700X with MSI MEG X570 GODLIKE where both of these popular BSD operating systems were working out-of-the-box. For some fun mid-week benchmarking, here are those results of FreeBSD 12.0 and DragonFlyBSD 5.6.2 up against openSUSE Tumbleweed and Ubuntu 19.04.</p>\n\n<p>Back in July I looked at FreeBSD 12 on the Ryzen 9 3900X but at that time at least DragonFlyBSD had troubles booting on that system. When trying out the Ryzen 7 3700X + MSI GODLIKE X570 motherboard on the latest BIOS, everything &quot;just worked&quot; without any compatibility issues for either of these BSDs.</p>\n\n<p>We&#39;ve been eager to see how well DragonFlyBSD is performing on these new AMD Zen 2 CPUs with DragonFlyBSD lead developer Matthew Dillon having publicly expressed being impressed by the new AMD Ryzen 3000 series CPUs.</p>\n\n<p>For comparison to those BSDs, Ubuntu 19.04 and openSUSE Tumbleweed were tested on the same hardware in their out-of-the-box configurations. While Clear Linux is normally the fastest, on this system Clear&#39;s power management defaults had caused issues in being unable to detect the Samsung 970 EVO Plus NVMe SSD used for testing and so we left it out this round.</p>\n\n<p>All of the hardware was the same throughout testing as were the BIOS settings and running the Ryzen 7 3700X at stock speeds. (Any differences in the reported hardware for the system table just come down to differences in what is exposed by each OS for reporting.) All of the BSD/Linux benchmarks on this eight core / sixteen thread processor were run via the Phoronix Test Suite. In the case of FreeBSD 12.0, we benchmarked both with its default LLVM Clang 6.0 compiler as well as with GCC 9.1 so that it would match the GCC compiler being the default on the other operating systems under test.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/jfk-presidential-library-pr/\" rel=\"nofollow\">JFK Presidential Library Chooses iXsystems TrueNAS to Preserve Precious Digital Archives</a></h3>\n\n<blockquote>\n<p>iXsystems is honored to have the TrueNAS® M-Series unified storage selected to store, serve, and protect the entire digital archive for the John F. Kennedy Library Foundation. This is in support of the collection at the John F. Kennedy Presidential Library and Museum (JFK Library). Over the next several years, the Foundation hopes to grow the digital collection from hundreds of terabytes today to cover much more of the Archives at the Kennedy Library. Overall there is a total of 25 million documents, audio recordings, photos, and videos once the project is complete.</p>\n\n<p>Having first deployed the TrueNAS M50-HA earlier in 2019, the JFK Library has now completed the migration of its existing digital collection and is now in the process of digitizing much of the rest of its vast collection. </p>\n\n<p>Not only is the catalog of material vast, it is also diverse, with files being copied to the storage system from a variety of sources in numerous file types. To achieve this ambitious goal, the library required a high-end NAS system capable of sharing with a variety of systems throughout the digitization process.  The digital archive will be served from the TrueNAS M50 and made available to both in-person and online visitors.</p>\n\n<p>With precious material and information comes robust demands. The highly-available TrueNAS M-Series has multiple layers of protection to help keep data safe, including data scrubs, checksums, unlimited snapshots, replication, and more. TrueNAS is also inherently scalable with data shares only limited by the number of drives connected to the pool. Perfect for archival storage, the deployed TrueNAS M50 will grow with the library’s content, easily expanding its storage capacity over time as needed. Supporting a variety of protocols, multi-petabyte scalability in a single share, and anytime, uninterrupted capacity expansion, the TrueNAS M-Series ticked all the right boxes. </p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=8rFjH5-0Fiw\" rel=\"nofollow\">Youtube Video</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=FreeBSD-12.1-Beta-Released\" rel=\"nofollow\">FreeBSD 12.1-beta available</a></h3>\n\n<blockquote>\n<p>FreeBSD 12.0 is already approaching one year old while FreeBSD 12.1 is now on the way as the next installment with various bug/security fixes and other alterations to this BSD operating system.</p>\n\n<p>FreeBSD 12.1 has many security/bug fixes throughout, no longer enables &quot;-Werror&quot; by default as a compiler flag (Update: This change is just for the GCC 4.2 compiler), has imported BearSSL into the FreeBSD base system as a lightweight TLS/SSL implementation, bzip2recover has been added, and a variety of mostly lower-level changes. More details can be found via the in-progress release notes.</p>\n\n<p>For those with time to test this weekend, FreeBSD 12.1 Beta 1 is available for all prominent architectures.</p>\n\n<p>The FreeBSD release team is planning for at least another beta or two and around three release candidates. If all goes well, FreeBSD 12.1 will be out in early November.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2019-September/091533.html\" rel=\"nofollow\">Announcement Link</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://cyber.dabamos.de/unix/x11/\" rel=\"nofollow\">Cool, but obscure X11 tools.  More suggestions in the source link</a></h3>\n\n<ul>\n<li>ASClock</li>\n<li>Free42</li>\n<li>FSV2</li>\n<li>GLXGears</li>\n<li>GMixer</li>\n<li>GVIM</li>\n<li>Micropolis</li>\n<li>Sunclock</li>\n<li>Ted</li>\n<li>TiEmu</li>\n<li>X026</li>\n<li>X48</li>\n<li>XAbacus</li>\n<li>XAntfarm</li>\n<li>XArchiver</li>\n<li>XASCII</li>\n<li>XBiff</li>\n<li>XBill</li>\n<li>XBoard</li>\n<li>XCalc</li>\n<li>XCalendar</li>\n<li>XCHM</li>\n<li>XChomp</li>\n<li>XClipboard</li>\n<li>XClock</li>\n<li>XClock/Cat Clock</li>\n<li>XColorSel</li>\n<li>XConsole</li>\n<li>XDiary</li>\n<li>XEarth</li>\n<li>XEdit</li>\n<li>Xev</li>\n<li>XEyes</li>\n<li>XFontSel</li>\n<li>XGalaga</li>\n<li>XInvaders 3D</li>\n<li>XKill</li>\n<li>XLennart</li>\n<li>XLoad</li>\n<li>XLock</li>\n<li>XLogo</li>\n<li>XMahjongg</li>\n<li>XMan</li>\n<li>XMessage</li>\n<li>XmGrace</li>\n<li>XMixer</li>\n<li>XmMix</li>\n<li>XMore</li>\n<li>XMosaic</li>\n<li>XMOTD</li>\n<li>XMountains</li>\n<li>XNeko</li>\n<li>XOdometer</li>\n<li>XOSView</li>\n<li>Xplore</li>\n<li>XPostIt</li>\n<li>XRoach</li>\n<li>XScreenSaver</li>\n<li>XSnow</li>\n<li>XSpread</li>\n<li>XTerm</li>\n<li>XTide</li>\n<li>Xv</li>\n<li>Xvkbd</li>\n<li>XWPE</li>\n<li>XZoom</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/vbsdcon-2019/\" rel=\"nofollow\">vBSDCon 2019 trip report from iXSystems</a></h3>\n\n<blockquote>\n<p>The fourth biennial vBSDCon was held in Reston, VA on September 5th through 7th and attracted attendees and presenters from not only the Washington, DC area, but also Canada, Germany, Kenya, and beyond. While MeetBSD caters to Silicon Valley BSD enthusiasts on even years, vBSDcon caters to East Coast and DC area enthusiasts on odd years. Verisign was again the key sponsor of vBSDcon 2019 but this year made a conscious effort to entrust the organization of the event to a team of community members led by Dan Langille, who you probably know as the lead BSDCan organizer. The result of this shift was a low key but professional event that fostered great conversation and brainstorming at every turn.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://project-trident.org/post/2019-09-21_stable12-u7_available/\" rel=\"nofollow\">Project Trident 12-U7 now available</a></h3>\n\n<ul>\n<li>Package Summary\n\n<ul>\n<li>New Packages: 130</li>\n<li>Deleted Packages: 72</li>\n<li>Updated Packages: 865</li>\n</ul></li>\n<li>Stable ISO - <a href=\"https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso\" rel=\"nofollow\">https://pkg.project-trident.org/iso/stable/Trident-x64-TOS-12-U7-20190920.iso</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://minnie.tuhs.org//pipermail/tuhs/2019-September/018685.html\" rel=\"nofollow\">A Couple new Unix Artifacts</a></h3>\n\n<blockquote>\n<p>I fear we&#39;re drifting a bit here and the S/N ratio is dropping a bit w.r.t the actual history of Unix. Please no more on the relative merits of version control systems or alternative text processing systems.</p>\n\n<p>So I&#39;ll try to distract you by saying this. I&#39;m sitting on two artifacts that have recently been given to me:</p>\n</blockquote>\n\n<ul>\n<li>by two large organisations</li>\n<li>of great significance to Unix history</li>\n<li>who want me to keep &quot;mum&quot; about them</li>\n<li>as they are going to make announcements about them soon*</li>\n</ul>\n\n<blockquote>\n<p>and I am going slowly crazy as I wait for them to be offically released. Now you have a new topic to talk about :-)</p>\n\n<p>Cheers, Warren</p>\n</blockquote>\n\n<p>* <em>for some definition of &quot;soon&quot;</em></p>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://mail-index.netbsd.org/netbsd-advocacy/2019/09/16/msg000813.html\" rel=\"nofollow\">NetBSD machines at Open Source Conference 2019 Hiroshima</a></li>\n<li><a href=\"https://www.hyperbola.info/news/end-of-xorg-support/\" rel=\"nofollow\">Hyperbola a GNU/Linux OS is using OpenBSD&#39;s Xenocara</a></li>\n<li><a href=\"https://www.talosintelligence.com/careers/freebsd_engineer\" rel=\"nofollow\">Talos is looking for a FreeBSD Engineer</a></li>\n<li><a href=\"https://github.com/dylanaraps/pure-sh-bible\" rel=\"nofollow\">GitHub - dylanaraps/pure-sh-bible: A collection of pure POSIX sh alternatives to external processes.</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/09/23/23523.html\" rel=\"nofollow\">dsynth: you’re building it</a></li>\n<li><a href=\"http://lists.sigcis.org/pipermail/members-sigcis.org/2019-September/001606.html\" rel=\"nofollow\">Percy Ludgate, the missing link between Babbage’s machine and everything else</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Bruce - <a href=\"http://dpaste.com/147HGP3#wrap\" rel=\"nofollow\">Down the expect rabbithole</a></li>\n<li>Bruce - <a href=\"http://dpaste.com/37MNVSW#wrap\" rel=\"nofollow\">Expect (update)</a></li>\n<li>David - <a href=\"http://dpaste.com/2SE1YSE\" rel=\"nofollow\">Netgraph answer</a></li>\n<li>Mason - <a href=\"http://dpaste.com/00KKXJM\" rel=\"nofollow\">Beeps?</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0318.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"DragonFlyBSD vs. FreeBSD vs. Linux benchmark on Ryzen 7, JFK Presidential Library chooses TrueNAS for digital archives, FreeBSD 12.1-beta is available, cool but obscure X11 tools, vBSDcon trip report, Project Trident 12-U7 is available, a couple new Unix artifacts, and more.","date_published":"2019-10-02T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a53fad97-5df2-4cd3-91a8-e75d5a2f38d7.mp3","mime_type":"audio/mp3","size_in_bytes":33605404,"duration_in_seconds":2800}]},{"id":"e26d9711-a9ef-433e-bf8e-90d57030f3e7","title":"317: Bots Building Jails","url":"https://www.bsdnow.tv/317","content_text":"Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD's HAMMER2 gets fsck, return of startx for users.\n\nHeadlines\n\nEuroBSDcon 2019 Recap\n\n\nWe’re back from EuroBSDcon in Lillehammer, Norway. It was a great conference with 212 people attending. 2 days of tutorials, parallel to the FreeBSD Devsummit, followed by two days of talks. Some speakers uploaded their slides to papers.freebsd.org already with more to come.\n\nThe social event was also interesting. We visited an open air museum with building preserved from different time periods. In the older section they had a collection of farm buildings, a church originally built in the 1200s and relocated to the museum, and a school house. In the more modern area, they had houses from 1915, and each decade from 1930 to 1990, plus a “house of the future” as imagined in 2001. Many had open doors to allow you to tour the inside, and some were even “inhabited”. The latter fact gave a much more interactive experience and we could learn additional things about the history of that particular house. The town at the end included a general store, a post office, and more. Then, we all had a nice dinner together in the museum’s restaurant.\n\n\n\nThe opening keynote by Patricia Aas was very good. Her talk on embedded ethics, from her perspective as someone trying to defend the sanctity of Norwegian elections, and a former developer for the Opera web browser, provided a great deal of insight into the issues. Her points about how the tech community has unleashed a very complex digital work upon people with barely any technical literacy were well taken. Her stories of trying to explain the problems with involving computers in the election process to journalists and politicians struck a chord with many of us, who have had to deal with legislation written by those who do not truly understand the issues with technology.\n\n\n\n\nSetting up buildbot in FreeBSD jails\n\n\nIn this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism \"jails\". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.\n\n\n\n\nSetting up a mail server with OpenSMTPD, Dovecot and Rspamd\n\n\nSelf-hosting and encouraging smaller providers is for the greater good\n\n\n\nFirst of all, I was not clear enough about the political consequences of centralizing mail services at Big Mailer Corps.\n\nIt doesn’t make sense for Random Joe, sharing kitten pictures with his family and friends, to build a personal mail infrastructure when multiple Big Mailer Corps offer “for free” an amazing quality of service. They provide him with an e-mail address that is immediately available and which will generally work reliably. It really doesn’t make sense for Random Joe not to go there, and particularly if even techies go there without hesitation, proving it is a sound choice.\n\nThere is nothing wrong with Random Joes using a service that works.\n\nWhat is terribly wrong though is the centralization of a communication protocol in the hands of a few commercial companies, EVERY SINGLE ONE OF THEM coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD), EVERY SINGLE ONE OF THEM having been in the news and/or in a court for random/assorted “unpleasant” behaviors (privacy abuses, eavesdropping, monopoly abuse, sexual or professional harassment, you just name it…), and EVERY SINGLE ONE OF THEM growing user bases that far exceeds the total population of multiple countries combined.\n\n\n\n\nNews Roundup\n\nThe HamBSD project aims to bring amateur packet radio to OpenBSD\n\n\nThe HamBSD project aims to bring amateur packet radio to OpenBSD, including support for TCP/IP over AX.25 and APRS tracking/digipeating in the base system.\n\nHamBSD will not provide a full AX.25 stack but instead only implement support for UI frames. There will be a focus on simplicity, security and readable code.\n\nThe amateur radio community needs a reliable platform for packet radio for use in both leisure and emergency scenarios. It should be expected that the system is stable and resilient (but as yet it is neither).\n\n\n\n\nDragonFlyBSD's HAMMER2 Gets Basic FSCK Support\n\n\nHAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there’s now a fsck command, useful if you want a report of data validity rather than any manual repair process.\n\n\n\ncommit\n\n\n\nAdd initial fsck support for HAMMER2, although CoW fs doesn't require fsck as a concept. Currently no repairing (no write), just verifying. \n\nKeep this as a separate command for now.\nhttps://i.redd.it/vkdss0mtdpo31.jpg\n\n\n\n\nThe return of startx for users\n\n\nAdd modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.\n\nThis makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).\n\n\n\n\nBeastie Bits\n\n\nOri Bernstein will be giving the October talk at NYCBUG\nBSD Pizza Night: 2019/09/26, 7–9PM, Portland, Oregon, USA\nNick Wolff : Home Lab Show &amp; Tell\nInstalling the Lumina Desktop in DragonflyBSD\ndhcpcd 8.0.6 added\n\n\n\n\nFeedback/Questions\n\n\nBruce - FOSDEM videos\nLars - Super Cluster of BSD on Rock64Pr\nMadhukar - Question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD&#39;s HAMMER2 gets fsck, return of startx for users.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://2019.eurobsdcon.org/\" rel=\"nofollow\">EuroBSDcon 2019 Recap</a></h3>\n\n<blockquote>\n<p>We’re back from EuroBSDcon in Lillehammer, Norway. It was a great conference with 212 people attending. 2 days of <a href=\"https://2019.eurobsdcon.org/tutorial-speakers/\" rel=\"nofollow\">tutorials</a>, parallel to the <a href=\"https://wiki.freebsd.org/DevSummit/201909\" rel=\"nofollow\">FreeBSD Devsummit</a>, followed by two days of <a href=\"https://2019.eurobsdcon.org/program/\" rel=\"nofollow\">talks</a>. Some speakers uploaded their slides to <a href=\"https://papers.freebsd.org/2019/eurobsdcon/\" rel=\"nofollow\">papers.freebsd.org</a> already with more to come.</p>\n\n<p>The social event was also interesting. We visited an open air museum with building preserved from different time periods. In the older section they had a collection of farm buildings, a church originally built in the 1200s and relocated to the museum, and a school house. In the more modern area, they had houses from 1915, and each decade from 1930 to 1990, plus a “house of the future” as imagined in 2001. Many had open doors to allow you to tour the inside, and some were even “inhabited”. The latter fact gave a much more interactive experience and we could learn additional things about the history of that particular house. The town at the end included a general store, a post office, and more. Then, we all had a nice dinner together in the museum’s restaurant.</p>\n</blockquote>\n\n<ul>\n<li>The opening keynote by Patricia Aas was very good. Her talk on embedded ethics, from her perspective as someone trying to defend the sanctity of Norwegian elections, and a former developer for the Opera web browser, provided a great deal of insight into the issues. Her points about how the tech community has unleashed a very complex digital work upon people with barely any technical literacy were well taken. Her stories of trying to explain the problems with involving computers in the election process to journalists and politicians struck a chord with many of us, who have had to deal with legislation written by those who do not truly understand the issues with technology.</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails\" rel=\"nofollow\">Setting up buildbot in FreeBSD jails</a></h3>\n\n<blockquote>\n<p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism &quot;jails&quot;. We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/\" rel=\"nofollow\">Setting up a mail server with OpenSMTPD, Dovecot and Rspamd</a></h3>\n\n<ul>\n<li>Self-hosting and encouraging smaller providers is for the greater good</li>\n</ul>\n\n<blockquote>\n<p>First of all, I was not clear enough about the political consequences of centralizing mail services at Big Mailer Corps.</p>\n\n<p>It doesn’t make sense for Random Joe, sharing kitten pictures with his family and friends, to build a personal mail infrastructure when multiple Big Mailer Corps offer “for free” an amazing quality of service. They provide him with an e-mail address that is immediately available and which will generally work reliably. It really doesn’t make sense for Random Joe not to go there, and particularly if even techies go there without hesitation, proving it is a sound choice.</p>\n\n<p>There is nothing wrong with Random Joes using a service that works.</p>\n\n<p>What is terribly wrong though is the centralization of a communication protocol in the hands of a few commercial companies, EVERY SINGLE ONE OF THEM coming from the same country (currently led by a lunatic who abuses power and probably suffers from NPD), EVERY SINGLE ONE OF THEM having been in the news and/or in a court for random/assorted “unpleasant” behaviors (privacy abuses, eavesdropping, monopoly abuse, sexual or professional harassment, you just name it…), and EVERY SINGLE ONE OF THEM growing user bases that far exceeds the total population of multiple countries combined.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://hambsd.org/\" rel=\"nofollow\">The HamBSD project aims to bring amateur packet radio to OpenBSD</a></h3>\n\n<blockquote>\n<p>The HamBSD project aims to bring amateur packet radio to OpenBSD, including support for TCP/IP over AX.25 and APRS tracking/digipeating in the base system.</p>\n\n<p>HamBSD will not provide a full AX.25 stack but instead only implement support for UI frames. There will be a focus on simplicity, security and readable code.</p>\n\n<p>The amateur radio community needs a reliable platform for packet radio for use in both leisure and emergency scenarios. It should be expected that the system is stable and resilient (but as yet it is neither).</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/09/24/23540.html\" rel=\"nofollow\">DragonFlyBSD&#39;s HAMMER2 Gets Basic FSCK Support</a></h3>\n\n<blockquote>\n<p>HAMMER2 is Copy on Write, meaning changes are made to copies of existing data.  This means operations are generally atomic and can survive a power outage, etc.  (You should read up on it!)  However, there’s now a fsck command, useful if you want a report of data validity rather than any manual repair process.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/5554cc8b81fbfcfd347f50be3f3b1b9a54b871b\" rel=\"nofollow\">commit</a></li>\n</ul>\n\n<blockquote>\n<p>Add initial fsck support for HAMMER2, although CoW fs doesn&#39;t require fsck as a concept. Currently no repairing (no write), just verifying. </p>\n\n<p>Keep this as a separate command for now.<br>\n<a href=\"https://i.redd.it/vkdss0mtdpo31.jpg\" rel=\"nofollow\">https://i.redd.it/vkdss0mtdpo31.jpg</a></p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"http://undeadly.org/cgi?action=article;sid=20190917091236\" rel=\"nofollow\">The return of startx for users</a></h3>\n\n<blockquote>\n<p>Add modesetting driver as a fall-back when appropriate such that we can use it when running without root privileges which prevents us from scanning the PCI bus.</p>\n\n<p>This makes startx(1)/xinit(1) work again on modern systems with inteldrm(4), radeondrm(4) and amdgpu(4).  In some cases this will result in using a different driver than with xenodm(4) which may expose issues (e.g. when we prefer the intel Xorg driver) or loss of acceleration (e.g. older cards supported by radeondrm(4)).</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.nycbug.org:8080/pipermail/talk/2019-September/018046.html\" rel=\"nofollow\">Ori Bernstein will be giving the October talk at NYCBUG</a></li>\n<li><a href=\"http://calagator.org/events/1250476200\" rel=\"nofollow\">BSD Pizza Night: 2019/09/26, 7–9PM, Portland, Oregon, USA</a></li>\n<li><a href=\"http://knoxbug.org/2019-09-30\" rel=\"nofollow\">Nick Wolff : Home Lab Show &amp; Tell</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=eWkCjj4_xsk\" rel=\"nofollow\">Installing the Lumina Desktop in DragonflyBSD</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/09/20/23519.html\" rel=\"nofollow\">dhcpcd 8.0.6 added</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Bruce - <a href=\"http://dpaste.com/15ABRRB#wrap\" rel=\"nofollow\">FOSDEM videos</a></li>\n<li>Lars - <a href=\"http://dpaste.com/1X9FEJJ\" rel=\"nofollow\">Super Cluster of BSD on Rock64Pr</a></li>\n<li>Madhukar - <a href=\"http://dpaste.com/0TWF1NB#wrap\" rel=\"nofollow\">Question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0317.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Setting up buildbot in FreeBSD jails, Set up a mail server with OpenSMTPD, Dovecot and Rspamd, OpenBSD amateur packet radio with HamBSD, DragonFlyBSD's HAMMER2 gets fsck, return of startx for users.","date_published":"2019-09-26T02:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e26d9711-a9ef-433e-bf8e-90d57030f3e7.mp3","mime_type":"audio/mp3","size_in_bytes":37879559,"duration_in_seconds":3156}]},{"id":"c6ea44fd-cbae-453a-bd88-a35b2b662859","title":"316: git commit FreeBSD","url":"https://www.bsdnow.tv/316","content_text":"NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.\n\nHeadlines\n\nLLVM santizers and GDB regression test suite.\n\n\nAs NetBSD-9 is branched, I have been asked to finish the LLVM sanitizer integration. This work is now accomplished and with MKLLVM=yes build option (by default off), the distribution will be populated with LLVM files for ASan, TSan, MSan, UBSan, libFuzzer, SafeStack and XRay.\n\nI have also transplanted basesystem GDB patched to my GDB repository and managed to run the GDB regression test-suite.\n\n\n\nNetBSD distribution changes\n\n\n\nI have enhanced and imported my local MKSANITIZER code that makes whole distribution sanitization possible. Few real bugs were fixed and a number of patches were newly written to reflect the current NetBSD sources state. I have also merged another chunk of the fruits of the GSoC-2018 project with fuzzing the userland (by plusun@).\n\n\n\nThe following changes were committed to the sources:\n\n\nab7de18d0283 Cherry-pick upstream compiler-rt patches for LLVM sanitizers\n966c62a34e30 Add LLVM sanitizers in the MKLLVM=yes build\n8367b667adb9 telnetd: Stop defining the same variables concurrently in bss and data\nfe72740f64bf fsck: Stop defining the same variable concurrently in bss and data\n40e89e890d66 Fix build of t_ubsan/t_ubsanxx under MKSANITIZER\nb71326fd7b67 Avoid symbol clashes in tests/usr.bin/id under MKSANITIZER\nc581f2e39fa5 Avoid symbol clashes in fs/nfs/nfsservice under MKSANITIZER\n030a4686a3c6 Avoid symbol clashes in bin/df under MKSANITIZER\nfd9679f6e8b1 Avoid symbol clashes in usr.sbin/ypserv/ypserv under MKSANITIZER\n5df2d7939ce3 Stop defining _rpcsvcdirty in bss and data\n5fafbe8b8f64 Add missing extern declaration of ib_mach_emips in installboot\nd134584be69a Add SANITIZER_RENAME_CLASSES in bsd.prog.mk\n2d00d9b08eae Adapt tests/kernel/t_subr_prf for MKSANITIZER\nce54363fe452 Ship with sanitizer/lsan_interface.h for GCC 7\n7bd5ee95e9a0 Ship with sanitizer/lsan_interface.h for LLVM 7\nd8671fba7a78 Set NODEBUG for LLVM sanitizers\n242cd44890a2 Add PAXCTL_FLAG rules for MKSANITIZER\n5e80ab99d9ce Avoid symbol clashes in test/rump/modautoload/t_modautoload with sanitizers\ne7ce7ecd9c2a sysctl: Add indirection of symbols to remove clash with sanitizers\n231aea846aba traceroute: Add indirection of symbol to remove clash with sanitizers\n8d85053f487c sockstat: Add indirection of symbols to remove clash with sanitizers\n81b333ab151a netstat: Add indirection of symbols to remove clash with sanitizers\na472baefefe8 Correct the memset(3)'s third argument in i386 biosdisk.c\n7e4e92115bc3 Add ATF c and c++ tests for TSan, MSan, libFuzzer\n921ddc9bc97c Set NOSANITIZER in i386 ramdisk image\n64361771c78d Enhance MKSANITIZER support\n3b5608f80a2b Define target_not_supported_body() in TSan, MSan and libFuzzer tests\nc27f4619d513 Avoids signedness bit shift in db_get_value()\n680c5b3cc24f Fix LLVM sanitizer build by GCC (HAVE_LLVM=no)\n4ecfbbba2f2a Rework the LLVM compiler_rt build rules\n748813da5547 Correct the build rules of LLVM sanitizers\n20e223156dee Enhance the support of LLVM sanitizers\n0bb38eb2f20d Register syms.extra in LLVM sanitizer .syms files\nAlmost all of the mentioned commits were backported to NetBSD-9 and will land 9.0.\n\n\n\n\n\nHomura - a Windows Games Launcher for FreeBSD\n\n\nInspired by lutris (a Linux gaming platform), we would like to provide a game launcher to play windows games on FreeBSD.\n\n\n\nMakes it easier to run games on FreeBSD, by providing the tweaks and dependencies for you\nDependencies\n\n\ncurl\nbash\np7zip\nzenity\nwebfonts\nalsa-utils (Optional)\nwinetricks\nvulkan-tools\nmesa-demos\ni386-wine-devel on amd64 or wine-devel on i386\n\n\n\n\n\nNews Roundup\n\nAda—The Language of Cost Savings?\n\n\nMany myths surround the Ada programming language, but it continues to be used and evolve at the same time. And while the increased adoption of Ada and SPARK, its provable subset, is slow, it’s noticeable. Ada already addresses more of the features found in found in heavily used embedded languages like C+ and C#. It also tackles problems addressed by upcoming languages like Rust.\n\nChris concludes, “Development technologies have a profound impact on one of the largest and most variable costs associated with embedded-system engineering—labor. At a time when on-time system deployment can not only impact customer satisfaction, but access to services revenue streams, engineering team efficiency is at a premium. Our research showed that programming language choices can have significant influence in this area, leading to shorter projects, better schedules and, ultimately, lower development costs. While a variety of factors can influence and dictate language choice, our research showed that Ada’s evolution has made it an increasingly compelling option for engineering organizations, providing both technically and financially sound solution.”\n\nIn general, Ada already makes embedded “programming in the large” much easier by handling issues that aren’t even addressed in other languages. Though these features are often provided by third-party software, it results in inconsistent practices among developers. Ada also supports the gamut of embedded platforms from systems like Arm’s Cortex-M through supercomputers. Learning Ada isn’t as hard as one might think and the benefits can be significant.\n\n\n\n\nFreeBSD core team appoints a WG to explore transitioning from Subversion to Git.\n\n\nThe FreeBSD Core Team is the governing body of FreeBSD.\n\n\n\nCore approved source commit bits for Doug Moore (dougm), Chuck Silvers (chs), Brandon Bergren (bdragon), and a vendor commit bit for Scott Phillips (scottph).\n\nThe annual developer survey closed on 2019-04-02. Of the 397 developers, 243 took the survey with an average completion time of 12 minutes. The public survey closed on 2019-05-13. It was taken by 3637 users and had a 79% completion rate. A presentation of the survey results took place at BSDCan 2019.\n\nThe core team voted to appoint a working group to explore transitioning our source code 'source of truth' from Subversion to Git. Core asked Ed Maste to chair the group as Ed has been researching this topic for some time. For example, Ed gave a MeetBSD 2018 talk on the topic.\n\nThere is a variety of viewpoints within core regarding where and how to host a Git repository, however core feels that Git is the prudent path forward.\n\n\n\n\nOpenBSD 6.6 Beta tagged\n\nCVSROOT:    /cvs\nModule name:    src\nChanges by:    deraadt@cvs.openbsd.org    2019/08/09 21:56:02\n\nModified files:\n    etc/root : root.mail\n    share/mk : sys.mk\n    sys/arch/macppc/stand/tbxidata: bsd.tbxi\n    sys/conf : newvers.sh\n    sys/sys : param.h\n    usr.bin/signify: signify.1\n\nLog message:\nmove to 6.6-beta\n\n\nPreliminary release notes\n\nImproved hardware support, including:\n\n\nclang(1) is now provided on powerpc.\nIEEE 802.11 wireless stack improvements:\nGeneric network stack improvements:\nInstaller improvements:\nSecurity improvements:\n  + Routing daemons and other userland network improvements\n  + The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.\n  + bgdp(8) improvements\n  + Assorted improvements:\n  + The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.\nThe BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See ber_read_elements(3).\nSupport for specifying boot device in vm.conf(5).\nOpenSMTPD 6.6.0\nLibreSSL 3.0.X\nAPI and Documentation Enhancements\nCompleted the port of RSA_METHOD accessors from the OpenSSL 1.1 API.\nDocumented undescribed options and removed unfunctional options description in openssl(1) manual.\nOpenSSH 8.0\n\n\n\n\nProject Trident 12-U5 update now available\n\n\nThis is the fifth general package update to the STABLE release repository based upon TrueOS 12-Stable.\n\n\n\nPackage changes from Stable 12-U4\nPackage Summary\n\n\nNew Packages: 20\nDeleted Packages: 24\nUpdated Packages: 279\n\nNew Packages (20)\n\n\nartemis (biology/artemis) : 17.0.1.11\ncatesc (games/catesc) : 0.6\ndmlc-core (devel/dmlc-core) : 0.3.105\ngo-wtf (sysutils/go-wtf) : 0.20.0_1\ninstead (games/instead) : 3.3.0_1\nlidarr (net-p2p/lidarr) : 0.6.2.883\nminerbold (games/minerbold) : 1.4\nonnx (math/onnx) : 1.5.0\nopenzwave-devel (comms/openzwave-devel) : 1.6.897\npolkit-qt-1 (sysutils/polkit-qt) : 0.113.0_8\npy36-traitsui (graphics/py-traitsui) : 6.1.2\nrubygem-aws-sigv2 (devel/rubygem-aws-sigv2) : 1.0.1\nrubygem-default_value_for32 (devel/rubygem-default_value_for32) : 3.2.0\nrubygem-ffi110 (devel/rubygem-ffi110) : 1.10.0\nrubygem-zeitwerk (devel/rubygem-zeitwerk) : 2.1.9\nsems (net/sems) : 1.7.0.g20190822\nskypat (devel/skypat) : 3.1.1\ntvm (math/tvm) : 0.4.1440\nvavoom (games/vavoom) : 1.33_15\nvavoom-extras (games/vavoom-extras) : 1.30_4\n\nDeleted Packages (24)\n\n\ngeeqie (graphics/geeqie) : Unknown reason\niriverter (multimedia/iriverter) : Unknown reason\nkde5 (x11/kde5) : Unknown reason\nkicad-doc (cad/kicad-doc) : Unknown reason\nos-nozfs-buildworld (os/buildworld) : Unknown reason\nos-nozfs-userland (os/userland) : Unknown reason\nos-nozfs-userland-base (os/userland-base) : Unknown reason\nos-nozfs-userland-base-bootstrap (os/userland-base-bootstrap) : Unknown reason\nos-nozfs-userland-bin (os/userland-bin) : Unknown reason\nos-nozfs-userland-boot (os/userland-boot) : Unknown reason\nos-nozfs-userland-conf (os/userland-conf) : Unknown reason\nos-nozfs-userland-debug (os/userland-debug) : Unknown reason\nos-nozfs-userland-devtools (os/userland-devtools) : Unknown reason\nos-nozfs-userland-docs (os/userland-docs) : Unknown reason\nos-nozfs-userland-lib (os/userland-lib) : Unknown reason\nos-nozfs-userland-lib32 (os/userland-lib32) : Unknown reason\nos-nozfs-userland-lib32-development (os/userland-lib32-development) : Unknown reason\nos-nozfs-userland-rescue (os/userland-rescue) : Unknown reason\nos-nozfs-userland-sbin (os/userland-sbin) : Unknown reason\nos-nozfs-userland-tests (os/userland-tests) : Unknown reason\nphotoprint (print/photoprint) : Unknown reason\nplasma5-plasma (x11/plasma5-plasma) : Unknown reason\npolkit-qt5 (sysutils/polkit-qt) : Unknown reason\nsecpanel (security/secpanel) : Unknown reason\n\n\n\n\n\nBeastie Bits\n\n\nDragonFlyBSD - msdosfs updates\nStand out as a speaker\nNot a review of the 7th Gen X1 Carbon\nFreeBSD Meets Linux At The Open Source Summit\nQEMU VM Escape\nPorting wine to amd64 on NetBSD, third evaluation report.\nOpenBSD disabled DoH by default in Firefox\n\n\n\n\nFeedback/Questions\n\n\nReinis - GELI with UEFI\nMason - Beeping\n\n\n[CHVT feedback]\nDJ - Feedback\nBen - chvt\nHarri - Marc's chvt question\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/llvm_santizers_and_gdb_regression\" rel=\"nofollow\">LLVM santizers and GDB regression test suite.</a></h3>\n\n<blockquote>\n<p>As NetBSD-9 is branched, I have been asked to finish the LLVM sanitizer integration. This work is now accomplished and with MKLLVM=yes build option (by default off), the distribution will be populated with LLVM files for ASan, TSan, MSan, UBSan, libFuzzer, SafeStack and XRay.</p>\n\n<p>I have also transplanted basesystem GDB patched to my GDB repository and managed to run the GDB regression test-suite.</p>\n</blockquote>\n\n<ul>\n<li>NetBSD distribution changes</li>\n</ul>\n\n<blockquote>\n<p>I have enhanced and imported my local MKSANITIZER code that makes whole distribution sanitization possible. Few real bugs were fixed and a number of patches were newly written to reflect the current NetBSD sources state. I have also merged another chunk of the fruits of the GSoC-2018 project with fuzzing the userland (by plusun@).</p>\n</blockquote>\n\n<ul>\n<li>The following changes were committed to the sources:\n\n<ul>\n<li>ab7de18d0283 Cherry-pick upstream compiler-rt patches for LLVM sanitizers</li>\n<li>966c62a34e30 Add LLVM sanitizers in the MKLLVM=yes build</li>\n<li>8367b667adb9 telnetd: Stop defining the same variables concurrently in bss and data</li>\n<li>fe72740f64bf fsck: Stop defining the same variable concurrently in bss and data</li>\n<li>40e89e890d66 Fix build of t_ubsan/t_ubsanxx under MKSANITIZER</li>\n<li>b71326fd7b67 Avoid symbol clashes in tests/usr.bin/id under MKSANITIZER</li>\n<li>c581f2e39fa5 Avoid symbol clashes in fs/nfs/nfsservice under MKSANITIZER</li>\n<li>030a4686a3c6 Avoid symbol clashes in bin/df under MKSANITIZER</li>\n<li>fd9679f6e8b1 Avoid symbol clashes in usr.sbin/ypserv/ypserv under MKSANITIZER</li>\n<li>5df2d7939ce3 Stop defining _rpcsvcdirty in bss and data</li>\n<li>5fafbe8b8f64 Add missing extern declaration of ib_mach_emips in installboot</li>\n<li>d134584be69a Add SANITIZER_RENAME_CLASSES in bsd.prog.mk</li>\n<li>2d00d9b08eae Adapt tests/kernel/t_subr_prf for MKSANITIZER</li>\n<li>ce54363fe452 Ship with sanitizer/lsan_interface.h for GCC 7</li>\n<li>7bd5ee95e9a0 Ship with sanitizer/lsan_interface.h for LLVM 7</li>\n<li>d8671fba7a78 Set NODEBUG for LLVM sanitizers</li>\n<li>242cd44890a2 Add PAXCTL_FLAG rules for MKSANITIZER</li>\n<li>5e80ab99d9ce Avoid symbol clashes in test/rump/modautoload/t_modautoload with sanitizers</li>\n<li>e7ce7ecd9c2a sysctl: Add indirection of symbols to remove clash with sanitizers</li>\n<li>231aea846aba traceroute: Add indirection of symbol to remove clash with sanitizers</li>\n<li>8d85053f487c sockstat: Add indirection of symbols to remove clash with sanitizers</li>\n<li>81b333ab151a netstat: Add indirection of symbols to remove clash with sanitizers</li>\n<li>a472baefefe8 Correct the memset(3)&#39;s third argument in i386 biosdisk.c</li>\n<li>7e4e92115bc3 Add ATF c and c++ tests for TSan, MSan, libFuzzer</li>\n<li>921ddc9bc97c Set NOSANITIZER in i386 ramdisk image</li>\n<li>64361771c78d Enhance MKSANITIZER support</li>\n<li>3b5608f80a2b Define target_not_supported_body() in TSan, MSan and libFuzzer tests</li>\n<li>c27f4619d513 Avoids signedness bit shift in db_get_value()</li>\n<li>680c5b3cc24f Fix LLVM sanitizer build by GCC (HAVE_LLVM=no)</li>\n<li>4ecfbbba2f2a Rework the LLVM compiler_rt build rules</li>\n<li>748813da5547 Correct the build rules of LLVM sanitizers</li>\n<li>20e223156dee Enhance the support of LLVM sanitizers</li>\n<li>0bb38eb2f20d Register syms.extra in LLVM sanitizer .syms files</li>\n<li>Almost all of the mentioned commits were backported to NetBSD-9 and will land 9.0.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://github.com/Alexander88207/Homura\" rel=\"nofollow\">Homura - a Windows Games Launcher for FreeBSD</a></h3>\n\n<blockquote>\n<p>Inspired by lutris (a Linux gaming platform), we would like to provide a game launcher to play windows games on FreeBSD.</p>\n</blockquote>\n\n<ul>\n<li>Makes it easier to run games on FreeBSD, by providing the tweaks and dependencies for you</li>\n<li>Dependencies\n\n<ul>\n<li>curl</li>\n<li>bash</li>\n<li>p7zip</li>\n<li>zenity</li>\n<li>webfonts</li>\n<li>alsa-utils (Optional)</li>\n<li>winetricks</li>\n<li>vulkan-tools</li>\n<li>mesa-demos</li>\n<li>i386-wine-devel on amd64 or wine-devel on i386</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://www.electronicdesign.com/embedded-revolution/ada-language-cost-savings\" rel=\"nofollow\">Ada—The Language of Cost Savings?</a></h3>\n\n<blockquote>\n<p>Many myths surround the Ada programming language, but it continues to be used and evolve at the same time. And while the increased adoption of Ada and SPARK, its provable subset, is slow, it’s noticeable. Ada already addresses more of the features found in found in heavily used embedded languages like C+ and C#. It also tackles problems addressed by upcoming languages like Rust.</p>\n\n<p>Chris concludes, “Development technologies have a profound impact on one of the largest and most variable costs associated with embedded-system engineering—labor. At a time when on-time system deployment can not only impact customer satisfaction, but access to services revenue streams, engineering team efficiency is at a premium. Our research showed that programming language choices can have significant influence in this area, leading to shorter projects, better schedules and, ultimately, lower development costs. While a variety of factors can influence and dictate language choice, our research showed that Ada’s evolution has made it an increasingly compelling option for engineering organizations, providing both technically and financially sound solution.”</p>\n\n<p>In general, Ada already makes embedded “programming in the large” much easier by handling issues that aren’t even addressed in other languages. Though these features are often provided by third-party software, it results in inconsistent practices among developers. Ada also supports the gamut of embedded platforms from systems like Arm’s Cortex-M through supercomputers. Learning Ada isn’t as hard as one might think and the benefits can be significant.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2019-04-2019-06.html#FreeBSD-Core-Team\" rel=\"nofollow\">FreeBSD core team appoints a WG to explore transitioning from Subversion to Git.</a></h3>\n\n<ul>\n<li>The FreeBSD Core Team is the governing body of FreeBSD.</li>\n</ul>\n\n<blockquote>\n<p>Core approved source commit bits for Doug Moore (dougm), Chuck Silvers (chs), Brandon Bergren (bdragon), and a vendor commit bit for Scott Phillips (scottph).</p>\n\n<p>The annual developer survey closed on 2019-04-02. Of the 397 developers, 243 took the survey with an average completion time of 12 minutes. The public survey closed on 2019-05-13. It was taken by 3637 users and had a 79% completion rate. A presentation of the survey results took place at BSDCan 2019.</p>\n\n<p>The core team voted to appoint a working group to explore transitioning our source code &#39;source of truth&#39; from Subversion to Git. Core asked Ed Maste to chair the group as Ed has been researching this topic for some time. For example, Ed gave a MeetBSD 2018 talk on the topic.</p>\n\n<p>There is a variety of viewpoints within core regarding where and how to host a Git repository, however core feels that Git is the prudent path forward.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20190810123243\" rel=\"nofollow\">OpenBSD 6.6 Beta tagged</a></h3>\n\n<pre><code>CVSROOT:    /cvs\nModule name:    src\nChanges by:    deraadt@cvs.openbsd.org    2019/08/09 21:56:02\n\nModified files:\n    etc/root : root.mail\n    share/mk : sys.mk\n    sys/arch/macppc/stand/tbxidata: bsd.tbxi\n    sys/conf : newvers.sh\n    sys/sys : param.h\n    usr.bin/signify: signify.1\n\nLog message:\nmove to 6.6-beta\n</code></pre>\n\n<p><a href=\"https://www.openbsd.org/66.html\" rel=\"nofollow\">Preliminary release notes</a></p>\n\n<p>Improved hardware support, including:</p>\n\n<ul>\n<li>clang(1) is now provided on powerpc.</li>\n<li>IEEE 802.11 wireless stack improvements:</li>\n<li>Generic network stack improvements:</li>\n<li>Installer improvements:</li>\n<li>Security improvements:</li>\n<li>  + Routing daemons and other userland network improvements</li>\n<li>  + The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.</li>\n<li>  + bgdp(8) improvements</li>\n<li>  + Assorted improvements:</li>\n<li>  + The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.</li>\n<li>The BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See ber_read_elements(3).</li>\n<li>Support for specifying boot device in vm.conf(5).</li>\n<li>OpenSMTPD 6.6.0</li>\n<li>LibreSSL 3.0.X</li>\n<li>API and Documentation Enhancements</li>\n<li>Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API.</li>\n<li>Documented undescribed options and removed unfunctional options description in openssl(1) manual.</li>\n<li>OpenSSH 8.0</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://project-trident.org/post/2019-09-04_stable12-u5_available/\" rel=\"nofollow\">Project Trident 12-U5 update now available</a></h3>\n\n<blockquote>\n<p>This is the fifth general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>\n</blockquote>\n\n<ul>\n<li>Package changes from Stable 12-U4</li>\n<li><p>Package Summary</p>\n\n<ul>\n<li>New Packages: 20</li>\n<li>Deleted Packages: 24</li>\n<li>Updated Packages: 279</li>\n</ul></li>\n<li><p>New Packages (20)</p>\n\n<ul>\n<li>artemis (biology/artemis) : 17.0.1.11</li>\n<li>catesc (games/catesc) : 0.6</li>\n<li>dmlc-core (devel/dmlc-core) : 0.3.105</li>\n<li>go-wtf (sysutils/go-wtf) : 0.20.0_1</li>\n<li>instead (games/instead) : 3.3.0_1</li>\n<li>lidarr (net-p2p/lidarr) : 0.6.2.883</li>\n<li>minerbold (games/minerbold) : 1.4</li>\n<li>onnx (math/onnx) : 1.5.0</li>\n<li>openzwave-devel (comms/openzwave-devel) : 1.6.897</li>\n<li>polkit-qt-1 (sysutils/polkit-qt) : 0.113.0_8</li>\n<li>py36-traitsui (graphics/py-traitsui) : 6.1.2</li>\n<li>rubygem-aws-sigv2 (devel/rubygem-aws-sigv2) : 1.0.1</li>\n<li>rubygem-default_value_for32 (devel/rubygem-default_value_for32) : 3.2.0</li>\n<li>rubygem-ffi110 (devel/rubygem-ffi110) : 1.10.0</li>\n<li>rubygem-zeitwerk (devel/rubygem-zeitwerk) : 2.1.9</li>\n<li>sems (net/sems) : 1.7.0.g20190822</li>\n<li>skypat (devel/skypat) : 3.1.1</li>\n<li>tvm (math/tvm) : 0.4.1440</li>\n<li>vavoom (games/vavoom) : 1.33_15</li>\n<li>vavoom-extras (games/vavoom-extras) : 1.30_4</li>\n</ul></li>\n<li><p>Deleted Packages (24)</p>\n\n<ul>\n<li>geeqie (graphics/geeqie) : Unknown reason</li>\n<li>iriverter (multimedia/iriverter) : Unknown reason</li>\n<li>kde5 (x11/kde5) : Unknown reason</li>\n<li>kicad-doc (cad/kicad-doc) : Unknown reason</li>\n<li>os-nozfs-buildworld (os/buildworld) : Unknown reason</li>\n<li>os-nozfs-userland (os/userland) : Unknown reason</li>\n<li>os-nozfs-userland-base (os/userland-base) : Unknown reason</li>\n<li>os-nozfs-userland-base-bootstrap (os/userland-base-bootstrap) : Unknown reason</li>\n<li>os-nozfs-userland-bin (os/userland-bin) : Unknown reason</li>\n<li>os-nozfs-userland-boot (os/userland-boot) : Unknown reason</li>\n<li>os-nozfs-userland-conf (os/userland-conf) : Unknown reason</li>\n<li>os-nozfs-userland-debug (os/userland-debug) : Unknown reason</li>\n<li>os-nozfs-userland-devtools (os/userland-devtools) : Unknown reason</li>\n<li>os-nozfs-userland-docs (os/userland-docs) : Unknown reason</li>\n<li>os-nozfs-userland-lib (os/userland-lib) : Unknown reason</li>\n<li>os-nozfs-userland-lib32 (os/userland-lib32) : Unknown reason</li>\n<li>os-nozfs-userland-lib32-development (os/userland-lib32-development) : Unknown reason</li>\n<li>os-nozfs-userland-rescue (os/userland-rescue) : Unknown reason</li>\n<li>os-nozfs-userland-sbin (os/userland-sbin) : Unknown reason</li>\n<li>os-nozfs-userland-tests (os/userland-tests) : Unknown reason</li>\n<li>photoprint (print/photoprint) : Unknown reason</li>\n<li>plasma5-plasma (x11/plasma5-plasma) : Unknown reason</li>\n<li>polkit-qt5 (sysutils/polkit-qt) : Unknown reason</li>\n<li>secpanel (security/secpanel) : Unknown reason</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.dragonflydigest.com/2019/09/10/23472.html\" rel=\"nofollow\">DragonFlyBSD - msdosfs updates</a></li>\n<li><a href=\"https://science.sciencemag.org/content/365/6455/834.full\" rel=\"nofollow\">Stand out as a speaker</a></li>\n<li><a href=\"http://akpoff.com/archive/2019/not_a_review_of_the_lenovo_x1c7.html\" rel=\"nofollow\">Not a review of the 7th Gen X1 Carbon</a></li>\n<li><a href=\"https://www.tfir.io/2019/08/24/freebsd-meets-linux-at-the-open-source-summit/\" rel=\"nofollow\">FreeBSD Meets Linux At The Open Source Summit</a></li>\n<li><a href=\"https://blog.bi0s.in/2019/08/24/Pwn/VM-Escape/2019-07-29-qemu-vm-escape-cve-2019-14378/\" rel=\"nofollow\">QEMU VM Escape</a></li>\n<li><a href=\"http://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on1\" rel=\"nofollow\">Porting wine to amd64 on NetBSD, third evaluation report.</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20190911113856\" rel=\"nofollow\">OpenBSD disabled DoH by default in Firefox</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Reinis - <a href=\"http://dpaste.com/0SG8630#wrap\" rel=\"nofollow\">GELI with UEFI</a></li>\n<li>Mason - <a href=\"http://dpaste.com/1FQN173\" rel=\"nofollow\">Beeping</a></li>\n</ul>\n\n<p>[CHVT feedback]<br>\nDJ - <a href=\"http://dpaste.com/08M3XNH#wrap\" rel=\"nofollow\">Feedback</a><br>\nBen - <a href=\"http://dpaste.com/274RVCE#wrap\" rel=\"nofollow\">chvt</a><br>\nHarri - <a href=\"http://dpaste.com/23R1YMK#wrap\" rel=\"nofollow\">Marc&#39;s chvt question</a></p>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0316.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"NetBSD LLVM sanitizers and GDB regression test suite, Ada—The Language of Cost Savings, Homura - a Windows Games Launcher for FreeBSD, FreeBSD core team appoints a WG to explore transition to Git, OpenBSD 6.6 Beta tagged, Project Trident 12-U5 update now available, and more.","date_published":"2019-09-18T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c6ea44fd-cbae-453a-bd88-a35b2b662859.mp3","mime_type":"audio/mp3","size_in_bytes":46851680,"duration_in_seconds":3904}]},{"id":"7b9117e9-57d1-48ae-8ceb-d92cabe2a2bd","title":"315: Recapping vBSDcon 2019","url":"https://www.bsdnow.tv/315","content_text":"vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.\n\nHeadlines\n\nvBSDcon Recap\n\nAllan and Benedict attended vBSDcon 2019, which ended last week.\n\nIt was held again at the Hyatt Regency Reston and the main conference was organized by Dan Langille of BSDCan fame.The two day conference was preceded by a one day FreeBSD hackathon, where FreeBSD developers had the chance to work on patches and PRs. In the evening, a reception was held to welcome attendees and give them a chance to chat and get to know each other over food and drinks.\n\nThe first day of the conference was opened with a Keynote by Paul Vixie about DNS over HTTPS (DoH). He explained how we got to the current state and what challenges (technical and social) this entails.\n\n\nIf you missed this talk and are dying to see it, it will also be presented at EuroBSDCon next week\n\n\nJohn Baldwin followed up by giving an overview of the work on “In-Kernel TLS Framing and Encryption for FreeBSD” abstract and the recent commit we covered in episode 313.\n\nMeanwhile, Brian Callahan was giving a separate session in another room about “Learning to (Open)BSD through its porting system: an attendee-driven educational session” where people had the chance to learn about how to create ports for the BSDs.\n\nDavid Fullard’s talk about “Transitioning from FreeNAS to FreeBSD” was his first talk at a BSD conference and described how he built his own home NAS setup trying to replicate FreeNAS’ functionality on FreeBSD, and why he transitioned from using an appliance to using vanilla FreeBSD.\n\nShawn Webb followed with his overview talk about the “State of the Hardened Union”. \n\nBenedict’s talk about “Replacing an Oracle Server with FreeBSD, OpenZFS, and PostgreSQL” was well received as people are interested in how we liberated ourselves from the clutches of Oracle without compromising functionality.\n\nEntertaining and educational at the same time, Michael W. Lucas talk about “Twenty Years in Jail: FreeBSD Jails, Then and Now” closed the first day. Lucas also had a table in the hallway with his various tech and non-tech books for sale.\n\nPeople formed small groups and went into town for dinner. Some returned later that night to some work in the hacker lounge or talk amongst fellow BSD enthusiasts. \n\nColin Percival was the keynote speaker for the second day and had an in-depth look at “23 years of software side channel attacks”.\n\nAllan reprised his “ELI5: ZFS Caching” talk explaining how the ZFS adaptive replacement cache (ARC) work and how it can be tuned for various workloads.\n\n“By the numbers: ZFS Performance Results from Six Operating Systems and Their Derivatives” by Michael Dexter followed with his approach to benchmarking OpenZFS on various platforms.\n\nConor Beh was also a new speaker to vBSDcon. His talk was about “FreeBSD at Work: Building Network and Storage Infrastructure with pfSense and FreeNAS”.\n\nTwo OpenBSD talks closed the talk session: Kurt Mosiejczuk with “Care and Feeding of OpenBSD Porters” and Aaron Poffenberger with “Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-up”.\n\nA dinner and reception was enjoyed by the attendees and gave more time to discuss the talks given and other things until late at night.\n\nWe want to thank the vBSDcon organizers and especially Dan Langille for running such a great conference. We are grateful to Verisign as the main sponsor and The FreeBSD Foundation for sponsoring the tote bags. Thanks to all the speakers and attendees!\n\nhumungus - an hg server\n\n\nFeatures\n\n\nView changes, files, changesets, etc. Some syntax highlighting.\nRead only.\nServes multiple repositories.\nAllows cloning via the obvious URL. Supports go get.\nServes files for downloads.\nOnline documentation via mandoc.\nTerminal based admin interface.\n\n\n\n\n\nNews Roundup\n\nOpenBSD on fan-less Tuxedo InfinityBook 14″ v2.\n\n\nThe InfinityBook 14” v2 is a fanless 14” notebook. It is an excellent choice for running OpenBSD - but order it with the supported wireless card (see below.).\n\nI’ve set it up in a dual-boot configuration so that I can switch between Linux and OpenBSD - mainly to spot differences in the drivers. TUXEDO allows a variety of configurations through their webshop.\n\nThe dual boot setup with grub2 and EFI boot will be covered in a separate blogpost. My tests were done with OpenBSD-current - which is as of writing flagged as 6.6-beta.\n\n\n\nSee Article for breakdown of CPU, Wireless, Video, Webcam, Audio, ACPI, Battery, Touchpad, and MicroSD Card Reader\n\n\n\n\nUnix at 50: How the OS that powered smartphones started from failure\n\n\nMaybe its pervasiveness has long obscured its origins. But Unix, the operating system that in one derivative or another powers nearly all smartphones sold worldwide, was born 50 years ago from the failure of an ambitious project that involved titans like Bell Labs, GE, and MIT. Largely the brainchild of a few programmers at Bell Labs, the unlikely story of Unix begins with a meeting on the top floor of an otherwise unremarkable annex at the sprawling Bell Labs complex in Murray Hill, New Jersey.\n\nIt was a bright, cold Monday, the last day of March 1969, and the computer sciences department was hosting distinguished guests: Bill Baker, a Bell Labs vice president, and Ed David, the director of research. Baker was about to pull the plug on Multics (a condensed form of MULTiplexed Information and Computing Service), a software project that the computer sciences department had been working on for four years. Multics was two years overdue, way over budget, and functional only in the loosest possible understanding of the term.\n\nTrying to put the best spin possible on what was clearly an abject failure, Baker gave a speech in which he claimed that Bell Labs had accomplished everything it was trying to accomplish in Multics and that they no longer needed to work on the project. As Berk Tague, a staffer present at the meeting, later told Princeton University, “Like Vietnam, he declared victory and got out of Multics.”\n\nWithin the department, this announcement was hardly unexpected. The programmers were acutely aware of the various issues with both the scope of the project and the computer they had been asked to build it for.\n\nStill, it was something to work on, and as long as Bell Labs was working on Multics, they would also have a $7 million mainframe computer to play around with in their spare time. Dennis Ritchie, one of the programmers working on Multics, later said they all felt some stake in the success of the project, even though they knew the odds of that success were exceedingly remote.\n\nCancellation of Multics meant the end of the only project that the programmers in the Computer science department had to work on—and it also meant the loss of the only computer in the Computer science department. After the GE 645 mainframe was taken apart and hauled off, the computer science department’s resources were reduced to little more than office supplies and a few terminals.\n\n\n\nSome of Allan’s favourite excerpts:\n\n\n\nIn the early '60s, Bill Ninke, a researcher in acoustics, had demonstrated a rudimentary graphical user interface with a DEC PDP-7 minicomputer. Acoustics still had that computer, but they weren’t using it and had stuck it somewhere out of the way up on the sixth floor.\n\nAnd so Thompson, an indefatigable explorer of the labs’ nooks and crannies, finally found that PDP-7 shortly after Davis and Baker cancelled Multics.\n\nWith the rest of the team’s help, Thompson bundled up the various pieces of the PDP-7—a machine about the size of a refrigerator, not counting the terminal—moved it into a closet assigned to the acoustics department, and got it up and running. One way or another, they convinced acoustics to provide space for the computer and also to pay for the not infrequent repairs to it out of that department’s budget.\n\nMcIlroy’s programmers suddenly had a computer, kind of. So during the summer of 1969, Thompson, Ritchie, and Canaday hashed out the basics of a file manager that would run on the PDP-7. This was no simple task. Batch computing—running programs one after the other—rarely required that a computer be able to permanently store information, and many mainframes did not have any permanent storage device (whether a tape or a hard disk) attached to them. But the time-sharing environment that these programmers had fallen in love with required attached storage. And with multiple users connected to the same computer at the same time, the file manager had to be written well enough to keep one user’s files from being written over another user’s. When a file was read, the output from that file had to be sent to the user that was opening it.\n\nIt was a challenge that McIlroy’s team was willing to accept. They had seen the future of computing and wanted to explore it. They knew that Multics was a dead-end, but they had discovered the possibilities opened up by shared development, shared access, and real-time computing. Twenty years later, Ritchie characterized it for Princeton as such: “What we wanted to preserve was not just a good environment in which to do programming, but a system around which a fellowship could form.”\n\nEventually when they had the file management system more or less fleshed out conceptually, it came time to actually write the code. The trio—all of whom had terrible handwriting—decided to use the Labs’ dictating service. One of them called up a lab extension and dictated the entire code base into a tape recorder. And thus, some unidentified clerical worker or workers soon had the unenviable task of trying to convert that into a typewritten document.\n\nOf course, it was done imperfectly. Among various errors, “inode” came back as “eye node,” but the output was still viewed as a decided improvement over their assorted scribbles.\n\nIn August 1969, Thompson’s wife and son went on a three-week vacation to see her family out in Berkeley, and Thompson decided to spend that time writing an assembler, a file editor, and a kernel to manage the PDP-7 processor. This would turn the group’s file manager into a full-fledged operating system. He generously allocated himself one week for each task.\n\nThompson finished his tasks more or less on schedule. And by September, the computer science department at Bell Labs had an operating system running on a PDP-7—and it wasn’t Multics.\n\nBy the summer of 1970, the team had attached a tape drive to the PDP-7, and their blossoming OS also had a growing selection of tools for programmers (several of which persist down to this day). But despite the successes, Thompson, Canaday, and Ritchie were still being rebuffed by labs management in their efforts to get a brand-new computer.\n\nIt wasn’t until late 1971 that the computer science department got a truly modern computer. The Unix team had developed several tools designed to automatically format text files for printing over the past year or so. They had done so to simplify the production of documentation for their pet project, but their tools had escaped and were being used by several researchers elsewhere on the top floor. At the same time, the legal department was prepared to spend a fortune on a mainframe program called “AstroText.” Catching wind of this, the Unix crew realized that they could, with only a little effort, upgrade the tools they had written for their own use into something that the legal department could use to prepare patent applications.\n\nThe computer science department pitched lab management on the purchase of a DEC PDP-11 for document production purposes, and Max Mathews offered to pay for the machine out of the acoustics department budget. Finally, management gave in and purchased a computer for the Unix team to play with. Eventually, word leaked out about this operating system, and businesses and institutions with PDP-11s began contacting Bell Labs about their new operating system. The Labs made it available for free—requesting only the cost of postage and media from anyone who wanted a copy.\n\nThe rest has quite literally made tech history.\n\n\n\nSee the link for the rest of the article\n\n\n\n\nHow to configure a network dump in FreeBSD?\n\n\nA network dump might be very useful for collecting kernel crash dumps from embedded machines and machines with a larger amount of RAM then available swap partition size. Besides net dumps we can also try to compress the core dump. However, often this may still not be enough swap to keep whole core dump. In such situation using network dump is a convenient and reliable way for collecting kernel dump.\n\nSo, first, let’s talk a little bit about history. The first implementation of the network dumps was implemented around 2000 for the FreeBSD 4.x as a kernel module. The code was implemented in 2010 with the intention of being part of FreeBSD 9.0. However, the code never landed in FreeBSD. Finally, in 2018 with the commit r333283 by Mark Johnston the netdump client code landed in the FreeBSD. Subsequently, many other commitments were then implemented to add support for the different drivers (for example r333289). The first official release of FreeBSD, which support netdump is FreeBSD 12.0.\n\nNow, let’s get back to the main topic. How to configure the network dump? Two machines are needed. One machine is to collect core dump, let’s call it server. We will use the second one to send us the core dump - the client. \n\n\n\nSee the link for the rest of the article\n\n\n\n\nBeastie Bits\n\n\nSudo Mastery 2nd edition is not out\nEmpirical Notes on the Interaction Between Continuous Kernel Fuzzing and Development\nsoso\nGregKH - OpenBSD was right\nGame of Trees\n\n\n\n\nFeedback/Questions\n\n\nBostJan - Another Question\nTom - PF\nJohnnyK - Changing VT without keys\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3>vBSDcon Recap</h3>\n\n<p>Allan and Benedict attended vBSDcon 2019, which ended last week.</p>\n\n<p>It was held again at the Hyatt Regency Reston and the main conference was organized by Dan Langille of BSDCan fame.The two day conference was preceded by a one day FreeBSD hackathon, where FreeBSD developers had the chance to work on patches and PRs. In the evening, a reception was held to welcome attendees and give them a chance to chat and get to know each other over food and drinks.</p>\n\n<p>The first day of the conference was opened with a Keynote by Paul Vixie about DNS over HTTPS (DoH). He explained how we got to the current state and what challenges (technical and social) this entails.</p>\n\n<ul>\n<li>If you missed this talk and are dying to see it, it will also be presented at EuroBSDCon next week</li>\n</ul>\n\n<p>John Baldwin followed up by giving an overview of the work on “In-Kernel TLS Framing and Encryption for FreeBSD” <a href=\"https://www.vbsdcon.com/schedule/2019-09-06.html#talk:132615\" rel=\"nofollow\">abstract</a> and the recent commit we covered in episode 313.</p>\n\n<p>Meanwhile, Brian Callahan was giving a separate session in another room about “Learning to (Open)BSD through its porting system: an attendee-driven educational session” where people had the chance to learn about how to create ports for the BSDs.</p>\n\n<p>David Fullard’s talk about “Transitioning from FreeNAS to FreeBSD” was his first talk at a BSD conference and described how he built his own home NAS setup trying to replicate FreeNAS’ functionality on FreeBSD, and why he transitioned from using an appliance to using vanilla FreeBSD.</p>\n\n<p>Shawn Webb followed with his overview talk about the “State of the Hardened Union”. </p>\n\n<p>Benedict’s talk about “Replacing an Oracle Server with FreeBSD, OpenZFS, and PostgreSQL” was well received as people are interested in how we liberated ourselves from the clutches of Oracle without compromising functionality.</p>\n\n<p>Entertaining and educational at the same time, Michael W. Lucas talk about “Twenty Years in Jail: FreeBSD Jails, Then and Now” closed the first day. Lucas also had a table in the hallway with his various tech and non-tech books for sale.</p>\n\n<p>People formed small groups and went into town for dinner. Some returned later that night to some work in the hacker lounge or talk amongst fellow BSD enthusiasts. </p>\n\n<p>Colin Percival was the keynote speaker for the second day and had an in-depth look at “23 years of software side channel attacks”.</p>\n\n<p>Allan reprised his “ELI5: ZFS Caching” talk explaining how the ZFS adaptive replacement cache (ARC) work and how it can be tuned for various workloads.</p>\n\n<p>“By the numbers: ZFS Performance Results from Six Operating Systems and Their Derivatives” by Michael Dexter followed with his approach to benchmarking OpenZFS on various platforms.</p>\n\n<p>Conor Beh was also a new speaker to vBSDcon. His talk was about “FreeBSD at Work: Building Network and Storage Infrastructure with pfSense and FreeNAS”.</p>\n\n<p>Two OpenBSD talks closed the talk session: Kurt Mosiejczuk with “Care and Feeding of OpenBSD Porters” and Aaron Poffenberger with “Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-up”.</p>\n\n<p>A dinner and reception was enjoyed by the attendees and gave more time to discuss the talks given and other things until late at night.</p>\n\n<p>We want to thank the vBSDcon organizers and especially Dan Langille for running such a great conference. We are grateful to Verisign as the main sponsor and The FreeBSD Foundation for sponsoring the tote bags. Thanks to all the speakers and attendees!</p>\n\n<h3><a href=\"https://humungus.tedunangst.com/r/humungus\" rel=\"nofollow\">humungus - an hg server</a></h3>\n\n<ul>\n<li>Features\n\n<ul>\n<li>View changes, files, changesets, etc. Some syntax highlighting.</li>\n<li>Read only.</li>\n<li>Serves multiple repositories.</li>\n<li>Allows cloning via the obvious URL. Supports go get.</li>\n<li>Serves files for downloads.</li>\n<li>Online documentation via mandoc.</li>\n<li>Terminal based admin interface.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://hazardous.org/archive/blog/openbsd/2019/09/02/OpenBSD-on-Infinitybook14\" rel=\"nofollow\">OpenBSD on fan-less Tuxedo InfinityBook 14″ v2.</a></h3>\n\n<blockquote>\n<p>The InfinityBook 14” v2 is a fanless 14” notebook. It is an excellent choice for running OpenBSD - but order it with the supported wireless card (see below.).</p>\n\n<p>I’ve set it up in a dual-boot configuration so that I can switch between Linux and OpenBSD - mainly to spot differences in the drivers. TUXEDO allows a variety of configurations through their webshop.</p>\n\n<p>The dual boot setup with grub2 and EFI boot will be covered in a separate blogpost. My tests were done with OpenBSD-current - which is as of writing flagged as 6.6-beta.</p>\n</blockquote>\n\n<ul>\n<li>See Article for breakdown of CPU, Wireless, Video, Webcam, Audio, ACPI, Battery, Touchpad, and MicroSD Card Reader</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://arstechnica.com/gadgets/2019/08/unix-at-50-it-starts-with-a-mainframe-a-gator-and-three-dedicated-researchers/\" rel=\"nofollow\">Unix at 50: How the OS that powered smartphones started from failure</a></h3>\n\n<blockquote>\n<p>Maybe its pervasiveness has long obscured its origins. But Unix, the operating system that in one derivative or another powers nearly all smartphones sold worldwide, was born 50 years ago from the failure of an ambitious project that involved titans like Bell Labs, GE, and MIT. Largely the brainchild of a few programmers at Bell Labs, the unlikely story of Unix begins with a meeting on the top floor of an otherwise unremarkable annex at the sprawling Bell Labs complex in Murray Hill, New Jersey.</p>\n\n<p>It was a bright, cold Monday, the last day of March 1969, and the computer sciences department was hosting distinguished guests: Bill Baker, a Bell Labs vice president, and Ed David, the director of research. Baker was about to pull the plug on Multics (a condensed form of MULTiplexed Information and Computing Service), a software project that the computer sciences department had been working on for four years. Multics was two years overdue, way over budget, and functional only in the loosest possible understanding of the term.</p>\n\n<p>Trying to put the best spin possible on what was clearly an abject failure, Baker gave a speech in which he claimed that Bell Labs had accomplished everything it was trying to accomplish in Multics and that they no longer needed to work on the project. As Berk Tague, a staffer present at the meeting, later told Princeton University, “Like Vietnam, he declared victory and got out of Multics.”</p>\n\n<p>Within the department, this announcement was hardly unexpected. The programmers were acutely aware of the various issues with both the scope of the project and the computer they had been asked to build it for.</p>\n\n<p>Still, it was something to work on, and as long as Bell Labs was working on Multics, they would also have a $7 million mainframe computer to play around with in their spare time. Dennis Ritchie, one of the programmers working on Multics, later said they all felt some stake in the success of the project, even though they knew the odds of that success were exceedingly remote.</p>\n\n<p>Cancellation of Multics meant the end of the only project that the programmers in the Computer science department had to work on—and it also meant the loss of the only computer in the Computer science department. After the GE 645 mainframe was taken apart and hauled off, the computer science department’s resources were reduced to little more than office supplies and a few terminals.</p>\n</blockquote>\n\n<ul>\n<li>Some of Allan’s favourite excerpts:</li>\n</ul>\n\n<blockquote>\n<p>In the early &#39;60s, Bill Ninke, a researcher in acoustics, had demonstrated a rudimentary graphical user interface with a DEC PDP-7 minicomputer. Acoustics still had that computer, but they weren’t using it and had stuck it somewhere out of the way up on the sixth floor.</p>\n\n<p>And so Thompson, an indefatigable explorer of the labs’ nooks and crannies, finally found that PDP-7 shortly after Davis and Baker cancelled Multics.</p>\n\n<p>With the rest of the team’s help, Thompson bundled up the various pieces of the PDP-7—a machine about the size of a refrigerator, not counting the terminal—moved it into a closet assigned to the acoustics department, and got it up and running. One way or another, they convinced acoustics to provide space for the computer and also to pay for the not infrequent repairs to it out of that department’s budget.</p>\n\n<p>McIlroy’s programmers suddenly had a computer, kind of. So during the summer of 1969, Thompson, Ritchie, and Canaday hashed out the basics of a file manager that would run on the PDP-7. This was no simple task. Batch computing—running programs one after the other—rarely required that a computer be able to permanently store information, and many mainframes did not have any permanent storage device (whether a tape or a hard disk) attached to them. But the time-sharing environment that these programmers had fallen in love with required attached storage. And with multiple users connected to the same computer at the same time, the file manager had to be written well enough to keep one user’s files from being written over another user’s. When a file was read, the output from that file had to be sent to the user that was opening it.</p>\n\n<p>It was a challenge that McIlroy’s team was willing to accept. They had seen the future of computing and wanted to explore it. They knew that Multics was a dead-end, but they had discovered the possibilities opened up by shared development, shared access, and real-time computing. Twenty years later, Ritchie characterized it for Princeton as such: “What we wanted to preserve was not just a good environment in which to do programming, but a system around which a fellowship could form.”</p>\n\n<p>Eventually when they had the file management system more or less fleshed out conceptually, it came time to actually write the code. The trio—all of whom had terrible handwriting—decided to use the Labs’ dictating service. One of them called up a lab extension and dictated the entire code base into a tape recorder. And thus, some unidentified clerical worker or workers soon had the unenviable task of trying to convert that into a typewritten document.</p>\n\n<p>Of course, it was done imperfectly. Among various errors, “inode” came back as “eye node,” but the output was still viewed as a decided improvement over their assorted scribbles.</p>\n\n<p>In August 1969, Thompson’s wife and son went on a three-week vacation to see her family out in Berkeley, and Thompson decided to spend that time writing an assembler, a file editor, and a kernel to manage the PDP-7 processor. This would turn the group’s file manager into a full-fledged operating system. He generously allocated himself one week for each task.</p>\n\n<p>Thompson finished his tasks more or less on schedule. And by September, the computer science department at Bell Labs had an operating system running on a PDP-7—and it wasn’t Multics.</p>\n\n<p>By the summer of 1970, the team had attached a tape drive to the PDP-7, and their blossoming OS also had a growing selection of tools for programmers (several of which persist down to this day). But despite the successes, Thompson, Canaday, and Ritchie were still being rebuffed by labs management in their efforts to get a brand-new computer.</p>\n\n<p>It wasn’t until late 1971 that the computer science department got a truly modern computer. The Unix team had developed several tools designed to automatically format text files for printing over the past year or so. They had done so to simplify the production of documentation for their pet project, but their tools had escaped and were being used by several researchers elsewhere on the top floor. At the same time, the legal department was prepared to spend a fortune on a mainframe program called “AstroText.” Catching wind of this, the Unix crew realized that they could, with only a little effort, upgrade the tools they had written for their own use into something that the legal department could use to prepare patent applications.</p>\n\n<p>The computer science department pitched lab management on the purchase of a DEC PDP-11 for document production purposes, and Max Mathews offered to pay for the machine out of the acoustics department budget. Finally, management gave in and purchased a computer for the Unix team to play with. Eventually, word leaked out about this operating system, and businesses and institutions with PDP-11s began contacting Bell Labs about their new operating system. The Labs made it available for free—requesting only the cost of postage and media from anyone who wanted a copy.</p>\n\n<p>The rest has quite literally made tech history.</p>\n</blockquote>\n\n<ul>\n<li>See the link for the rest of the article</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.oshogbo.vexillium.org/blog/68/\" rel=\"nofollow\">How to configure a network dump in FreeBSD?</a></h3>\n\n<blockquote>\n<p>A network dump might be very useful for collecting kernel crash dumps from embedded machines and machines with a larger amount of RAM then available swap partition size. Besides net dumps we can also try to compress the core dump. However, often this may still not be enough swap to keep whole core dump. In such situation using network dump is a convenient and reliable way for collecting kernel dump.</p>\n\n<p>So, first, let’s talk a little bit about history. The first implementation of the network dumps was implemented around 2000 for the FreeBSD 4.x as a kernel module. The code was implemented in 2010 with the intention of being part of FreeBSD 9.0. However, the code never landed in FreeBSD. Finally, in 2018 with the commit r333283 by Mark Johnston the netdump client code landed in the FreeBSD. Subsequently, many other commitments were then implemented to add support for the different drivers (for example r333289). The first official release of FreeBSD, which support netdump is FreeBSD 12.0.</p>\n\n<p>Now, let’s get back to the main topic. How to configure the network dump? Two machines are needed. One machine is to collect core dump, let’s call it server. We will use the second one to send us the core dump - the client. </p>\n</blockquote>\n\n<ul>\n<li>See the link for the rest of the article</li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://mwl.io/archives/4530\" rel=\"nofollow\">Sudo Mastery 2nd edition is not out</a></li>\n<li><a href=\"http://users.utu.fi/kakrind/publications/19/vulnfuzz_camera.pdf\" rel=\"nofollow\">Empirical Notes on the Interaction Between Continuous Kernel Fuzzing and Development</a></li>\n<li><a href=\"https://github.com/ozkl/soso\" rel=\"nofollow\">soso</a></li>\n<li><a href=\"https://youtu.be/gUqcMs0svNU?t=254\" rel=\"nofollow\">GregKH - OpenBSD was right</a></li>\n<li><a href=\"https://gameoftrees.org/faq.html\" rel=\"nofollow\">Game of Trees</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>BostJan - <a href=\"http://dpaste.com/1ZPCCQY#wrap\" rel=\"nofollow\">Another Question</a></li>\n<li>Tom - <a href=\"http://dpaste.com/3ZSCB8N#wrap\" rel=\"nofollow\">PF</a></li>\n<li>JohnnyK - <a href=\"http://dpaste.com/3QZQ7Q5#wrap\" rel=\"nofollow\">Changing VT without keys</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0315.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"vBSDcon 2019 recap, Unix at 50, OpenBSD on fan-less Tuxedo InfinityBook, humungus - an hg server, how to configure a network dump in FreeBSD, and more.","date_published":"2019-09-12T01:45:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7b9117e9-57d1-48ae-8ceb-d92cabe2a2bd.mp3","mime_type":"audio/mp3","size_in_bytes":55391213,"duration_in_seconds":4615}]},{"id":"a98d492a-7c4f-4f70-b6cf-388387042427","title":"314: Swap that Space","url":"https://www.bsdnow.tv/314","content_text":"Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.\n\nHeadlines\n\nWhat has to happen with Unix virtual memory when you have no swap space\n\n\nRecently, Artem S. Tashkinov wrote on the Linux kernel mailing list about a Linux problem under memory pressure (via, and threaded here). The specific reproduction instructions involved having low RAM, turning off swap space, and then putting the system under load, and when that happened (emphasis mine):\n\nOnce you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I'm not entirely sure why). [...]\n\nI'm afraid I have bad news for the people snickering at Linux here; if you're running without swap space, you can probably get any Unix to behave this way under memory pressure. If you can't on your particular Unix, I'd actually say that your Unix is probably not letting you get full use out of your RAM.\n\nTo simplify a bit, we can divide pages of user memory up into anonymous pages and file-backed pages. File-backed pages are what they sound like; they come from some specific file on the filesystem that they can be written out to (if they're dirty) or read back in from. Anonymous pages are not backed by a file, so the only place they can be written out to and read back in from is swap space. Anonymous pages mostly come from dynamic memory allocations and from modifying the program's global variables and data; file backed pages come mostly from mapping files into memory with mmap() and also, crucially, from the code and read-only data of the program.\n\n\n\nSee link for the rest of the article\n\n\n\n\nDsynth details on Dragonfly\n\n\nFirst, history: DragonFly has had binaries of dports available for download for quite some time.  These were originally built using poudriere, and then using the synth tool put together by John Marino.  Synth worked both to build all software in dports, and as a way to test DragonFly’s SMP capability under extreme load.\n\nMatthew Dillon is working on a new version, called dsynth.  It is available now but not yet part of the build.  He’s been working quickly on it and there’s plenty more commits than what I have linked here.  It’s already led to finding more high-load fixes.\n\n\n\ndsynth\n\n\n\nDSynth is basically synth written in C, from scratch.  It is designed to give us a bulk builder in base and be friendly to porting and jails down the line (for now its uses chroot's).\n\nThe original synth was written by John R. Marino and its basic flow was used in writing this program, but as it was written in ada no code was directly copied.\n\n\nThe intent is to make dsynth compatible with synth's configuration files and directory structure.\nThis is a work in progress and not yet ready for prime-time.  Pushing so we can get some more eyeballs.  Most of the directives do not yet work (everything, and build works, and 'cleanup' can be used to clean up any dangling mounts).\n\n\n\n\ndsynth code\n\n\n\n\nNews Roundup\n\nInstant Workstation\n\n\nSome considerable time ago I wrote up instructions on how to set up a FreeBSD machine with the latest KDE Plasma Desktop. Those instructions, while fairly short (set up X, install the KDE meta-port, .. and that’s it) are a bit fiddly.\n\nSo – prompted slightly by a Twitter exchange recently – I’ve started a mini-sub-project to script the installation of a desktop environment and the bits needed to support it. To give it at least a modicum of UI, dialog(1) is used to ask for an environment to install and a display manager.\n\nThe tricky bits – pointed out to me after I started – are hardware support, although a best-effort is better than having nothing, I think.\n\nIn any case, in a VBox host it’s now down to running a single script and picking Plasma and SDDM to get a usable system for me. Other combinations have not been tested, nor has system-hardware-setup. I’ll probably maintain it for a while and if I have time and energy it’ll be tried with nVidia (those work quite well on FreeBSD) and AMD (not so much, in my experience) graphics cards when I shuffle some machines around.\n\n\n\nHere is the script in my GitHub repository with notes-for-myself.\n\n\n\n\nNew Servers, new Tech\n\n\nFollowing up on an earlier post, the new servers for DragonFly are in place.   The old 40-core machine used for bulk build, monster, is being retired.  The power efficiency of the new machines is startling.  Incidentally, this is where donations go – infrastructure.\n\n\n\nNew servers in the colo, monster is being retired\n\n\n\nWe have three new servers in the colo now that will be taking most/all bulk package building duties from monster and the two blades (muscles and pkgbox64) that previously did the work.   Monster will be retired.   The new servers are a dual-socket Xeon (sting) and two 3900X based systems (thor and loki) which all together burn only around half the wattage that monster burned (500W vs 1000W) and 3 times the performance.   That's at least a 6:1 improvement in performance efficiency.\n\nWith SSD prices down significantly the new machines have all-SSDs.  These new machines allow us to build dports binary packages for release, master, and staged at the same time and reduces the full-on bulk build times for getting all three done down from 2 weeks to 2 days.  It will allow us to more promptly synchronize updates to ports with dports and get binary packages up sooner.\n\nMonster, our venerable 48-core quad-socket opteron is being retired.  This was a wonderful dev machine for working on DragonFly's SMP algorithms over the last 6+ years precisely because its inter-core and inter-socket latencies were quite high.  If a SMP algorithm wasn't spot-on, you could feel it.  Over the years DragonFly's performance on monster in doing things like bulk builds increased radically as the SMP algorithms got better and the cores became more and more localized.  This kept monster relevant far longer than I thought it would be.\n\nBut we are at a point now where improvements in efficiency are just too good to ignore.  Monster's quad-socket opteron (4  x 12 core 6168's) pulls 1000W under full load while a single Ryzen 3900X (12 core / 24 thread) in a server configuration pulls only 150W, and is slightly faster on the same workload to boot.\n\nI would like to thank everyone's generous donations over the last few years!  We burned a few thousand on the new machines (as well as the major SSD upgrades we did to the blades) and made very good use of the money, particularly this year as prices for all major components (RAM, SSDs, CPUs, Mobos, etc) have dropped significantly.\n\n\n\n\nExperimenting with streaming setups on NetBSD\n\n\nEver since OBS was successfully ported to NetBSD, I’ve been trying it out, seeing what works and what doesn’t. I’ve only just gotten started, and there’ll definitely be a lot of tweaking going forward.\n\nCapturing a specific application’s windows seems to work okay. Capturing an entire display works, too. I actually haven’t tried streaming to Twitch or YouTube yet, but in a previous experiment a few weeks ago, I was able to run a FFmpeg command line and that could stream to Twitch mostly OK.\n\nMy laptop combined with my external monitor allows me to have a dual-monitor setup wherein the smaller laptop screen can be my “broadcasting station” while the bigger screen is where all the action takes place. I can make OBS visible on all Xfce workspaces, but keep it tucked away on that display only. Altogether, the setup should let me use the big screen for the fun stuff but I can still monitor everything in the small screen.\n\n\n\n\nNetBSD Made Progress Thanks To GSoC In Its March Towards Steam Support\n\n\nUltimately the goal is to get Valve's Steam client running on NetBSD using their Linux compatibility layer while the focus the past few months with Google Summer of Code 2019 were supporting the necessary DRM ioctls for allowing Linux software running on NetBSD to be able to tap accelerated graphics support.\n\nStudent developer Surya P spent the summer working on compat_netbsd32 DRM interfaces to allow Direct Rendering Manager using applications running under their Linux compatibility layer.\n\nThese interfaces have been tested and working as well as updating the \"suse131\" packages in NetBSD to make use of those interfaces. So the necessary interfaces are now in place for Linux software running on NetBSD to be able to use accelerated graphics though Steam itself isn't yet running on NetBSD with this layer.\n\nThose curious about this DRM ioctl GSoC project can learn more from the NetBSD blog. NetBSD has also been seeing work this summer on Wayland support and better Wine support to ultimately make this BSD a better desktop operating system and potentially a comparable gaming platform to Linux.\n\n\n\n\nBeastie Bits\n\n\nFreeBSD in Wellington?\nFreeBSD on GFE\nClarification \nDistrotest.net now with BSDs\nLecture: Anykernels meet fuzzing NetBSD\nSun Microsystems business plan from 1982 [pdf]\n\n\n\n\nFeedback/Questions\n\n\nAlan - Questions\nRodriguez - Feedback and a question\nJeff - OpenZFS follow-up, FreeBSD Adventures\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/NoSwapConsequence\" rel=\"nofollow\">What has to happen with Unix virtual memory when you have no swap space</a></h3>\n\n<blockquote>\n<p>Recently, Artem S. Tashkinov wrote on the Linux kernel mailing list about a Linux problem under memory pressure (via, and threaded here). The specific reproduction instructions involved having low RAM, turning off swap space, and then putting the system under load, and when that happened (emphasis mine):</p>\n\n<p>Once you hit a situation when opening a new tab requires more RAM than is currently available, the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly (I&#39;m not entirely sure why). [...]</p>\n\n<p>I&#39;m afraid I have bad news for the people snickering at Linux here; if you&#39;re running without swap space, you can probably get any Unix to behave this way under memory pressure. If you can&#39;t on your particular Unix, I&#39;d actually say that your Unix is probably not letting you get full use out of your RAM.</p>\n\n<p>To simplify a bit, we can divide pages of user memory up into anonymous pages and file-backed pages. File-backed pages are what they sound like; they come from some specific file on the filesystem that they can be written out to (if they&#39;re dirty) or read back in from. Anonymous pages are not backed by a file, so the only place they can be written out to and read back in from is swap space. Anonymous pages mostly come from dynamic memory allocations and from modifying the program&#39;s global variables and data; file backed pages come mostly from mapping files into memory with mmap() and also, crucially, from the code and read-only data of the program.</p>\n</blockquote>\n\n<ul>\n<li>See link for the rest of the article</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/08/27/23398.html\" rel=\"nofollow\">Dsynth details on Dragonfly</a></h3>\n\n<blockquote>\n<p>First, history: DragonFly has had binaries of dports available for download for quite some time.  These were originally built using poudriere, and then using the synth tool put together by John Marino.  Synth worked both to build all software in dports, and as a way to test DragonFly’s SMP capability under extreme load.</p>\n\n<p>Matthew Dillon is working on a new version, called dsynth.  It is available now but not yet part of the build.  He’s been working quickly on it and there’s plenty more commits than what I have linked here.  It’s already led to finding more high-load fixes.</p>\n</blockquote>\n\n<ul>\n<li>dsynth</li>\n</ul>\n\n<blockquote>\n<p>DSynth is basically synth written in C, from scratch.  It is designed to give us a bulk builder in base and be friendly to porting and jails down the line (for now its uses chroot&#39;s).</p>\n\n<p>The original synth was written by John R. Marino and its basic flow was used in writing this program, but as it was written in ada no code was directly copied.</p>\n\n<ul>\n<li><p>The intent is to make dsynth compatible with synth&#39;s configuration files and directory structure.</p></li>\n<li><p>This is a work in progress and not yet ready for prime-time.  Pushing so we can get some more eyeballs.  Most of the directives do not yet work (everything, and build works, and &#39;cleanup&#39; can be used to clean up any dangling mounts).</p></li>\n</ul>\n</blockquote>\n\n<ul>\n<li><a href=\"https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/usr.bin/dsynth/dsynth.1\" rel=\"nofollow\">dsynth code</a></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://euroquis.nl/freebsd/2019/08/12/instant-workstation.html\" rel=\"nofollow\">Instant Workstation</a></h3>\n\n<blockquote>\n<p>Some considerable time ago I wrote up instructions on how to set up a FreeBSD machine with the latest KDE Plasma Desktop. Those instructions, while fairly short (set up X, install the KDE meta-port, .. and that’s it) are a bit fiddly.</p>\n\n<p>So – prompted slightly by a Twitter exchange recently – I’ve started a mini-sub-project to script the installation of a desktop environment and the bits needed to support it. To give it at least a modicum of UI, dialog(1) is used to ask for an environment to install and a display manager.</p>\n\n<p>The tricky bits – pointed out to me after I started – are hardware support, although a best-effort is better than having nothing, I think.</p>\n\n<p>In any case, in a VBox host it’s now down to running a single script and picking Plasma and SDDM to get a usable system for me. Other combinations have not been tested, nor has system-hardware-setup. I’ll probably maintain it for a while and if I have time and energy it’ll be tried with nVidia (those work quite well on FreeBSD) and AMD (not so much, in my experience) graphics cards when I shuffle some machines around.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://raw.githubusercontent.com/adriaandegroot/FreeBSDTools/master/bin/instant-workstation\" rel=\"nofollow\">Here is the script in my GitHub repository with notes-for-myself.</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.dragonflydigest.com/2019/08/26/23396.html\" rel=\"nofollow\">New Servers, new Tech</a></h3>\n\n<blockquote>\n<p>Following up on an earlier post, the new servers for DragonFly are in place.   The old 40-core machine used for bulk build, monster, is being retired.  The power efficiency of the new machines is startling.  Incidentally, this is where donations go – infrastructure.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/users/2019-August/358271.html\" rel=\"nofollow\">New servers in the colo, monster is being retired</a></li>\n</ul>\n\n<blockquote>\n<p>We have three new servers in the colo now that will be taking most/all bulk package building duties from monster and the two blades (muscles and pkgbox64) that previously did the work.   Monster will be retired.   The new servers are a dual-socket Xeon (sting) and two 3900X based systems (thor and loki) which all together burn only around half the wattage that monster burned (500W vs 1000W) and 3 times the performance.   That&#39;s at least a 6:1 improvement in performance efficiency.</p>\n\n<p>With SSD prices down significantly the new machines have all-SSDs.  These new machines allow us to build dports binary packages for release, master, and staged at the same time and reduces the full-on bulk build times for getting all three done down from 2 weeks to 2 days.  It will allow us to more promptly synchronize updates to ports with dports and get binary packages up sooner.</p>\n\n<p>Monster, our venerable 48-core quad-socket opteron is being retired.  This was a wonderful dev machine for working on DragonFly&#39;s SMP algorithms over the last 6+ years precisely because its inter-core and inter-socket latencies were quite high.  If a SMP algorithm wasn&#39;t spot-on, you could feel it.  Over the years DragonFly&#39;s performance on monster in doing things like bulk builds increased radically as the SMP algorithms got better and the cores became more and more localized.  This kept monster relevant far longer than I thought it would be.</p>\n\n<p>But we are at a point now where improvements in efficiency are just too good to ignore.  Monster&#39;s quad-socket opteron (4  x 12 core 6168&#39;s) pulls 1000W under full load while a single Ryzen 3900X (12 core / 24 thread) in a server configuration pulls only 150W, and is slightly faster on the same workload to boot.</p>\n\n<p>I would like to thank everyone&#39;s generous donations over the last few years!  We burned a few thousand on the new machines (as well as the major SSD upgrades we did to the blades) and made very good use of the money, particularly this year as prices for all major components (RAM, SSDs, CPUs, Mobos, etc) have dropped significantly.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dressupgeekout.blogspot.com/2019/08/experimenting-with-streaming-setups-on.html?m=1\" rel=\"nofollow\">Experimenting with streaming setups on NetBSD</a></h3>\n\n<blockquote>\n<p>Ever since OBS was successfully ported to NetBSD, I’ve been trying it out, seeing what works and what doesn’t. I’ve only just gotten started, and there’ll definitely be a lot of tweaking going forward.</p>\n\n<p>Capturing a specific application’s windows seems to work okay. Capturing an entire display works, too. I actually haven’t tried streaming to Twitch or YouTube yet, but in a previous experiment a few weeks ago, I was able to run a FFmpeg command line and that could stream to Twitch mostly OK.</p>\n\n<p>My laptop combined with my external monitor allows me to have a dual-monitor setup wherein the smaller laptop screen can be my “broadcasting station” while the bigger screen is where all the action takes place. I can make OBS visible on all Xfce workspaces, but keep it tucked away on that display only. Altogether, the setup should let me use the big screen for the fun stuff but I can still monitor everything in the small screen.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=NetBSD-Linux-DRM-Ioctl-GSoC2019\" rel=\"nofollow\">NetBSD Made Progress Thanks To GSoC In Its March Towards Steam Support</a></h3>\n\n<blockquote>\n<p>Ultimately the goal is to get Valve&#39;s Steam client running on NetBSD using their Linux compatibility layer while the focus the past few months with Google Summer of Code 2019 were supporting the necessary DRM ioctls for allowing Linux software running on NetBSD to be able to tap accelerated graphics support.</p>\n\n<p>Student developer Surya P spent the summer working on compat_netbsd32 DRM interfaces to allow Direct Rendering Manager using applications running under their Linux compatibility layer.</p>\n\n<p>These interfaces have been tested and working as well as updating the &quot;suse131&quot; packages in NetBSD to make use of those interfaces. So the necessary interfaces are now in place for Linux software running on NetBSD to be able to use accelerated graphics though Steam itself isn&#39;t yet running on NetBSD with this layer.</p>\n\n<p>Those curious about this DRM ioctl GSoC project can learn more from <a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2019_report_implementation_of\" rel=\"nofollow\">the NetBSD blog</a>. NetBSD has also been seeing work this summer on Wayland support and better Wine support to ultimately make this BSD a better desktop operating system and potentially a comparable gaming platform to Linux.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/MengTangmu/status/1163265206660694016\" rel=\"nofollow\">FreeBSD in Wellington?</a></li>\n<li><a href=\"https://twitter.com/onewilshire/status/1163792878642114560\" rel=\"nofollow\">FreeBSD on GFE</a></li>\n<li><a href=\"https://twitter.com/onewilshire/status/1166323112620826624\" rel=\"nofollow\">Clarification</a> </li>\n<li><a href=\"https://distrotest.net/\" rel=\"nofollow\">Distrotest.net now with BSDs</a></li>\n<li><a href=\"https://fahrplan.events.ccc.de/camp/2019/Fahrplan/events/10334.html\" rel=\"nofollow\">Lecture: Anykernels meet fuzzing NetBSD</a></li>\n<li><a href=\"https://www.khoslaventures.com/wp-content/uploads/SunMicrosystem_bus_plan.pdf\" rel=\"nofollow\">Sun Microsystems business plan from 1982 [pdf]</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Alan - <a href=\"http://dpaste.com/1Z8EGTW\" rel=\"nofollow\">Questions</a></li>\n<li>Rodriguez - <a href=\"http://dpaste.com/2PZFP4X#wrap\" rel=\"nofollow\">Feedback and a question</a></li>\n<li>Jeff - <a href=\"http://dpaste.com/02ZM6YE#wrap\" rel=\"nofollow\">OpenZFS follow-up, FreeBSD Adventures</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0314.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Unix virtual memory when you have no swap space, Dsynth details on Dragonfly, Instant Workstation on FreeBSD, new servers new tech, Experimenting with streaming setups on NetBSD, NetBSD’s progress towards Steam support thanks to GSoC, and more.","date_published":"2019-09-04T20:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a98d492a-7c4f-4f70-b6cf-388387042427.mp3","mime_type":"audio/mp3","size_in_bytes":34897838,"duration_in_seconds":2908}]},{"id":"15bbd7ef-a3c7-4996-9751-d37aa7b5a255","title":"313: In-Kernel TLS","url":"https://www.bsdnow.tv/313","content_text":"OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.\n\nHeadlines\n\nOpenBSD on the Thinkpad X1 Carbon 7th Gen\n\n\nAnother year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.\nThe seventh generation X1 Carbon isn't much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.\nGone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.\nOn my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, \"X1 Carbon\" branding from the bottom of the display, the power button LED, and the \"ThinkPad\" branding from the lower part of the keyboard deck.\n\n\n\nSee link for the rest of the article\n\n\n\n\nHow To Install FreeBSD On A MacBook 1,1 or 2,1\n\n\n FreeBSD Setup For MacBook 1,1 and 2,1\n\n\n\nFreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.\n\n\n\nInstalling\n\n\n\nFreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:\n\n\n\nA Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.\nA blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.\nAn ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.\nBurn the ISO file to the blank CD or DVD. Once done, make sure it's in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.\n\n\nSee link for the rest of the guide\n\n\n\n\n\nNews Roundup\n\nPatch for review: Kernel portion of in-kernel TLS (KTLS)\n\n\nOne of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.\n\n\n\nhttps://reviews.freebsd.org/D21277\n\n\n\n\nDragonFly Boot Enviroments\n\n\nThis is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.\n\n\n\nSee link for the rest of the details\n\n\n\n\nProject Trident Updates\n\n\n19.08 Available\n\n\n\nThis is a general package update to the CURRENT release repository based upon TrueOS 19.08.\nLegacy boot ISO functional again\nThis update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.\n\n\n\nPACKAGE CHANGES FROM 19.07-U1\n\n\nNew Packages: 154\nDeleted Packages: 394\nUpdated Packages: 4926\n\n12-U3 Available\n\n\n\nThis is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.\n\n\n\nPACKAGE CHANGES FROM STABLE 12-U2\n\n\nNew Packages: 105\nDeleted Packages: 386\nUpdated Packages: 1046\n\n\n\n\n\nvBSDcon\n\n\nvBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019.\n***\n\n\nBeastie Bits\n\n\nThe next NYCBUG meeting will be Sept 4 @ 18:45\n\n\n\n\nFeedback/Questions\n\n\nTom - Questions\nMichael - dfbeadm\nBostjan - Questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://jcs.org/2019/08/14/x1c7\" rel=\"nofollow\">OpenBSD on the Thinkpad X1 Carbon 7th Gen</a></h3>\n\n<blockquote>\n<p>Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.<br>\nThe seventh generation X1 Carbon isn&#39;t much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.<br>\nGone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.<br>\nOn my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, &quot;X1 Carbon&quot; branding from the bottom of the display, the power button LED, and the &quot;ThinkPad&quot; branding from the lower part of the keyboard deck.</p>\n</blockquote>\n\n<ul>\n<li>See link for the rest of the article</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"http://lexploit.com/freebsdmacbook1-1-2-1/\" rel=\"nofollow\">How To Install FreeBSD On A MacBook 1,1 or 2,1</a></h3>\n\n<ul>\n<li> FreeBSD Setup For MacBook 1,1 and 2,1</li>\n</ul>\n\n<blockquote>\n<p>FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.</p>\n</blockquote>\n\n<ul>\n<li>Installing</li>\n</ul>\n\n<blockquote>\n<p>FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:</p>\n</blockquote>\n\n<ul>\n<li>A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.</li>\n<li>A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.</li>\n<li>An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.</li>\n<li><p>Burn the ISO file to the blank CD or DVD. Once done, make sure it&#39;s in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.</p>\n\n<ul>\n<li>See link for the rest of the guide</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=351522\" rel=\"nofollow\">Patch for review: Kernel portion of in-kernel TLS (KTLS)</a></h3>\n\n<blockquote>\n<p>One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://reviews.freebsd.org/D21277\" rel=\"nofollow\">https://reviews.freebsd.org/D21277</a></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://github.com/newnix/dfbeadm\" rel=\"nofollow\">DragonFly Boot Enviroments</a></h3>\n\n<blockquote>\n<p>This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.</p>\n</blockquote>\n\n<ul>\n<li>See link for the rest of the details</li>\n</ul>\n\n<hr>\n\n<h3>Project Trident Updates</h3>\n\n<ul>\n<li><a href=\"https://project-trident.org/post/2019-08-15_19.08_available/\" rel=\"nofollow\">19.08 Available</a></li>\n</ul>\n\n<blockquote>\n<p>This is a general package update to the CURRENT release repository based upon TrueOS 19.08.<br>\nLegacy boot ISO functional again<br>\nThis update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.</p>\n</blockquote>\n\n<ul>\n<li><p>PACKAGE CHANGES FROM 19.07-U1</p>\n\n<ul>\n<li>New Packages: 154</li>\n<li>Deleted Packages: 394</li>\n<li>Updated Packages: 4926</li>\n</ul></li>\n<li><p><a href=\"https://project-trident.org/post/2019-08-22_stable12-u3_available/\" rel=\"nofollow\">12-U3 Available</a></p></li>\n</ul>\n\n<blockquote>\n<p>This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.</p>\n</blockquote>\n\n<ul>\n<li>PACKAGE CHANGES FROM STABLE 12-U2\n\n<ul>\n<li>New Packages: 105</li>\n<li>Deleted Packages: 386</li>\n<li>Updated Packages: 1046</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.vbsdcon.com/schedule/\" rel=\"nofollow\">vBSDcon</a></h3>\n\n<ul>\n<li>vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019.\n***</li>\n</ul>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.nycbug.org/index?action=view&id=10671\" rel=\"nofollow\">The next NYCBUG meeting will be Sept 4 @ 18:45</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Tom - <a href=\"http://dpaste.com/1AXXK7G#wrap\" rel=\"nofollow\">Questions</a></li>\n<li>Michael - <a href=\"http://dpaste.com/0PNEDYT#wrap\" rel=\"nofollow\">dfbeadm</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/1N7T7BR#wrap\" rel=\"nofollow\">Questions</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0313.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.","date_published":"2019-08-29T00:30:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/15bbd7ef-a3c7-4996-9751-d37aa7b5a255.mp3","mime_type":"audio/mp3","size_in_bytes":39745015,"duration_in_seconds":3312}]},{"id":"6dfbd978-c8a2-45c6-a49a-3a4937d83c69","title":"312: Why Package Managers","url":"https://www.bsdnow.tv/312","content_text":"The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.\n\nHeadlines\n\nThe UNIX Philosophy in 2019\n\n\nToday, Linux and open source rules the world, and the UNIX philosophy is widely considered compulsory. Organizations are striving to build small, focused applications that work collaboratively in a cloud and microservices environment. We rely on the network, as well as HTTP (text) APIs for storing and referencing data. Moreover, nearly all configuration is stored and communicated using text (e.g. YAML, JSON or XML). And while the UNIX philosophy has changed dramatically over the past 5 decades, it hasn’t strayed too far from Ken Thompson’s original definition in 1973:\n\n\n\nWe write programs that do one thing and do it well\nWe write programs to work together\nAnd we write programs that handle text streams, because that is a universal interface\n\n\n\n\nWhy Use Package Managers?\n\n\nValuable research is often hindered or outright prevented by the inability to install software.  This need not be the case.\n\nSince I began supporting research computing in 1999, I’ve frequently seen researchers struggle for days or weeks trying to install a single open source application.  In most cases, they ultimately failed.\n\nIn many cases, they could have easily installed the software in seconds with one simple command, using a package manager such as Debian packages, FreeBSD ports, MacPorts, or Pkgsrc, just to name a few.\n\nDeveloper websites often contain poorly written instructions for doing “caveman installs”; manually downloading, unpacking, patching, and building the software.  The same laborious process must often be followed for other software packages on which it depends, which can sometimes number in the dozens.  Many researchers are simply unaware that there are easier ways to install the software they need.  Caveman installs are a colossal waste of man-hours.  If 1000 people around the globe spend an average of 20 hours each trying to install the same program that could have been installed with a package manager (this is not uncommon), then 20,000 man-hours have been lost that could have gone toward science.  How many important discoveries are delayed by this?\n\nThe elite research institutions have ample funding and dozens of IT staff dedicated to research computing.  They can churn out publications even if their operation is inefficient.  Most institutions, however, have few or no IT staff dedicated to research, and cannot afford to squander precious man-hours on temporary, one-off software installs.  The wise approach for those of us in that situation is to collaborate on making software deployment easier for everyone.  If we do so, then even the smallest research groups can leverage that work to be more productive and make more frequent contributions to science.\n\nFortunately, the vast majority of open source software installs can be made trivial for anyone to do for themselves.  Modern package managers perform all the same steps as a caveman install, but automatically.  Package managers also install dependencies for us automatically.\n\n\n\n\nNews Roundup\n\nTouchpad, Interrupted\n\n\nFor two years I've been driving myself crazy trying to figure out the source of a driver problem on OpenBSD: interrupts never arrived for certain touchpad devices. A couple weeks ago, I put out a public plea asking for help in case any non-OpenBSD developers recognized the problem, but while debugging an unrelated issue over the weekend, I finally solved it.\n\nIt's been a long journey and it's a technical tale, but here it is.\n\n\n\n\nPorting wine to amd64 on NetBSD, second evaluation report\n\n\nSummary\n\n\n\nPresently, Wine on amd64 is in test phase. It seems to work fine with caveats like LD_LIBRARY_PATH which has to be set as 32-bit Xorg libs don't have ${PREFIX}/emul/netbsd32/lib in its rpath section. The latter is due to us extracting 32-bit libs from tarballs in lieu of building 32-bit Xorg on amd64. As previously stated, pkgsrc doesn't search for pkgconfig files in ${PREFIX}/emul/netbsd32/lib which might have inadvertent effects that I am unaware of as of now. I shall be working on these issues during the final coding period. I would like to thank @leot, @maya and @christos for saving me from shooting myself in the foot many a time. I, admittedly, have had times when multiple approaches, which all seemed right at that time, perplexed me. I believe those are times when having a mentor counts, and I have been lucky enough to have really good ones. Once again, thanks to Google for this wonderful opportunity.\n\n\n\n\nEnhancing Syzkaller Support for NetBSD, Part 2\n\n\nAs a part of Google Summer of Code’19, I am working on improving the support for Syzkaller kernel fuzzer. Syzkaller is an unsupervised coverage-guided kernel fuzzer, that supports a variety of operating systems including NetBSD. This report details the work done during the second coding period.\n\nYou can also take a look at the first report to learn more about the initial support that we added. : https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd\n\n\n\n\nJuly Update: All about the Pinebook Pro\n\n\n\"So I said I won’t be talking about the BSDs, but I feel like I should at the very least give you a general overview of the RK3399 *BSD functionality. I’ll make it quick. I’ve spoken to *BSD devs whom worked on the RockPro64 and from what I’ve gathered (despite the different *BSDs having varying degree of support for the RK3399 SOC) many of the core features are already supported, which bodes well for *BSD on the Pro. That said, some of the things you’d require on a functional laptop – such as the LCD (using eDP) for instance – will not work on the Pinebook Pro using *BSD as of today. So clearly a degree of work is yet needed for a BSD to run on the device. However, keep in mind that *BSD developers will be receiving their units soon and by the time you receive yours some basic functionality may be available.\"\n\n\n\n\nKilling a process and all of its descendants\n\n\nKilling processes in a Unix-like system can be trickier than expected. Last week I was debugging an odd issue related to job stopping on Semaphore. More specifically, an issue related to the killing of a running process in a job. Here are the highlights of what I learned:\n\nUnix-like operating systems have sophisticated process relationships. Parent-child, process groups, sessions, and session leaders. However, the details are not uniform across operating systems like Linux and macOS. POSIX compliant operating systems support sending signals to process groups with a negative PID number.\n\nSending signals to all processes in a session is not trivial with syscalls.\n\nChild processes started with exec inherit their parent signal configuration. If the parent process is ignoring the SIGHUP signal, for example, this configuration is propagated to the children.\n\nThe answer to the “What happens with orphaned process groups” question is not trivial.\n\n\n\n\nFast Software, the Best Software\n\n\nI love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness.\n\nSoftware that’s speedy usually means it’s focused. Like a good tool, it often means that it’s simple, but that’s not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book — makes you smile without necessarily knowing why.\n\nBut why is slow bad? Fast software is not always good software, but slow software is rarely able to rise to greatness. Fast software gives the user a chance to “meld” with its toolset. That is, not break flow. When the nerds upon Nerd Hill fight to the death over Vi and Emacs, it’s partly because they have such a strong affinity for the flow of the application and its meldiness. They have invested. The Tool Is Good, so they feel. Not breaking flow is an axiom of great tools.\n\nA typewriter is an excellent tool because, even though it’s slow in a relative sense, every aspect of the machine itself operates as quickly as the user can move. It is focused. There are no delays when making a new line or slamming a key into the paper. Yes, you have to put a new sheet of paper into the machine at the end of a page, but that action becomes part of the flow of using the machine, and the accumulation of paper a visual indication of work completed. It is not wasted work. There are no fundamental mechanical delays in using the machine. The best software inches ever closer to the physical directness of something like a typewriter. (The machine may break down, of course, ribbons need to be changed — but this is maintenance and separate from the use of the tool. I’d be delighted to “maintain” Photoshop if it would lighten it up.)\n\n\n\n\nBeastie Bits\n\n\nRegister for vBSDCon 2019, Sept 5-7 in Reston VA\nRegister for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway\n\n\n\n\nFeedback/Questions\n\n\nPaulo - FreeNAS Question\nMarc - Changing VT without function keys?\nCaleb - Patch, update, and upgrade management\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://triosdevelopers.com/jason.eckert/blog/Entries/2019/6/1_Entry_1.html\" rel=\"nofollow\">The UNIX Philosophy in 2019</a></h3>\n\n<blockquote>\n<p>Today, Linux and open source rules the world, and the UNIX philosophy is widely considered compulsory. Organizations are striving to build small, focused applications that work collaboratively in a cloud and microservices environment. We rely on the network, as well as HTTP (text) APIs for storing and referencing data. Moreover, nearly all configuration is stored and communicated using text (e.g. YAML, JSON or XML). And while the UNIX philosophy has changed dramatically over the past 5 decades, it hasn’t strayed too far from Ken Thompson’s original definition in 1973:</p>\n</blockquote>\n\n<ul>\n<li>We write programs that do one thing and do it well</li>\n<li>We write programs to work together</li>\n<li>And we write programs that handle text streams, because that is a universal interface</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://uwm.edu/hpc/software-management/\" rel=\"nofollow\">Why Use Package Managers?</a></h3>\n\n<blockquote>\n<p>Valuable research is often hindered or outright prevented by the inability to install software.  This need not be the case.</p>\n\n<p>Since I began supporting research computing in 1999, I’ve frequently seen researchers struggle for days or weeks trying to install a single open source application.  In most cases, they ultimately failed.</p>\n\n<p>In many cases, they could have easily installed the software in seconds with one simple command, using a package manager such as Debian packages, FreeBSD ports, MacPorts, or Pkgsrc, just to name a few.</p>\n\n<p>Developer websites often contain poorly written instructions for doing “caveman installs”; manually downloading, unpacking, patching, and building the software.  The same laborious process must often be followed for other software packages on which it depends, which can sometimes number in the dozens.  Many researchers are simply unaware that there are easier ways to install the software they need.  Caveman installs are a colossal waste of man-hours.  If 1000 people around the globe spend an average of 20 hours each trying to install the same program that could have been installed with a package manager (this is not uncommon), then 20,000 man-hours have been lost that could have gone toward science.  How many important discoveries are delayed by this?</p>\n\n<p>The elite research institutions have ample funding and dozens of IT staff dedicated to research computing.  They can churn out publications even if their operation is inefficient.  Most institutions, however, have few or no IT staff dedicated to research, and cannot afford to squander precious man-hours on temporary, one-off software installs.  The wise approach for those of us in that situation is to collaborate on making software deployment easier for everyone.  If we do so, then even the smallest research groups can leverage that work to be more productive and make more frequent contributions to science.</p>\n\n<p>Fortunately, the vast majority of open source software installs can be made trivial for anyone to do for themselves.  Modern package managers perform all the same steps as a caveman install, but automatically.  Package managers also install dependencies for us automatically.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jcs.org/2019/07/28/ihidev\" rel=\"nofollow\">Touchpad, Interrupted</a></h3>\n\n<blockquote>\n<p>For two years I&#39;ve been driving myself crazy trying to figure out the source of a driver problem on OpenBSD: interrupts never arrived for certain touchpad devices. A couple weeks ago, I put out a public plea asking for help in case any non-OpenBSD developers recognized the problem, but while debugging an unrelated issue over the weekend, I finally solved it.</p>\n\n<p>It&#39;s been a long journey and it&#39;s a technical tale, but here it is.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on2\" rel=\"nofollow\">Porting wine to amd64 on NetBSD, second evaluation report</a></h3>\n\n<ul>\n<li>Summary</li>\n</ul>\n\n<blockquote>\n<p>Presently, Wine on amd64 is in test phase. It seems to work fine with caveats like LD_LIBRARY_PATH which has to be set as 32-bit Xorg libs don&#39;t have ${PREFIX}/emul/netbsd32/lib in its rpath section. The latter is due to us extracting 32-bit libs from tarballs in lieu of building 32-bit Xorg on amd64. As previously stated, pkgsrc doesn&#39;t search for pkgconfig files in ${PREFIX}/emul/netbsd32/lib which might have inadvertent effects that I am unaware of as of now. I shall be working on these issues during the final coding period. I would like to thank @leot, @maya and @christos for saving me from shooting myself in the foot many a time. I, admittedly, have had times when multiple approaches, which all seemed right at that time, perplexed me. I believe those are times when having a mentor counts, and I have been lucky enough to have really good ones. Once again, thanks to Google for this wonderful opportunity.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/enchancing_syzkaller_support_for_netbsd\" rel=\"nofollow\">Enhancing Syzkaller Support for NetBSD, Part 2</a></h3>\n\n<blockquote>\n<p>As a part of Google Summer of Code’19, I am working on improving the support for Syzkaller kernel fuzzer. Syzkaller is an unsupervised coverage-guided kernel fuzzer, that supports a variety of operating systems including NetBSD. This report details the work done during the second coding period.</p>\n\n<p>You can also take a look at the first report to learn more about the initial support that we added. : <a href=\"https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd\" rel=\"nofollow\">https://blog.netbsd.org/tnf/entry/enhancing_syzkaller_support_for_netbsd</a></p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.pine64.org/2019/07/05/july-update-all-about-the-pinebook-pro/\" rel=\"nofollow\">July Update: All about the Pinebook Pro</a></h3>\n\n<blockquote>\n<p>&quot;So I said I won’t be talking about the BSDs, but I feel like I should at the very least give you a general overview of the RK3399 *BSD functionality. I’ll make it quick. I’ve spoken to *BSD devs whom worked on the RockPro64 and from what I’ve gathered (despite the different *BSDs having varying degree of support for the RK3399 SOC) many of the core features are already supported, which bodes well for *BSD on the Pro. That said, some of the things you’d require on a functional laptop – such as the LCD (using eDP) for instance – will not work on the Pinebook Pro using *BSD as of today. So clearly a degree of work is yet needed for a BSD to run on the device. However, keep in mind that *BSD developers will be receiving their units soon and by the time you receive yours some basic functionality may be available.&quot;</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://morningcoffee.io/killing-a-process-and-all-of-its-descendants.html\" rel=\"nofollow\">Killing a process and all of its descendants</a></h3>\n\n<blockquote>\n<p>Killing processes in a Unix-like system can be trickier than expected. Last week I was debugging an odd issue related to job stopping on Semaphore. More specifically, an issue related to the killing of a running process in a job. Here are the highlights of what I learned:</p>\n\n<p>Unix-like operating systems have sophisticated process relationships. Parent-child, process groups, sessions, and session leaders. However, the details are not uniform across operating systems like Linux and macOS. POSIX compliant operating systems support sending signals to process groups with a negative PID number.</p>\n\n<p>Sending signals to all processes in a session is not trivial with syscalls.</p>\n\n<p>Child processes started with exec inherit their parent signal configuration. If the parent process is ignoring the SIGHUP signal, for example, this configuration is propagated to the children.</p>\n\n<p>The answer to the “What happens with orphaned process groups” question is not trivial.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://craigmod.com/essays/fast_software/\" rel=\"nofollow\">Fast Software, the Best Software</a></h3>\n\n<blockquote>\n<p>I love fast software. That is, software speedy both in function and interface. Software with minimal to no lag between wanting to activate or manipulate something and the thing happening. Lightness.</p>\n\n<p>Software that’s speedy usually means it’s focused. Like a good tool, it often means that it’s simple, but that’s not necessarily true. Speed in software is probably the most valuable, least valued asset. To me, speedy software is the difference between an application smoothly integrating into your life, and one called upon with great reluctance. Fastness in software is like great margins in a book — makes you smile without necessarily knowing why.</p>\n\n<p>But why is slow bad? Fast software is not always good software, but slow software is rarely able to rise to greatness. Fast software gives the user a chance to “meld” with its toolset. That is, not break flow. When the nerds upon Nerd Hill fight to the death over Vi and Emacs, it’s partly because they have such a strong affinity for the flow of the application and its meldiness. They have invested. The Tool Is Good, so they feel. Not breaking flow is an axiom of great tools.</p>\n\n<p>A typewriter is an excellent tool because, even though it’s slow in a relative sense, every aspect of the machine itself operates as quickly as the user can move. It is focused. There are no delays when making a new line or slamming a key into the paper. Yes, you have to put a new sheet of paper into the machine at the end of a page, but that action becomes part of the flow of using the machine, and the accumulation of paper a visual indication of work completed. It is not wasted work. There are no fundamental mechanical delays in using the machine. The best software inches ever closer to the physical directness of something like a typewriter. (The machine may break down, of course, ribbons need to be changed — but this is maintenance and separate from the use of the tool. I’d be delighted to “maintain” Photoshop if it would lighten it up.)</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://vbsdcon.com/registration\" rel=\"nofollow\">Register for vBSDCon 2019, Sept 5-7 in Reston VA</a></li>\n<li><a href=\"https://2019.eurobsdcon.org/registration/\" rel=\"nofollow\">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Paulo - <a href=\"http://dpaste.com/2GDG7WR#wrap\" rel=\"nofollow\">FreeNAS Question</a></li>\n<li>Marc - <a href=\"http://dpaste.com/1AKC7A1#wrap\" rel=\"nofollow\">Changing VT without function keys?</a></li>\n<li>Caleb - <a href=\"http://dpaste.com/2D6J482#wrap\" rel=\"nofollow\">Patch, update, and upgrade management</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0312.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"The UNIX Philosophy in 2019, why use package managers, touchpad interrupted, Porting wine to amd64 on NetBSD second evaluation report, Enhancing Syzkaller Support for NetBSD, all about the Pinebook Pro, killing a process and all of its descendants, fast software the best software, and more.","date_published":"2019-08-21T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6dfbd978-c8a2-45c6-a49a-3a4937d83c69.mp3","mime_type":"audio/mp3","size_in_bytes":51882863,"duration_in_seconds":4323}]},{"id":"1d57e61a-57d9-4d3b-ac9a-c3a4c061da07","title":"311: Conference Gear Breakdown","url":"https://www.bsdnow.tv/311","content_text":"NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.\n\nHeadlines\n\nNetBSD 9.0 release process has started\n\n\nIf you have been following source-changes, you may have noticed the creation of the netbsd-9 branch! It has some really exciting items that we worked on:\n\n\nNew AArch64 architecture support:\n\n\nSymmetric and asymmetrical multiprocessing support (aka big.LITTLE)\nSupport for running 32-bit binaries\nUEFI and ACPI support\nSupport for SBSA/SBBR (server-class) hardware.\n\nThe FDT-ization of many ARM boards:\n\n\nthe 32-bit GENERIC kernel lists 129 different DTS configurations\nthe 64-bit GENERIC64 kernel lists 74 different DTS configurations\nAll supported by a single kernel, without requiring per-board configuration.\n\nGraphics driver update, matching Linux 4.4, adding support for up to Kaby Lake based Intel graphics devices.\nZFS has been updated to a modern version and seen many bugfixes.\nNew hardware-accelerated virtualization via NVMM.\nNPF performance improvements and bug fixes. A new lookup algorithm, thmap, is now the default.\nNVMe performance improvements\nOptional kernel ASLR support, and partial kernel ASLR for the default configuration.\nKernel sanitizers:\n\n\nKLEAK, detecting memory leaks\nKASAN, detecting memory overruns\nKUBSAN, detecting undefined behaviour\nThese have been used together with continuous fuzzing via the syzkaller project to find many bugs that were fixed.\n\nThe removal of outdated networking components such as ISDN and all of its drivers\nThe installer is now capable of performing GPT UEFI installations.\nDramatically improved support for userland sanitizers, as well as the option to build all of NetBSD's userland using them for bug-finding.\nUpdate to graphics userland: Mesa was updated to 18.3.4, and llvmpipe is now available for several architectures, providing 3D graphics even in the absence of a supported GPU.\n\n\nWe try to test NetBSD as best as we can, but your testing can help NetBSD 9.0 a great release. Please test it and let us know of any bugs you find.\n\n\nBinaries are available at https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/\n\n\n\n\n\nxargs wtf\n\n\nxargs is probably one of the more difficult to understand of the unix command arsenal and of course that just means it’s one of the most useful too.\nI discovered a handy trick that I thought was worth a share. Please note there are probably other (better) ways to do this but I did my stackoverflow research and found nothing better.\nxargs — at least how I’ve most utilized it — is handy for taking some number of lines as input and doing some work per line. It’s hard to be more specific than that as it does so much else.\nIt literally took me an hour of piecing together random man pages + tips from 11 year olds on stack overflow, but eventually I produced this gem:\nThis is an example of how to find files matching a certain pattern and rename each of them. It sounds so trivial (and it is) but it demonstrates some cool tricks in an easy concept.\n\n\n\n\nNews Roundup\n\nPkgSrc: A Tale of Two Spellcheckers\n\n\nThis is a transcript of the talk I gave at pkgsrcCon 2019 in Cambridge, UK. It is about spellcheckers, but there are much more general software engineering lessons that we can learn from this case study.\nThe reason I got into this subject at all was my paternal leave last year, when I finally had some more time to spend working on pkgsrc. It was a tiny item in the enormous TODO file at the top of the source tree (“update enchant to version 2.2”) that made me go into this rabbit hole.\n\n\n\n\nAdapting TriforceAFL for NetBSD, Part 2\n\n\nI have been working on adapting TriforceAFL for NetBSD kernel syscall fuzzing. This blog post summarizes the work done until the second evaluation.\nFor work done during the first coding period, check out this post.\n\n\n\nSummary\n&gt; So far, the TriforceNetBSDSyscallFuzzer has been made available in the form of a pkgsrc package with the ability to fuzz most of NetBSD syscalls. In the final coding period of GSoC. I plan to analyse the crashes that were found until now. Integrate sanitizers, try and find more bugs and finally wrap up neatly with detailed documentation.\n&gt; Last but not least, I would like to thank my mentor, Kamil Rytarowski for helping me through the process and guiding me. It has been a wonderful learning experience so far!\n\n\n\n\nExploiting a no-name freebsd kernel vulnerability\n\n\nA new patch has been recently shipped in FreeBSD kernels to fix a vulnerability (cve-2019-5602) present in the cdrom device. In this post, we will introduce the bug and discuss its exploitation on pre/post-SMEP FreeBSD revisions.\n&gt; A closer look at the commit 6bcf6e3 shows that when invoking the CDIOCREADSUBCHANNEL_SYSSPACE ioctl, data are copied with bcopy instead of the copyout primitive. This endows a local attacker belonging to the operator group with an arbitrary write primitive in the kernel memory.\n\n\n\n\n[Allan and Benedicts Conference Gear Breakdown]\n\n\n\nBenedict’s Gear:\n\n\nGlocalMe G3 Mobile Travel HotSpot and Powerbank\nMogics Power Bagel\nCharby Sense Power Cable\n\nAllan’s Gear:\n\n\nHuawei E5770s-320 4G LTE 150 Mbps Mobile WiFi Pro\nAOW Global Data SIM Card for On-Demand 4G LTE Mobile Data in Over 90 Countries\nAll my devices charge from USB-C, so that is great\nMore USB thumb drives than strictly necessary\nMy Lenovo X270 laptop running FreeBSD 13-current\nMy 2016 Macbook Pro (a prize from the raffle at vBSDCon 2017) that I use for email and video conferencing to preserve battery on my FreeBSD machine for work\n\n\n\n\n\nBeastie Bits\n\n\nReplacing the Unix tradition (Warning may be rage inducing)\nInstalling OpenBSD over remote serial on the AtomicPI\nZen 2 and DragonFly\nImprove Docking on FreeBSD\nRegister for vBSDCon 2019, Sept 5-7 in Reston VA. Early bird ends August 15th.\nRegister for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway\n\n\n\n\nFeedback/Questions\n\n\nJT - Congrats\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>NetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://mail-index.netbsd.org/netbsd-announce/2019/07/31/msg000301.html\" rel=\"nofollow\">NetBSD 9.0 release process has started</a></h3>\n\n<blockquote>\n<p>If you have been following source-changes, you may have noticed the creation of the netbsd-9 branch! It has some really exciting items that we worked on:</p>\n\n<ul>\n<li>New AArch64 architecture support:\n\n<ul>\n<li>Symmetric and asymmetrical multiprocessing support (aka big.LITTLE)</li>\n<li>Support for running 32-bit binaries</li>\n<li>UEFI and ACPI support</li>\n<li>Support for SBSA/SBBR (server-class) hardware.</li>\n</ul></li>\n<li>The FDT-ization of many ARM boards:\n\n<ul>\n<li>the 32-bit GENERIC kernel lists 129 different DTS configurations</li>\n<li>the 64-bit GENERIC64 kernel lists 74 different DTS configurations</li>\n<li>All supported by a single kernel, without requiring per-board configuration.</li>\n</ul></li>\n<li>Graphics driver update, matching Linux 4.4, adding support for up to Kaby Lake based Intel graphics devices.</li>\n<li>ZFS has been updated to a modern version and seen many bugfixes.</li>\n<li>New hardware-accelerated virtualization via NVMM.</li>\n<li>NPF performance improvements and bug fixes. A new lookup algorithm, thmap, is now the default.</li>\n<li>NVMe performance improvements</li>\n<li>Optional kernel ASLR support, and partial kernel ASLR for the default configuration.</li>\n<li>Kernel sanitizers:\n\n<ul>\n<li>KLEAK, detecting memory leaks</li>\n<li>KASAN, detecting memory overruns</li>\n<li>KUBSAN, detecting undefined behaviour</li>\n<li>These have been used together with continuous fuzzing via the syzkaller project to find many bugs that were fixed.</li>\n</ul></li>\n<li>The removal of outdated networking components such as ISDN and all of its drivers</li>\n<li>The installer is now capable of performing GPT UEFI installations.</li>\n<li>Dramatically improved support for userland sanitizers, as well as the option to build all of NetBSD&#39;s userland using them for bug-finding.</li>\n<li>Update to graphics userland: Mesa was updated to 18.3.4, and llvmpipe is now available for several architectures, providing 3D graphics even in the absence of a supported GPU.</li>\n</ul>\n\n<p>We try to test NetBSD as best as we can, but your testing can help NetBSD 9.0 a great release. Please test it and let us know of any bugs you find.</p>\n\n<ul>\n<li>Binaries are available at <a href=\"https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/\" rel=\"nofollow\">https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/</a></li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://medium.com/@aarontharris/xargs-wtf-34d2618286b7\" rel=\"nofollow\">xargs wtf</a></h3>\n\n<blockquote>\n<p>xargs is probably one of the more difficult to understand of the unix command arsenal and of course that just means it’s one of the most useful too.<br>\nI discovered a handy trick that I thought was worth a share. Please note there are probably other (better) ways to do this but I did my stackoverflow research and found nothing better.<br>\nxargs — at least how I’ve most utilized it — is handy for taking some number of lines as input and doing some work per line. It’s hard to be more specific than that as it does so much else.<br>\nIt literally took me an hour of piecing together random man pages + tips from 11 year olds on stack overflow, but eventually I produced this gem:<br>\nThis is an example of how to find files matching a certain pattern and rename each of them. It sounds so trivial (and it is) but it demonstrates some cool tricks in an easy concept.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://bentsukun.ch/posts/pkgsrccon-2019/\" rel=\"nofollow\">PkgSrc: A Tale of Two Spellcheckers</a></h3>\n\n<blockquote>\n<p>This is a transcript of the talk I gave at pkgsrcCon 2019 in Cambridge, UK. It is about spellcheckers, but there are much more general software engineering lessons that we can learn from this case study.<br>\nThe reason I got into this subject at all was my paternal leave last year, when I finally had some more time to spend working on pkgsrc. It was a tiny item in the enormous TODO file at the top of the source tree (“update enchant to version 2.2”) that made me go into this rabbit hole.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/adapting_triforceafl_for_netbsd_part1\" rel=\"nofollow\">Adapting TriforceAFL for NetBSD, Part 2</a></h3>\n\n<blockquote>\n<p>I have been working on adapting TriforceAFL for NetBSD kernel syscall fuzzing. This blog post summarizes the work done until the second evaluation.<br>\nFor work done during the first coding period, check out this post.</p>\n</blockquote>\n\n<ul>\n<li>Summary\n&gt; So far, the TriforceNetBSDSyscallFuzzer has been made available in the form of a pkgsrc package with the ability to fuzz most of NetBSD syscalls. In the final coding period of GSoC. I plan to analyse the crashes that were found until now. Integrate sanitizers, try and find more bugs and finally wrap up neatly with detailed documentation.\n&gt; Last but not least, I would like to thank my mentor, Kamil Rytarowski for helping me through the process and guiding me. It has been a wonderful learning experience so far!</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.synacktiv.com/posts/exploit/exploiting-a-no-name-freebsd-kernel-vulnerability.html\" rel=\"nofollow\">Exploiting a no-name freebsd kernel vulnerability</a></h3>\n\n<ul>\n<li>A new patch has been recently shipped in FreeBSD kernels to fix a vulnerability (cve-2019-5602) present in the cdrom device. In this post, we will introduce the bug and discuss its exploitation on pre/post-SMEP FreeBSD revisions.\n&gt; A closer look at the commit 6bcf6e3 shows that when invoking the CDIOCREADSUBCHANNEL_SYSSPACE ioctl, data are copied with bcopy instead of the copyout primitive. This endows a local attacker belonging to the operator group with an arbitrary write primitive in the kernel memory.</li>\n</ul>\n\n<hr>\n\n<h3>[Allan and Benedicts Conference Gear Breakdown]</h3>\n\n<ul>\n<li></li>\n<li><p>Benedict’s Gear:</p>\n\n<blockquote>\n<p><a href=\"https://www.glocalme.com/CA/en-US/cloudsim/g3\" rel=\"nofollow\">GlocalMe G3 Mobile Travel HotSpot and Powerbank</a><br>\n<a href=\"http://www.mogics.com/3824-2\" rel=\"nofollow\">Mogics Power Bagel</a><br>\n<a href=\"https://charbycharge.com/charby-sense-worlds-smartest-auto-cutoff-cable/\" rel=\"nofollow\">Charby Sense Power Cable</a></p>\n</blockquote></li>\n<li><p>Allan’s Gear:</p>\n\n<blockquote>\n<p><a href=\"https://smile.amazon.com/gp/product/B013CEGGKI/\" rel=\"nofollow\">Huawei E5770s-320 4G LTE 150 Mbps Mobile WiFi Pro</a><br>\n<a href=\"https://smile.amazon.com/dp/B071HJFX27/\" rel=\"nofollow\">AOW Global Data SIM Card for On-Demand 4G LTE Mobile Data in Over 90 Countries</a><br>\nAll my devices charge from USB-C, so that is great<br>\nMore USB thumb drives than strictly necessary<br>\nMy Lenovo X270 laptop running FreeBSD 13-current<br>\nMy 2016 Macbook Pro (a prize from the raffle at vBSDCon 2017) that I use for email and video conferencing to preserve battery on my FreeBSD machine for work</p>\n</blockquote></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=L9v4Mg8wi4U&feature=youtu.be\" rel=\"nofollow\">Replacing the Unix tradition (Warning may be rage inducing)</a></li>\n<li><a href=\"https://www.thanassis.space/remoteserial.html#remoteserial\" rel=\"nofollow\">Installing OpenBSD over remote serial on the AtomicPI</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/08/05/23294.html\" rel=\"nofollow\">Zen 2 and DragonFly</a></li>\n<li><a href=\"https://blog.yukiisbo.red/posts/2019/05/improve-docking-on-freebsd/\" rel=\"nofollow\">Improve Docking on FreeBSD</a></li>\n<li><a href=\"https://vbsdcon.com/registration\" rel=\"nofollow\">Register for vBSDCon 2019, Sept 5-7 in Reston VA. Early bird ends August 15th.</a></li>\n<li><a href=\"https://2019.eurobsdcon.org/registration/\" rel=\"nofollow\">Register for EuroBSDCon 2019, Sept 19-22 in Lillehammer, Norway</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>JT - <a href=\"http://dpaste.com/0D7Y31E#wrap\" rel=\"nofollow\">Congrats</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0311.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"\nNetBSD 9.0 release process has started, xargs, a tale of two spellcheckers, Adapting TriforceAFL for NetBSD, Exploiting a no-name freebsd kernel vulnerability, and more.","date_published":"2019-08-15T09:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1d57e61a-57d9-4d3b-ac9a-c3a4c061da07.mp3","mime_type":"audio/mp3","size_in_bytes":52868098,"duration_in_seconds":4405}]},{"id":"11bc3886-8630-42e4-8ce6-a97cfce82f4d","title":"310: My New Free NAS","url":"https://www.bsdnow.tv/310","content_text":"OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. \n\nHeadlines\n\nOPNsense 19.7.1\n\n\nWe do not wish to keep you from enjoying your summer time, but this\nis a recommended security update enriched with reliability fixes for the\nnew 19.7 series.  Of special note are performance improvements as well\nas a fix for a longstanding NAT before IPsec limitation.\n\nFull patch notes:\n\n\n\nsystem: do not create automatic copies of existing gateways\nsystem: do not translate empty tunables descriptions\nsystem: remove unwanted form action tags\nsystem: do not include Syslog-ng in rc.freebsd handler\nsystem: fix manual system log stop/start/restart\nsystem: scoped IPv6 \"%\" could confuse mwexecf(), use plain mwexec() instead\nsystem: allow curl-based downloads to use both trusted and local authorities\nsystem: fix group privilege print and correctly redirect after edit\nsystem: use cached address list in referrer check\nsystem: fix Syslog-ng search stats\nfirewall: HTML-escape dynamic entries to display aliases\nfirewall: display correct IP version in automatic rules\nfirewall: fix a warning while reading empty outbound rules configuration\nfirewall: skip illegal log lines in live log\ninterfaces: performance improvements for configurations with hundreds of interfaces\nreporting: performance improvements for Python 3 NetFlow aggregator rewrite\ndhcp: move advanced router advertisement options to correct config section\nipsec: replace global array access with function to ensure side-effect free boot\nipsec: change DPD action on start to \"dpdaction = restart\"\nipsec: remove already default \"dpdaction = none\" if not set\nipsec: use interface IP address in local ID when doing NAT before IPsec\nweb proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen\nplugins: os-acme-client 1.24[1]\nplugins: os-bind 1.6[2]\nplugins: os-dnscrypt-proxy 1.5[3]\nplugins: os-frr now restricts characters BGP prefix-list and route-maps[4]\nplugins: os-google-cloud-sdk 1.0[5]\nports: curl 7.65.3[6]\nports: monit 5.26.0[7]\nports: openssh 8.0p1[8]\nports: php 7.2.20[9]\nports: python 3.7.4[10]\nports: sqlite 3.29.0[11]\nports: squid 4.8[12]\n\n\n\nStay safe and hydrated, Your OPNsense team\n\n\n\n\nZFS on Linux still has annoying issues with ARC size\n\nOne of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS's auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.\n\n\nLinux's regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there's very little memory actually free, but at least you're getting value from your RAM. This is so reliable and regular that we generally don't think about 'is my system going to use all of my RAM as a disk cache', because the answer is always 'yes'. (The general filesystem cache is also called the page cache.)\n\nThis is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn't necessarily the case even on Solaris). ZFS has both a current size and a 'target size' for the ARC (called 'c' in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that's its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn't currently expose enough statistics to tell why your ARC target size shrunk in any particular case).\n\nThe net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux's normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).\n\n\n\n\nNews Roundup\n\nHammer2 is now default\n\ncommit a49112761c919d42d405ec10252eb0553662c824\nAuthor: Matthew Dillon &lt;dillon at apollo.backplane.com&gt;\nDate:   Mon Jun 10 17:53:46 2019 -0700\n\n    installer - Default to HAMMER2\n\n    * Change the installer default from HAMMER1 to HAMMER2.\n\n    * Adjust the nrelease build to print the location of the image files\n      when it finishes.\n\nSummary of changes:\n nrelease/Makefile                          |  2 +-\n usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------\n 2 files changed, 11 insertions(+), 11 deletions(-)\n\nhttp://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824\n\n\n\n\nNetBSD audio – an application perspective\n\n\nNetBSD audio – an application perspective ... or, \"doing it natively, because we can\"\n\n\n\naudio options for NetBSD in pkgsrc\n\n\nUse NetBSD native audio (sun audio/audioio.h)\nOr OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff\n\nMany many abstraction layers available:\n\n\nOpenAL-Soft\nalsa-lib (config file required)\nlibao, GStreamer (plugins!)\nPortAudio, SDL\nPulseAudio, JACK\n... lots more!? some obsolete stuff (esd, nas?)\n\nAdvantages of using NetBSD audio directly\n\n\nLow latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)\nQuery device information: Is /dev/audio1 a USB microphone or another sound card?\nAvoid bugs from excessive layering\nNice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]\nYour code might work on illumos too\n\n[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don't know why.]\n\n\n\n\nNew FreeNAS Mini\n\n\nTwo new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:\n\nFreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.\n\nFreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.\n\n\n\n\nBeastie Bits\n\n\nWelcome to NetBSD 9.99.1!\nBerkeley smorgasbord — part II\ndtracing postgres\nProject Trident 19.07-U1 now available\nNeed a Secure Operating System? Take a Look at OpenBSD\n\n\n\n\nFeedback/Questions\n\n\nJeff - OpenZFS Port Testing Feedback\nMalcolm - Best Practices for Custom Ports\nMichael - Little Correction\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. </p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://opnsense.org/opnsense-19-7-1-released/\" rel=\"nofollow\">OPNsense 19.7.1</a></h3>\n\n<blockquote>\n<p>We do not wish to keep you from enjoying your summer time, but this<br>\nis a recommended security update enriched with reliability fixes for the<br>\nnew 19.7 series.  Of special note are performance improvements as well<br>\nas a fix for a longstanding NAT before IPsec limitation.</p>\n\n<p>Full patch notes:</p>\n</blockquote>\n\n<ul>\n<li>system: do not create automatic copies of existing gateways</li>\n<li>system: do not translate empty tunables descriptions</li>\n<li>system: remove unwanted form action tags</li>\n<li>system: do not include Syslog-ng in rc.freebsd handler</li>\n<li>system: fix manual system log stop/start/restart</li>\n<li>system: scoped IPv6 &quot;%&quot; could confuse mwexecf(), use plain mwexec() instead</li>\n<li>system: allow curl-based downloads to use both trusted and local authorities</li>\n<li>system: fix group privilege print and correctly redirect after edit</li>\n<li>system: use cached address list in referrer check</li>\n<li>system: fix Syslog-ng search stats</li>\n<li>firewall: HTML-escape dynamic entries to display aliases</li>\n<li>firewall: display correct IP version in automatic rules</li>\n<li>firewall: fix a warning while reading empty outbound rules configuration</li>\n<li>firewall: skip illegal log lines in live log</li>\n<li>interfaces: performance improvements for configurations with hundreds of interfaces</li>\n<li>reporting: performance improvements for Python 3 NetFlow aggregator rewrite</li>\n<li>dhcp: move advanced router advertisement options to correct config section</li>\n<li>ipsec: replace global array access with function to ensure side-effect free boot</li>\n<li>ipsec: change DPD action on start to &quot;dpdaction = restart&quot;</li>\n<li>ipsec: remove already default &quot;dpdaction = none&quot; if not set</li>\n<li>ipsec: use interface IP address in local ID when doing NAT before IPsec</li>\n<li>web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen</li>\n<li>plugins: os-acme-client 1.24[1]</li>\n<li>plugins: os-bind 1.6[2]</li>\n<li>plugins: os-dnscrypt-proxy 1.5[3]</li>\n<li>plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]</li>\n<li>plugins: os-google-cloud-sdk 1.0[5]</li>\n<li>ports: curl 7.65.3[6]</li>\n<li>ports: monit 5.26.0[7]</li>\n<li>ports: openssh 8.0p1[8]</li>\n<li>ports: php 7.2.20[9]</li>\n<li>ports: python 3.7.4[10]</li>\n<li>ports: sqlite 3.29.0[11]</li>\n<li>ports: squid 4.8[12]</li>\n</ul>\n\n<blockquote>\n<p>Stay safe and hydrated, Your OPNsense team</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxARCShrinkage\" rel=\"nofollow\">ZFS on Linux still has annoying issues with ARC size</a></h3>\n\n<p><code>One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS&#39;s auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.</code></p>\n\n<blockquote>\n<p>Linux&#39;s regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there&#39;s very little memory actually free, but at least you&#39;re getting value from your RAM. This is so reliable and regular that we generally don&#39;t think about &#39;is my system going to use all of my RAM as a disk cache&#39;, because the answer is always &#39;yes&#39;. (The general filesystem cache is also called the page cache.)</p>\n\n<p>This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn&#39;t necessarily the case even on Solaris). ZFS has both a current size and a &#39;target size&#39; for the ARC (called &#39;c&#39; in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that&#39;s its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn&#39;t currently expose enough statistics to tell why your ARC target size shrunk in any particular case).</p>\n\n<p>The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux&#39;s normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-June/718989.html\" rel=\"nofollow\">Hammer2 is now default</a></h3>\n\n<pre><code>commit a49112761c919d42d405ec10252eb0553662c824\nAuthor: Matthew Dillon &lt;dillon at apollo.backplane.com&gt;\nDate:   Mon Jun 10 17:53:46 2019 -0700\n\n    installer - Default to HAMMER2\n\n    * Change the installer default from HAMMER1 to HAMMER2.\n\n    * Adjust the nrelease build to print the location of the image files\n      when it finishes.\n\nSummary of changes:\n nrelease/Makefile                          |  2 +-\n usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------\n 2 files changed, 11 insertions(+), 11 deletions(-)\n\nhttp://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824\n</code></pre>\n\n<hr>\n\n<h3><a href=\"https://netbsd.org/gallery/presentations/nia/netbsd-audio/\" rel=\"nofollow\">NetBSD audio – an application perspective</a></h3>\n\n<blockquote>\n<p>NetBSD audio – an application perspective ... or, &quot;doing it natively, because we can&quot;</p>\n</blockquote>\n\n<ul>\n<li><p>audio options for NetBSD in pkgsrc</p>\n\n<ul>\n<li>Use NetBSD native audio (sun audio/audioio.h)</li>\n<li>Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff</li>\n</ul></li>\n<li><p>Many many abstraction layers available:</p>\n\n<ul>\n<li>OpenAL-Soft</li>\n<li>alsa-lib (config file required)</li>\n<li>libao, GStreamer (plugins!)</li>\n<li>PortAudio, SDL</li>\n<li>PulseAudio, JACK</li>\n<li>... lots more!? some obsolete stuff (esd, nas?)</li>\n</ul></li>\n<li><p>Advantages of using NetBSD audio directly</p>\n\n<ul>\n<li>Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)</li>\n<li>Query device information: Is /dev/audio1 a USB microphone or another sound card?</li>\n<li>Avoid bugs from excessive layering</li>\n<li>Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]</li>\n<li>Your code might work on illumos too</li>\n</ul></li>\n<li><p>[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don&#39;t know why.]</p></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/new-freenas-mini-models-release-pr/\" rel=\"nofollow\">New FreeNAS Mini</a></h3>\n\n<blockquote>\n<p>Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:</p>\n\n<p>FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.</p>\n\n<p>FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://mail-index.netbsd.org/source-changes/2019/07/30/msg107671.html\" rel=\"nofollow\">Welcome to NetBSD 9.99.1!</a></li>\n<li><a href=\"http://blog.snailtext.com/posts/berkeley-smorgasbord-part-2.html\" rel=\"nofollow\">Berkeley smorgasbord — part II</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=Brt41xnMZqo&list=PLuJmmKtsV1dOTmlImlD9U5j1P1rLxS2V8&index=20&t=0s\" rel=\"nofollow\">dtracing postgres</a></li>\n<li><a href=\"https://project-trident.org/post/2019-07-30_19.07-u1_available/\" rel=\"nofollow\">Project Trident 19.07-U1 now available</a></li>\n<li><a href=\"https://www.devprojournal.com/technology-trends/operating-systems/need-a-secure-operating-system-take-a-look-at-openbsd/\" rel=\"nofollow\">Need a Secure Operating System? Take a Look at OpenBSD</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Jeff - <a href=\"http://dpaste.com/2AT7JGP#wrap\" rel=\"nofollow\">OpenZFS Port Testing Feedback</a></li>\n<li>Malcolm - <a href=\"http://dpaste.com/1R170D7\" rel=\"nofollow\">Best Practices for Custom Ports</a></li>\n<li>Michael - <a href=\"http://dpaste.com/0CERP6R\" rel=\"nofollow\">Little Correction</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0310.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"\r\nOPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. ","date_published":"2019-08-07T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/11bc3886-8630-42e4-8ce6-a97cfce82f4d.mp3","mime_type":"audio/mp3","size_in_bytes":34679977,"duration_in_seconds":2889}]},{"id":"630a645e-fe37-4a56-a2fd-8c51abb5dfe5","title":"Episode 309: Get Your Telnet Fix","url":"https://www.bsdnow.tv/309","content_text":"DragonFlyBSD Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD and an OpenSSH vuln, and more.\n\nHeadlines\n\nDragonFlyBSD Project Update - colo upgrade, future trends\n\n\nFor the last week I've been testing out a replacement for Monster, our 48-core opteron server.  The project will be removing Monster from the colo in a week or two and replacing it with three machines which together will use half the power that Monster did alone.\n\nThe goal is to clear out a little power budget in the colo and to really beef-up our package-building capabilities to reduce the turn-around time needed to test ports syncs and updates to the binary package system.\n\nCurrently we use two blades to do most of the building, plus monster sometimes.  The blades take almost a week (120 hours+) to do a full synth run and monster takes around 27.5 hours.  But we need to do three bulk builds more or less at the same time... one for the release branch, one for the development branch, and one for staging updates.  It just takes too long and its been gnawing at me for a little while.\n\nWell, Zen 2 to the rescue!  These new CPUs can take ECC, there's actually an IPMI mobo available, and they are fast as hell and cheap for what we get. \n\nThe new machines will be two 3900X based servers, plus a dual-xeon system that I already had at home.   The 3900X's can each do a full synth run in 24.5 hours and the Xeon can do it in around 31 hours.  Monster will be retired.  And the crazy thing about this?  Monster burns 1000W going full bore.  Each of the 3900X servers burns 160W and the Xeon burns 200W.  In otherwords, we are replacing 1000W with only 520W and getting roughly 6x the performance efficiency in the upgrade.  This tell you just how much more power-efficient machines have become in the last 9 years or so. &gt; This upgrade will allow us to do full builds for both release and dev in roughly one day instead of seven days, and do it without interfering with staging work that might be happening at the same time.\n\nFuture trends - DragonFlyBSD has reached a bit of a cross-roads.  With most of the SMP work now essentially complete across the entire system the main project focus is now on supplying reliable binary ports for release and developer branches, DRM  (GPU) support and other UI elements to keep DragonFlyBSD relevant on workstations, and continuing Filesystem work on HAMMER2 to get multi-device and clustering going.\n\n\n\n\nResuming ZFS send\n\n\nOne of the amazing functionalities of ZFS is the possibility of sending a whole dataset from one place to another. This mechanism is amazing to create backups of your ZFS based machines. Although, there were some issues with this functionality for a long time when a user sent a big chunk of data. What if you would do that over the network and your connection has disappeared? What if your machine was rebooted as you are sending a snapshot?\n\nFor a very long time, you didn't have any options - you had to send a snapshot from the beginning. Now, this limitation was already bad enough. However, another downside of this approach was that all the data which you already send was thrown away. Therefore, ZFS had to go over all this data and remove them from the dataset. Imagine the terabytes of data which you sent via the network was thrown away because as you were sending the last few bytes, the network went off.\n\nIn this short post, I don't want to go over the whole ZFS snapshot infrastructure (if you think that such a post would be useful, please leave a comment). Now, to get back to the point, this infrastructure is used to clone the datasets. Some time ago a new feature called “Resuming ZFS send” was introduced. That means that if there was some problem with transmitting the dataset from one point to another you could resume it or throw them away. But the point is, that yes, you finally have a choice.\n\n\n\n\nNews Roundup\n\nRealtime bandwidth terminal graph visualization\n\n\nIf for some reasons you want to visualize your bandwidth traffic on an interface (in or out) in a terminal with a nice graph, here is a small script to do so, involving ttyplot, a nice software making graphics in a terminal.\n\nThe following will works on OpenBSD. You can install ttyplot by pkg_add ttyplot as root, ttyplot package appeared since OpenBSD 6.5.\n\n\n\n\nfixing telnet fixes\n\n\nThere’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.\n\n\nThe first line is indented with spaces while the others use tabs.\nThe correct type for string length is size_t not unsigned int.\nsizeof(char) is always one. There’s no need to multiply by it.\nIf you do need to multiply by a size, this is an unsafe pattern.  Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)\nReturn value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.\nReturn value of malloc is not checked for NULL.\nNo reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?\nThe whole operation could be simplified by using asprintf.\nAlthough unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.\n\n\n\n\n\nA Chapter from the FBI’s History with OpenBSD and an OpenSSH Vuln\n\n\nEarlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs (https://marc.info/?l=openbsd-tech&amp;m=129236621626462 …) Today, I got an interesting but unexpected responsive record: \n\n\n\nFreedom of Information Act: FBI: OpenBSD \nGitHub Repo\n\n\n\n\nBeastie Bits\n\n\n“Sudo Mastery, 2nd Edition” open for tech review\nFreeBSD Journal: FreeBSD for Makers\nOpenBSD and NetBSD machines at Open Source Conference 2019 Nagoya\nFreeBSD 12.0: WINE Gaming\nIntroduction to the Structure and Interpretation of TNF (The NetBSD Foundation)\nvBSDcon speakers announced\n\n\n\n\nFeedback/Questions\n\n\nPat - NYCBug Aug 7th\nTyler - SSH keys vs password\nLars - Tor-Talk\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>DragonFlyBSD Project Update - colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD and an OpenSSH vuln, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://lists.dragonflybsd.org/pipermail/users/2019-July/358226.html\" rel=\"nofollow\">DragonFlyBSD Project Update - colo upgrade, future trends</a></h3>\n\n<blockquote>\n<p>For the last week I&#39;ve been testing out a replacement for Monster, our 48-core opteron server.  The project will be removing Monster from the colo in a week or two and replacing it with three machines which together will use half the power that Monster did alone.</p>\n\n<p>The goal is to clear out a little power budget in the colo and to really beef-up our package-building capabilities to reduce the turn-around time needed to test ports syncs and updates to the binary package system.</p>\n\n<p>Currently we use two blades to do most of the building, plus monster sometimes.  The blades take almost a week (120 hours+) to do a full synth run and monster takes around 27.5 hours.  But we need to do three bulk builds more or less at the same time... one for the release branch, one for the development branch, and one for staging updates.  It just takes too long and its been gnawing at me for a little while.</p>\n\n<p>Well, Zen 2 to the rescue!  These new CPUs can take ECC, there&#39;s actually an IPMI mobo available, and they are fast as hell and cheap for what we get. </p>\n\n<p>The new machines will be two 3900X based servers, plus a dual-xeon system that I already had at home.   The 3900X&#39;s can each do a full synth run in 24.5 hours and the Xeon can do it in around 31 hours.  Monster will be retired.  And the crazy thing about this?  Monster burns 1000W going full bore.  Each of the 3900X servers burns 160W and the Xeon burns 200W.  In otherwords, we are replacing 1000W with only 520W and getting roughly 6x the performance efficiency in the upgrade.  This tell you just how much more power-efficient machines have become in the last 9 years or so. &gt; This upgrade will allow us to do full builds for both release and dev in roughly one day instead of seven days, and do it without interfering with staging work that might be happening at the same time.</p>\n\n<p>Future trends - DragonFlyBSD has reached a bit of a cross-roads.  With most of the SMP work now essentially complete across the entire system the main project focus is now on supplying reliable binary ports for release and developer branches, DRM  (GPU) support and other UI elements to keep DragonFlyBSD relevant on workstations, and continuing Filesystem work on HAMMER2 to get multi-device and clustering going.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.oshogbo.vexillium.org/blog/66/\" rel=\"nofollow\">Resuming ZFS send</a></h3>\n\n<blockquote>\n<p>One of the amazing functionalities of ZFS is the possibility of sending a whole dataset from one place to another. This mechanism is amazing to create backups of your ZFS based machines. Although, there were some issues with this functionality for a long time when a user sent a big chunk of data. What if you would do that over the network and your connection has disappeared? What if your machine was rebooted as you are sending a snapshot?</p>\n\n<p>For a very long time, you didn&#39;t have any options - you had to send a snapshot from the beginning. Now, this limitation was already bad enough. However, another downside of this approach was that all the data which you already send was thrown away. Therefore, ZFS had to go over all this data and remove them from the dataset. Imagine the terabytes of data which you sent via the network was thrown away because as you were sending the last few bytes, the network went off.</p>\n\n<p>In this short post, I don&#39;t want to go over the whole ZFS snapshot infrastructure (if you think that such a post would be useful, please leave a comment). Now, to get back to the point, this infrastructure is used to clone the datasets. Some time ago a new feature called “Resuming ZFS send” was introduced. That means that if there was some problem with transmitting the dataset from one point to another you could resume it or throw them away. But the point is, that yes, you finally have a choice.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2019-07-19-ttyplot-netstat-openbsd.html\" rel=\"nofollow\">Realtime bandwidth terminal graph visualization</a></h3>\n\n<blockquote>\n<p>If for some reasons you want to visualize your bandwidth traffic on an interface (in or out) in a terminal with a nice graph, here is a small script to do so, involving ttyplot, a nice software making graphics in a terminal.</p>\n\n<p>The following will works on OpenBSD. You can install ttyplot by pkg_add ttyplot as root, ttyplot package appeared since OpenBSD 6.5.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://flak.tedunangst.com/post/fixing-telnet-fixes\" rel=\"nofollow\">fixing telnet fixes</a></h3>\n\n<blockquote>\n<p>There’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.</p>\n\n<ol>\n<li><p>The first line is indented with spaces while the others use tabs.</p></li>\n<li><p>The correct type for string length is size_t not unsigned int.</p></li>\n<li><p>sizeof(char) is always one. There’s no need to multiply by it.</p></li>\n<li><p>If you do need to multiply by a size, this is an unsafe pattern.  Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)</p></li>\n<li><p>Return value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.</p></li>\n<li><p>Return value of malloc is not checked for NULL.</p></li>\n<li><p>No reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?</p></li>\n<li><p>The whole operation could be simplified by using asprintf.</p></li>\n<li><p>Although unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.</p></li>\n</ol>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://twitter.com/RooneyMcNibNug/status/1152327783055601664\" rel=\"nofollow\">A Chapter from the FBI’s History with OpenBSD and an OpenSSH Vuln</a></h3>\n\n<blockquote>\n<p>Earlier this year I FOIAed the FBI for details on allegations of backdoor installed in the IPSEC stack in 2010, originally discussed by OpenBSD devs (<a href=\"https://marc.info/?l=openbsd-tech&m=129236621626462\" rel=\"nofollow\">https://marc.info/?l=openbsd-tech&amp;m=129236621626462</a> …) Today, I got an interesting but unexpected responsive record: </p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.muckrock.com/foi/united-states-of-america-10/foia-fbi-openbsd-70084/\" rel=\"nofollow\">Freedom of Information Act: FBI: OpenBSD</a> </li>\n<li><a href=\"https://github.com/RooneyMcNibNug/FOIA/blob/master/Responsive%20Docs/OpenBSD/FBI_OpenBSD_response_OCRd.pdf\" rel=\"nofollow\">GitHub Repo</a></li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://mwl.io/archives/4378\" rel=\"nofollow\">“Sudo Mastery, 2nd Edition” open for tech review</a></li>\n<li><a href=\"https://www.freebsdnews.com/2019/07/12/freebsd-journal-freebsd-for-makers/\" rel=\"nofollow\">FreeBSD Journal: FreeBSD for Makers</a></li>\n<li><a href=\"http://mail-index.netbsd.org/netbsd-advocacy/2019/07/19/msg000808.html\" rel=\"nofollow\">OpenBSD and NetBSD machines at Open Source Conference 2019 Nagoya</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=zuj9pRNR2oM\" rel=\"nofollow\">FreeBSD 12.0: WINE Gaming</a></li>\n<li><a href=\"https://www.netbsd.org/gallery/presentations/wiz/pkgsrccon2019/index.html#/\" rel=\"nofollow\">Introduction to the Structure and Interpretation of TNF (The NetBSD Foundation)</a></li>\n<li><a href=\"https://www.vbsdcon.com/\" rel=\"nofollow\">vBSDcon speakers announced</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Pat - <a href=\"http://dpaste.com/21Y1PRM\" rel=\"nofollow\">NYCBug Aug 7th</a></li>\n<li>Tyler - <a href=\"http://dpaste.com/3JEVVEF#wrap\" rel=\"nofollow\">SSH keys vs password</a></li>\n<li>Lars - <a href=\"http://dpaste.com/0RAFMXZ\" rel=\"nofollow\">Tor-Talk</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0309.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"\r\nDragonFlyBSD Project colo upgrade, future trends, resuming ZFS send, realtime bandwidth terminal graph visualization, fixing telnet fixes, a chapter from the FBI’s history with OpenBSD, an OpenSSH vulnerability, and more.","date_published":"2019-07-31T23:45:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/630a645e-fe37-4a56-a2fd-8c51abb5dfe5.mp3","mime_type":"audio/mp3","size_in_bytes":34856460,"duration_in_seconds":2904}]},{"id":"583db96b-f838-461b-a366-c6d49825c5be","title":"308: Mumbling with OpenBSD","url":"https://www.bsdnow.tv/308","content_text":"Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.\n\nHeadlines\n\nReplacing a (silently) failing disk in a ZFS pool\n\n\nMaybe I can’t read, but I have the feeling that official documentations explain every single corner case for a given tool, except the one you will actually need. My today’s struggle: replacing a disk within a FreeBSD ZFS pool.\nWhat? there’s a shitton of docs on this topic! Are you stupid?\nI don’t know, maybe. Yet none covered the process in a simple, straight and complete manner.\n\n\n\n\nOPNsense 19.7 RC1 released\n\n\nHi there,\nFor four and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.\nWe thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you.\nDownload links, an installation guide[1] and the checksums for the images can be found below as well.\n\n\n\n\nNews Roundup\n\nImplementation of DRM ioctl Support for NetBSD kernel\n\n\nWhat is DRM ioctl ?\n\n\n\nIoctls are input/output control system calls and DRM stands for direct rendering manager The DRM layer provides several services to graphics drivers, many of them driven by the application interfaces it provides through libdrm, the library that wraps most of the DRM ioctls. These include vblank event handling, memory management, output management, framebuffer management, command submission &amp; fencing, suspend/resume support, and DMA services.\n\n\n\nNative DRM ioctl calls\n\n\n\nNetBSD was able to make native DRM ioctl calls with hardware rendering once xorg and proper mesa packages where installed. We used the glxinfo and glxgears applications to test this out.\n\n\n\n\nHigh quality / low latency VOIP server with umurmur/Mumble on OpenBSD\n\n\nDiscord users keep telling about their so called discord server, which is not dedicated to them at all. And Discord has a very bad quality and a lot of voice distorsion.\nWhy not run your very own mumble server with high voice quality and low latency and privacy respect? This is very easy to setup on OpenBSD!\nMumble is an open source voip client, it has a client named Mumble (available on various operating system) and at least Android, the server part is murmur but there is a lightweight server named umurmur. People authentication is done through certificate generated locally and automatically accepted on a server, and the certificate get associated with a nickname. Nobody can pick the same nickname as another person if it’s not the same certificate.\n\n\n\n\nTMWL June’19 — JS Fetch API, scheduling in Spring, thoughts on Unix\n\n\nUnix — going back to the roots\n\n\n\nFrom time to time, I like to review my knowledge in a certain area, even when I feel like I know a lot about it already. I go back to the basics and read tutorials, manuals, books or watch interesting videos.\nI’ve been using macOS for a couple of years now, previously being a linux user for some (relatively short) time. Both these operating systems have a common ancestor — Unix. While I’m definitely not an expert, I feel quite comfortable using linux &amp; macOS — I understand the concepts behind the system architecture, know a lot of command line tools &amp; navigate through the shell without a hassle. So-called unix philosophy is also close to my heart. I always feel like there’s more I could squeeze out of it.\nRecently, I found that book titled “Unix for dummies, 5th edition” which was published back in… 2004. Feels literally like AGES in the computer-related world. However, it was a great shot — the book starts with the basics, providing some brief history of Unix and how it came to life. It talks a lot about the structure of the system and where certain pieces fit (eg. “standard” set of tools), and how to understand permissions and work with files &amp; directories. There’s even a whole chapter about shell-based text editors like Vi and Emacs! Despite the fact that I am familiar with most of these, I could still find some interesting pieces &amp; tools that I either knew existed (but never had a chance to use), or even haven’t ever heard of. And almost all of these are still valid in the modern “incarnations” of Unix’s descendants: Linux and macOS.\nThe book also talks about networking, surfing the web &amp; working with email. It’s cute to see pictures of those old browsers rendering “ancient” Internet websites, but hey — this is how it looked like no more than fifteen years ago!\nI can really recommend this book to anyone working on modern macOS or Linux — you will certainly find some interesting pieces. Especially if you like to go back to the roots from time to time as I do!\n\n\n\n\nThePDP-7 Where Unix Began\n\n\nIn preparation for a talk on Seventh Edition Unix this fall, I stumbled upon a service list from DEC for all known PDP-7 machines. From that list, and other sources, I believe that PDP-7 serial number 34 was the original Unix machine.\nV0 Unix could run on only one of the PDP-7s. Of the 99 PDP-7s produced, only two had disks. Serial number 14 had an RA01 listed, presumably a disk, though of a different type. In addition to the PDP-7 being obsolete in 1970, no other PDP-7 could run Unix, limiting its appeal outside of Bell Labs. By porting Unix to the PDP-11 in 1970, the group ensured Unix would live on into the future. The PDP-9 and PDP-15 were both upgrades of the PDP-7, so to be fair, PDP-7 Unix did have a natural upgrade path (the PDP-11 out sold the 18 bit systems though ~600,000 to ~1000). Ken Thompson reports in a private email that there were 2 PDP-9s and 1 PDP-15 at Bell Labs that could run a version of the PDP-7 Unix, though those machines were viewed as born obsolete.\n\n\n\n\nLLDB: watchpoints, XSTATE in ptrace() and core dumps\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD's ptrace interface to cover more register types and fix compat32 issues. You can read more about that in my May 2019 report.\nIn June, I have finally finished the remaining ptrace() work for xstate and got it merged both on NetBSD and LLDB end (meaning it's going to make it into NetBSD 9). I have also worked on debug register support in LLDB, effectively fixing watchpoint support. Once again I had to fight some upstream regressions.\n\n\nBeastie Bits\n\n\nProject Trident 19.07 Available\nA list of names from \"Cold Blood\" -- Any familiar?\nfern: a curses-based mastodon client modeled off usenet news readers &amp; pine, with an emphasis on getting to 'timeline zero'\nOpenBSD Community goes Platinum for 2019!\ntcp keepalive and dports on DragonFly\n\n\n\n\nFeedback/Questions\n\n\nPatrick - OpenZFS/ZoL Module from Ports\nBrad - Services not starting\nSimon - Feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://imil.net/blog/2019/07/02/Replacing-a-silently-failing-disk-in-a-ZFS-pool/\" rel=\"nofollow\">Replacing a (silently) failing disk in a ZFS pool</a></h3>\n\n<blockquote>\n<p>Maybe I can’t read, but I have the feeling that official documentations explain every single corner case for a given tool, except the one you will actually need. My today’s struggle: replacing a disk within a FreeBSD ZFS pool.<br>\nWhat? there’s a shitton of docs on this topic! Are you stupid?<br>\nI don’t know, maybe. Yet none covered the process in a simple, straight and complete manner.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://opnsense.org/opnsense-19-7-rc1-released/\" rel=\"nofollow\">OPNsense 19.7 RC1 released</a></h3>\n\n<blockquote>\n<p>Hi there,<br>\nFor four and a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>\nWe thank all of you for helping test, shape and contribute to the project! We know it would not be the same without you.<br>\nDownload links, an installation guide[1] and the checksums for the images can be found below as well.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/implementation_of_drm_ioctl_support\" rel=\"nofollow\">Implementation of DRM ioctl Support for NetBSD kernel</a></h3>\n\n<ul>\n<li>What is DRM ioctl ?</li>\n</ul>\n\n<blockquote>\n<p>Ioctls are input/output control system calls and DRM stands for direct rendering manager The DRM layer provides several services to graphics drivers, many of them driven by the application interfaces it provides through libdrm, the library that wraps most of the DRM ioctls. These include vblank event handling, memory management, output management, framebuffer management, command submission &amp; fencing, suspend/resume support, and DMA services.</p>\n</blockquote>\n\n<ul>\n<li>Native DRM ioctl calls</li>\n</ul>\n\n<blockquote>\n<p>NetBSD was able to make native DRM ioctl calls with hardware rendering once xorg and proper mesa packages where installed. We used the glxinfo and glxgears applications to test this out.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2019-07-04-umurmur.html\" rel=\"nofollow\">High quality / low latency VOIP server with umurmur/Mumble on OpenBSD</a></h3>\n\n<blockquote>\n<p>Discord users keep telling about their so called discord server, which is not dedicated to them at all. And Discord has a very bad quality and a lot of voice distorsion.<br>\nWhy not run your very own mumble server with high voice quality and low latency and privacy respect? This is very easy to setup on OpenBSD!<br>\nMumble is an open source voip client, it has a client named Mumble (available on various operating system) and at least Android, the server part is murmur but there is a lightweight server named umurmur. People authentication is done through certificate generated locally and automatically accepted on a server, and the certificate get associated with a nickname. Nobody can pick the same nickname as another person if it’s not the same certificate.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.softwaremill.com/tmwl-june19-js-fetch-api-scheduling-in-spring-thoughts-on-unix-fd54f50ecd64\" rel=\"nofollow\">TMWL June’19 — JS Fetch API, scheduling in Spring, thoughts on Unix</a></h3>\n\n<ul>\n<li>Unix — going back to the roots</li>\n</ul>\n\n<blockquote>\n<p>From time to time, I like to review my knowledge in a certain area, even when I feel like I know a lot about it already. I go back to the basics and read tutorials, manuals, books or watch interesting videos.<br>\nI’ve been using macOS for a couple of years now, previously being a linux user for some (relatively short) time. Both these operating systems have a common ancestor — Unix. While I’m definitely not an expert, I feel quite comfortable using linux &amp; macOS — I understand the concepts behind the system architecture, know a lot of command line tools &amp; navigate through the shell without a hassle. So-called unix philosophy is also close to my heart. I always feel like there’s more I could squeeze out of it.<br>\nRecently, I found that book titled “Unix for dummies, 5th edition” which was published back in… 2004. Feels literally like AGES in the computer-related world. However, it was a great shot — the book starts with the basics, providing some brief history of Unix and how it came to life. It talks a lot about the structure of the system and where certain pieces fit (eg. “standard” set of tools), and how to understand permissions and work with files &amp; directories. There’s even a whole chapter about shell-based text editors like Vi and Emacs! Despite the fact that I am familiar with most of these, I could still find some interesting pieces &amp; tools that I either knew existed (but never had a chance to use), or even haven’t ever heard of. And almost all of these are still valid in the modern “incarnations” of Unix’s descendants: Linux and macOS.<br>\nThe book also talks about networking, surfing the web &amp; working with email. It’s cute to see pictures of those old browsers rendering “ancient” Internet websites, but hey — this is how it looked like no more than fifteen years ago!<br>\nI can really recommend this book to anyone working on modern macOS or Linux — you will certainly find some interesting pieces. Especially if you like to go back to the roots from time to time as I do!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://bsdimp.blogspot.com/2019/07/the-pdp-7-where-unix-began.html\" rel=\"nofollow\">ThePDP-7 Where Unix Began</a></h3>\n\n<blockquote>\n<p>In preparation for a talk on Seventh Edition Unix this fall, I stumbled upon a service list from DEC for all known PDP-7 machines. From that list, and other sources, I believe that PDP-7 serial number 34 was the original Unix machine.<br>\nV0 Unix could run on only one of the PDP-7s. Of the 99 PDP-7s produced, only two had disks. Serial number 14 had an RA01 listed, presumably a disk, though of a different type. In addition to the PDP-7 being obsolete in 1970, no other PDP-7 could run Unix, limiting its appeal outside of Bell Labs. By porting Unix to the PDP-11 in 1970, the group ensured Unix would live on into the future. The PDP-9 and PDP-15 were both upgrades of the PDP-7, so to be fair, PDP-7 Unix did have a natural upgrade path (the PDP-11 out sold the 18 bit systems though ~600,000 to ~1000). Ken Thompson reports in a private email that there were 2 PDP-9s and 1 PDP-15 at Bell Labs that could run a version of the PDP-7 Unix, though those machines were viewed as born obsolete.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/lldb_watchpoints_xstate_in_ptrace\" rel=\"nofollow\">LLDB: watchpoints, XSTATE in ptrace() and core dumps</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types and fix compat32 issues. You can read more about that in my May 2019 report.<br>\nIn June, I have finally finished the remaining ptrace() work for xstate and got it merged both on NetBSD and LLDB end (meaning it&#39;s going to make it into NetBSD 9). I have also worked on debug register support in LLDB, effectively fixing watchpoint support. Once again I had to fight some upstream regressions.</p>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://project-trident.org/post/2019-07-12_19.07_available/\" rel=\"nofollow\">Project Trident 19.07 Available</a></li>\n<li><a href=\"https://www.montanalinux.org/cold-blood-list-of-numbers-201907.html\" rel=\"nofollow\">A list of names from &quot;Cold Blood&quot; -- Any familiar?</a></li>\n<li><a href=\"https://github.com/enkiv2/fern\" rel=\"nofollow\">fern: a curses-based mastodon client modeled off usenet news readers &amp; pine, with an emphasis on getting to &#39;timeline zero&#39;</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20190707065226\" rel=\"nofollow\">OpenBSD Community goes Platinum for 2019!</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/07/15/23199.html\" rel=\"nofollow\">tcp keepalive and dports on DragonFly</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Patrick - <a href=\"http://dpaste.com/1W2HJ04\" rel=\"nofollow\">OpenZFS/ZoL Module from Ports</a></li>\n<li>Brad - <a href=\"http://dpaste.com/345VM9Y#wrap\" rel=\"nofollow\">Services not starting</a></li>\n<li>Simon - <a href=\"http://dpaste.com/1B4ZKC8#wrap\" rel=\"nofollow\">Feedback</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0308.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Replacing a (silently) failing disk in a ZFS pool, OPNsense 19.7 RC1 released, implementing DRM ioctl support for NetBSD, High quality/low latency VOIP server with umurmur/Mumble on OpenBSD, the PDP-7 where Unix began, LLDB watchpoints, and more.","date_published":"2019-07-24T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/583db96b-f838-461b-a366-c6d49825c5be.mp3","mime_type":"audio/mp3","size_in_bytes":31984767,"duration_in_seconds":2665}]},{"id":"1bd153c0-be65-44ed-8f12-f73d97e93d8b","title":"307: Twitching with OpenBSD","url":"https://www.bsdnow.tv/307","content_text":"FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.\n\nHeadlines\n\nFreeBSD 11.3-RELEASE Announcement\n\n\nThe FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 11.3-RELEASE. This is the fourth release of the stable/11 branch.\n\n\n\nSome of the highlights:\n\n\nThe clang, llvm, lld, lldb, and compiler-rt utilities as well as libc++ have been updated to upstream version 8.0.0.\nThe ELF Tool Chain has been updated to version r3614.\nOpenSSL has been updated to version 1.0.2s.\nThe ZFS filesystem has been updated to implement parallel mounting.\nThe loader(8) has been updated to extend geli(8) support to all architectures.\nThe pkg(8) utility has been updated to version 1.10.5.\nThe KDE desktop environment has been updated to version 5.15.3.\nThe GNOME desktop environment has been updated to version 3.28.\nThe kernel will now log the jail(8) ID when logging a process exit.\nSeveral feature additions and updates to userland applications.\nSeveral network driver firmware updates.\nWarnings for features deprecated in future releases will now be printed on all FreeBSD versions.\nWarnings have been added for IPSec algorithms deprecated in RFC 8221.\nDeprecation warnings have been added for weaker algorithms when creating geli(8) providers.\nAnd more...\n\n\n\n\n\nOpenBSD Is Now My Workstation\n\n\nWhy OpenBSD? Simply because it is the best tool for the job for me for my new-to-me Lenovo Thinkpad T420. Additionally, I do care about security and non-bloat in my personal operating systems (business needs can have different priorities, to be clear).\n\nI will try to detail what my reasons are for going with OpenBSD (instead of GNU/Linux, NetBSD, or FreeBSD of which I’m comfortable using without issue), challenges and frustrations I’ve encountered, and what my opinions are along the way.\n\nDisclaimer: in this post, I’m speaking about what is my opinion, and I’m not trying to convince you to use OpenBSD or anything else. I don’t truly care, but wanted to share in case it could be useful to you. I do hope you give OpenBSD a shot as your workstation, especially if it has been a while.\n\n\n\nA Bit About Me and OpenBSD\n\n\n\nI’m not new to OpenBSD, to be clear. I’ve been using it off and on for over 20 years. The biggest time in my life was the early 2000s (I was even the Python port maintainer for a bit), where I not only used it for my workstation, but also for production servers and network devices.\n\nI just haven’t used it as a workstation (outside of a virtual machine) in over 10 years, but have used it for servers. Workstation needs, especially for a primary workstation, are greatly different and the small things end up mattering most.\n\n\n\n\nNews Roundup\n\nWrite your own fuzzer for NetBSD kernel! [Part 1]\n\n\nHow Fuzzing works? The dummy Fuzzer.\n\n\n\nThe easy way to describe fuzzing is to compare it to the process of unit testing a program, but with different input. This input can be random, or it can be generated in some way that makes it unexpected form standard execution perspective.\n\nThe simplest 'fuzzer' can be written in few lines of bash, by getting N bytes from /dev/rand, and putting them to the program as a parameter.\n\n\n\nCoverage and Fuzzing\n\n\n\nWhat can be done to make fuzzing more effective? If we think about fuzzing as a process, where we place data into the input of the program (which is a black box), and we can only interact via input, not much more can be done.\n\nHowever, programs usually process different inputs at different speeds, which can give us some insight into the program's behavior. During fuzzing, we are trying to crash the program, thus we need additional probes to observe the program's behaviour.\n\nAdditional knowledge about program state can be exploited as a feedback loop for generating new input vectors. Knowledge about the program itself and the structure of input data can also be considered. As an example, if the input data is in the form of HTML, changing characters inside the body will probably cause less problems for the parser than experimenting with headers and HTML tags.\n\nFor open source programs, we can read the source code to know what input takes which execution path. Nonetheless, this might be very time consuming, and it would be much more helpful if this can be automated. As it turns out, this process can be improved by tracing coverage of the execution\n\n\n\n\nvBSDcon - CFP - Call for Papers ends July 19th\n\n\nYou can submit your proposal at https://easychair.org/conferences/?conf=vbsdcon2019\n\nThe talks will have a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.\n\nIf you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal.\n\nPossible topics include: How we manage a giant installation with respect to handling spam, snd/or sysadmin, and/or networking, Cool new stuff in BSD, Tell us about your project which runs on BSD.\n\nBoth users and developers are encouraged to share their experiences.\n\n\n\n\nExploiting FreeBSD-SA-19:02.fd\n\n\nIn February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors. UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.\n\nInside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.\n\nWhat really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.\n\nThe advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.\n\nThe advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.\n\n\n\nIn the next section, the bug itself is analyzed to make a statement about the bug class and a guess about a possible exploitation primitive.\nAfter that, the bug trigger is addressed.\nIt follows a discussion of three imaginable exploitation strategies - including a discussion of why two of these approaches failed.\nIn the section before last, the working exploit primitive is discussed. It introduces a (at least to the author’s knowledge) new exploitation technique for these kind of vulnerabilities in FreeBSD. The stabilization of the exploit is addressed, too.\nThe last section wraps everything up in a conclusion and points out further steps and challenges.\n\n\n\nThe privilege escalation is now a piece of cake thanks to a technique used by kingcope, who published a FreeBSD root exploit in 2005, which writes to the file /etc/libmap.conf. This configuration file can be used to hook the loading of dynamic libraries if a program is started. The exploit therefore creates a dynamic library, which copies /bin/sh to another file and sets the suid-bit for the copy. The hooked library is libutil, which is for instance called by su. Therefore, a call to su by the user will afterwards result in a suid copy of /bin/sh.\n\n\n\n\nStreaming to Twitch using OpenBSD\n\n\n Introduction\n\n\n\nIf you ever wanted to make a twitch stream from your OpenBSD system, this is now possible, thanks to OpenBSD developer thfr@ who made a wrapper named fauxstream using ffmpeg with relevant parameters.\n\nThe setup is quite easy, it only requires a few steps and searching on Twitch website two informations, hopefully, to ease the process, I found the links for you.\n\nYou will need to make an account on twitch, get your api key (a long string of characters) which should stay secret because it allow anyone having it to stream on your account.\n\n\n\nThese same techniques should work for Twitch, YouTube Live, Periscope, Facebook, etc, including the live streaming service ScaleEngine provides free to BSD user groups.\nThere is also an open source application called ‘OBS’ or Open Broadcaster Studio. It is in FreeBSD ports and should work on all of the other BSDs as well. It has a GUI and supports compositing and green screening. We use it heavily at ScaleEngine and it is also used at JupiterBroadcasting in place of WireCast, a $1000-per-copy commercial application.\n\n\n\n\nBeastie Bits\n\n\nPortland BSD Pizza Night - 2019-07-25 19:00 - Rudy's Gourmet Pizza\nKnoxBUG - Michael W. Lucas : Twenty Years in Jail\nOhio Linuxfest - CFP - Closes August 17th\nMy college (NYU Tandon) is moving their CS department and I saw this on a shelf being moved\n3 different ways of dumping hex contents of a file\n\n\n\n\nFeedback/Questions\n\n\nSebastian - ZFS setup toward ESXi\nChristopher - Questions\nSer - Bhyve and Microsoft SQL\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsd.org/releases/11.3R/announce.html\" rel=\"nofollow\">FreeBSD 11.3-RELEASE Announcement</a></h3>\n\n<blockquote>\n<p>The FreeBSD Release Engineering Team is pleased to announce the availability of FreeBSD 11.3-RELEASE. This is the fourth release of the stable/11 branch.</p>\n</blockquote>\n\n<ul>\n<li>Some of the highlights:\n\n<ul>\n<li>The clang, llvm, lld, lldb, and compiler-rt utilities as well as libc++ have been updated to upstream version 8.0.0.</li>\n<li>The ELF Tool Chain has been updated to version r3614.</li>\n<li>OpenSSL has been updated to version 1.0.2s.</li>\n<li>The ZFS filesystem has been updated to implement parallel mounting.</li>\n<li>The loader(8) has been updated to extend geli(8) support to all architectures.</li>\n<li>The pkg(8) utility has been updated to version 1.10.5.</li>\n<li>The KDE desktop environment has been updated to version 5.15.3.</li>\n<li>The GNOME desktop environment has been updated to version 3.28.</li>\n<li>The kernel will now log the jail(8) ID when logging a process exit.</li>\n<li>Several feature additions and updates to userland applications.</li>\n<li>Several network driver firmware updates.</li>\n<li>Warnings for features deprecated in future releases will now be printed on all FreeBSD versions.</li>\n<li>Warnings have been added for IPSec algorithms deprecated in RFC 8221.</li>\n<li>Deprecation warnings have been added for weaker algorithms when creating geli(8) providers.</li>\n<li>And more...</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://sogubsys.com/openbsd-is-now-my-workstation-operating-system/\" rel=\"nofollow\">OpenBSD Is Now My Workstation</a></h3>\n\n<blockquote>\n<p>Why OpenBSD? Simply because it is the best tool for the job for me for my new-to-me Lenovo Thinkpad T420. Additionally, I do care about security and non-bloat in my personal operating systems (business needs can have different priorities, to be clear).</p>\n\n<p>I will try to detail what my reasons are for going with OpenBSD (instead of GNU/Linux, NetBSD, or FreeBSD of which I’m comfortable using without issue), challenges and frustrations I’ve encountered, and what my opinions are along the way.</p>\n\n<p>Disclaimer: in this post, I’m speaking about what is my opinion, and I’m not trying to convince you to use OpenBSD or anything else. I don’t truly care, but wanted to share in case it could be useful to you. I do hope you give OpenBSD a shot as your workstation, especially if it has been a while.</p>\n</blockquote>\n\n<ul>\n<li>A Bit About Me and OpenBSD</li>\n</ul>\n\n<blockquote>\n<p>I’m not new to OpenBSD, to be clear. I’ve been using it off and on for over 20 years. The biggest time in my life was the early 2000s (I was even the Python port maintainer for a bit), where I not only used it for my workstation, but also for production servers and network devices.</p>\n\n<p>I just haven’t used it as a workstation (outside of a virtual machine) in over 10 years, but have used it for servers. Workstation needs, especially for a primary workstation, are greatly different and the small things end up mattering most.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/write_your_own_fuzzer_for\" rel=\"nofollow\">Write your own fuzzer for NetBSD kernel! [Part 1]</a></h3>\n\n<ul>\n<li>How Fuzzing works? The dummy Fuzzer.</li>\n</ul>\n\n<blockquote>\n<p>The easy way to describe fuzzing is to compare it to the process of unit testing a program, but with different input. This input can be random, or it can be generated in some way that makes it unexpected form standard execution perspective.</p>\n\n<p>The simplest &#39;fuzzer&#39; can be written in few lines of bash, by getting N bytes from /dev/rand, and putting them to the program as a parameter.</p>\n</blockquote>\n\n<ul>\n<li>Coverage and Fuzzing</li>\n</ul>\n\n<blockquote>\n<p>What can be done to make fuzzing more effective? If we think about fuzzing as a process, where we place data into the input of the program (which is a black box), and we can only interact via input, not much more can be done.</p>\n\n<p>However, programs usually process different inputs at different speeds, which can give us some insight into the program&#39;s behavior. During fuzzing, we are trying to crash the program, thus we need additional probes to observe the program&#39;s behaviour.</p>\n\n<p>Additional knowledge about program state can be exploited as a feedback loop for generating new input vectors. Knowledge about the program itself and the structure of input data can also be considered. As an example, if the input data is in the form of HTML, changing characters inside the body will probably cause less problems for the parser than experimenting with headers and HTML tags.</p>\n\n<p>For open source programs, we can read the source code to know what input takes which execution path. Nonetheless, this might be very time consuming, and it would be much more helpful if this can be automated. As it turns out, this process can be improved by tracing coverage of the execution</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://vbsdcon.com/\" rel=\"nofollow\">vBSDcon - CFP - Call for Papers ends July 19th</a></h3>\n\n<blockquote>\n<p>You can submit your proposal at <a href=\"https://easychair.org/conferences/?conf=vbsdcon2019\" rel=\"nofollow\">https://easychair.org/conferences/?conf=vbsdcon2019</a></p>\n\n<p>The talks will have a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p>\n\n<p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal.</p>\n\n<p>Possible topics include: How we manage a giant installation with respect to handling spam, snd/or sysadmin, and/or networking, Cool new stuff in BSD, Tell us about your project which runs on BSD.</p>\n\n<p>Both users and developers are encouraged to share their experiences.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://secfault-security.com/blog/FreeBSD-SA-1902.fd.html\" rel=\"nofollow\">Exploiting FreeBSD-SA-19:02.fd</a></h3>\n\n<blockquote>\n<p>In February 2019 the FreeBSD project issued an advisory about a possible vulnerability in the handling of file descriptors. UNIX-like systems such as FreeBSD allow to send file descriptors to other processes via UNIX-domain sockets. This can for example be used to pass file access privileges to the receiving process.</p>\n\n<p>Inside the kernel, file descriptors are used to indirectly reference a C struct which stores the relevant information about the file object. This could for instance include a reference to a vnode which describes the file for the file system, the file type, or the access privileges.</p>\n\n<p>What really happens if a UNIX-domain socket is used to send a file descriptor to another process is that for the receiving process, inside the kernel a reference to this struct is created. As the new file descriptor is a reference to the same file object, all information is inherited. For instance, this can allow to give another process write access to a file on the drive even if the process owner is normally not able to open the file writable.</p>\n\n<p>The advisory describes that FreeBSD 12.0 introduced a bug in this mechanism. As the file descriptor information is sent via a socket, the sender and the receiver have to allocate buffers for the procedure. If the receiving buffer is not large enough, the FreeBSD kernel attempts to close the received file descriptors to prevent a leak of these to the sender. However, while the responsible function closes the file descriptor, it fails to release the reference from the file descriptor to the file object. This could cause the reference counter to wrap.</p>\n\n<p>The advisory further states that the impact of this bug is possibly a local privilege escalation to gain root privileges or a jail escape. However, no proof-of-concept was provided by the advisory authors.</p>\n</blockquote>\n\n<ul>\n<li>In the next section, the bug itself is analyzed to make a statement about the bug class and a guess about a possible exploitation primitive.</li>\n<li>After that, the bug trigger is addressed.</li>\n<li>It follows a discussion of three imaginable exploitation strategies - including a discussion of why two of these approaches failed.</li>\n<li>In the section before last, the working exploit primitive is discussed. It introduces a (at least to the author’s knowledge) new exploitation technique for these kind of vulnerabilities in FreeBSD. The stabilization of the exploit is addressed, too.</li>\n<li>The last section wraps everything up in a conclusion and points out further steps and challenges.</li>\n</ul>\n\n<blockquote>\n<p>The privilege escalation is now a piece of cake thanks to a technique used by kingcope, who published a FreeBSD root exploit in 2005, which writes to the file /etc/libmap.conf. This configuration file can be used to hook the loading of dynamic libraries if a program is started. The exploit therefore creates a dynamic library, which copies /bin/sh to another file and sets the suid-bit for the copy. The hooked library is libutil, which is for instance called by su. Therefore, a call to su by the user will afterwards result in a suid copy of /bin/sh.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://dataswamp.org/%7Esolene/2019-07-06-twitch.html\" rel=\"nofollow\">Streaming to Twitch using OpenBSD</a></h3>\n\n<ul>\n<li> Introduction</li>\n</ul>\n\n<blockquote>\n<p>If you ever wanted to make a twitch stream from your OpenBSD system, this is now possible, thanks to OpenBSD developer thfr@ who made a wrapper named fauxstream using ffmpeg with relevant parameters.</p>\n\n<p>The setup is quite easy, it only requires a few steps and searching on Twitch website two informations, hopefully, to ease the process, I found the links for you.</p>\n\n<p>You will need to make an account on twitch, get your api key (a long string of characters) which should stay secret because it allow anyone having it to stream on your account.</p>\n</blockquote>\n\n<ul>\n<li>These same techniques should work for Twitch, YouTube Live, Periscope, Facebook, etc, including the live streaming service ScaleEngine provides free to BSD user groups.</li>\n<li>There is also an open source application called ‘OBS’ or Open Broadcaster Studio. It is in FreeBSD ports and should work on all of the other BSDs as well. It has a GUI and supports compositing and green screening. We use it heavily at ScaleEngine and it is also used at JupiterBroadcasting in place of WireCast, a $1000-per-copy commercial application.</li>\n</ul>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://calagator.org/events/1250475868\" rel=\"nofollow\">Portland BSD Pizza Night - 2019-07-25 19:00 - Rudy&#39;s Gourmet Pizza</a></li>\n<li><a href=\"http://knoxbug.org/2019-07-29\" rel=\"nofollow\">KnoxBUG - Michael W. Lucas : Twenty Years in Jail</a></li>\n<li><a href=\"https://ohiolinux.org/call-for-presentations/\" rel=\"nofollow\">Ohio Linuxfest - CFP - Closes August 17th</a></li>\n<li><a href=\"https://old.reddit.com/r/freebsd/comments/cdx8fp/my_college_nyu_tandon_is_moving_their_cs/\" rel=\"nofollow\">My college (NYU Tandon) is moving their CS department and I saw this on a shelf being moved</a></li>\n<li><a href=\"https://moopost.blogspot.com/2019/07/3-different-ways-of-dumping-hex.html\" rel=\"nofollow\">3 different ways of dumping hex contents of a file</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Sebastian - <a href=\"http://dpaste.com/0DRKFH6#wrap\" rel=\"nofollow\">ZFS setup toward ESXi</a></li>\n<li>Christopher - <a href=\"http://dpaste.com/2YNN1SH\" rel=\"nofollow\">Questions</a></li>\n<li>Ser - <a href=\"http://dpaste.com/1F5TMT0#wrap\" rel=\"nofollow\">Bhyve and Microsoft SQL</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0307.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD 11.3 has been released, OpenBSD workstation, write your own fuzzer for the NetBSD kernel, Exploiting FreeBSD-SA-19:02.fd, streaming to twitch using OpenBSD, 3 different ways of dumping hex contents of a file, and more.","date_published":"2019-07-18T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1bd153c0-be65-44ed-8f12-f73d97e93d8b.mp3","mime_type":"audio/mp3","size_in_bytes":36709691,"duration_in_seconds":3059}]},{"id":"2e907009-f426-4bbd-a592-d91329f11f0f","title":"306: Comparing Hammers","url":"https://www.bsdnow.tv/306","content_text":"Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.\n\n\n\nHeadlines\n\nPolprog's Am5x86 based retro UNIX build log\n\n\nI have recently acquired an Am5x86 computer, in a surprisingly good condition. This is an ongoing project, check this page often for updates!\n\nI began by connecting a front panel. The panel came from a different chassis and is slightly too wide, so I had to attach it with a couple of zip-ties. However, that makes it stick out from the PC front at an angle, allowing easy access when the computer sits at the floor - and thats where it is most of the time. It's not that bad, to be honest, and its way easier to access than it would be, if mounted vertically\n\nThere is a mains switch on the front panel because the computer uses an older style power supply. Those power supplies instead of relying on a PSON signal, like modern ATX supplies, run a 4 wire cable to a mains switch. The cable carries live and neutral both ways, and the switch keys in or out the power. The system powers on as soon as the switch is enabled.\n\nOriginally there was no graphics card in it. Since a PC will not boot with out a GPU, I had to find one. The mainboard only has PCI and ISA slots, and all the GPUs I had were AGP. Fortunately, I bought a PCI GPU hoping it would solve my issue...\n\nHowever the GPU turned out to be faulty. It took me some time to repair it. I had to repair a broken trace leading to one of the EEPROM pins, and replace a contact in the EEPROM's socket. Then I replaced all the electrolytic capacitors on it, and that fixed it for good.\n\nHaving used up only one of the three PCI slots, I populated the remaining pair with two ethernet cards. I still have a bunch of ISA slots available, but I have nothing to install there. Yet.\n\n\n\nSee the article for the rest of the writeup\n\n\n\n\nSetting up services in a FreeNAS Jail\n\n\nThis piece demonstrates the setup of a server service in a FreeNAS jail and how to share files with a jail using Apache 2.4 as an example. Jails are powerful, self-contained FreeBSD environments with separate network settings, package management, and access to thousands of FreeBSD application packages. Popular packages such as Apache, NGINX, LigHTTPD, MySQL, and PHP can be found and installed with the pkg search and pkg install commands. \n\nThis example shows creating a jail, installing an Apache web server, and setting up a simple web page. \n\nNOTE: Do not directly attach FreeNAS to an external network (WAN). Use port forwarding, proper firewalls and DDoS protections when using FreeNAS for external web sites. This example demonstrates expanding the functionality of FreeNAS in an isolated LAN environment.\n\n\n\n\nNews Roundup\n\nFirst taste of DragonflyBSD\n\n\nLast week, I needed to pick a BSD Operating System which supports NUMA to do some testing, so I decided to give Dragonfly BSD a shot. Dragonfly BSDonly can run on X86_64 architecture, which reminds me of Arch Linux, and after some tweaking, I feel Dragonfly BSD may be a “developer-friendly” Operating System, at least for me.\n\nI mainly use Dragonfly BSD as a server, so I don’t care whether GUI is fancy or not. But I have high requirements of developer tools, i.e., compiler and debugger. The default compiler of Dragonfly BSD is gcc 8.3, and I can also install clang 8.0.0 from package. This means I can test state-of-the-art features of compilers, and it is really important for me. gdb‘s version is 7.6.1, a little lag behind, but still OK.\n\nFurthermore, the upgradation of Dragonfly BSD is pretty simple and straightforward. I followed document to upgrade my Operating System to 5.6.0 this morning, just copied and pasted, no single error, booted successfully.\n\n\n\n\nStreaming Netflix on NetBSD\n\n\nHere's a step-by-step guide that allows streaming Netflix media on NetBSD using a intel-haxm accelerated QEMU vm.\n\nHeads-up! Sound doesn't work, but everything else is fine. Please read the rest of this thread for a solution to this!!\n\n\n\n\n“Sudo Mastery 2nd Edition” cover art reveal\n\n\nI’m about halfway through the new edition of Sudo Mastery. Assuming nothing terrible happens, should have a complete first draft in four to six weeks. Enough stuff has changed in sudo that I need to carefully double-check every single feature. (I’m also horrified by the painfully obsolete versions of sudo shipped in the latest versions of CentOS and Debian, but people running those operating systems are already accustomed to their creaky obsolescence.)\n\nBut the reason for this blog post? I have Eddie Sharam’s glorious cover art. My Patronizers saw it last month, so now the rest of you get a turn.\n\n\n\n\nNetBSD on the last G4 Mac mini\n\n\nI'm a big fan of NetBSD. I've run it since 2000 on a Mac IIci (of course it's still running it) and I ran it for several years on a Power Mac 7300 with a G3 card which was the second incarnation of the Floodgap gopher server. Today I also still run it on a MIPS-based Cobalt RaQ 2 and an HP Jornada 690. I think NetBSD is a better match for smaller or underpowered systems than current-day Linux, and is fairly easy to harden and keep secure even though none of these systems are exposed to the outside world.\n\nRecently I had a need to set up a bridge system that would be fast enough to connect two networks and I happened to have two of the \"secret\" last-of-the-line 1.5GHz G4 Mac minis sitting on the shelf doing nothing. Yes, they're probably outclassed by later Raspberry Pi models, but I don't have to buy anything and I like putting old hardware to good use.\n\n\n\n\nHammer vs Hammer2\n\n\nWith the newly released DragonFlyBSD 5.6 there are improvements to its original HAMMER2 file-system to the extent that it's now selected by its installer as the default file-system choice for new installations. Curious how the performance now compares between HAMMER and HAMMER2, here are some initial benchmarks on an NVMe solid-state drive using DragonFlyBSD 5.6.0. \n\nWith a 120GB Toshiba NVMe SSD on an Intel Core i7 8700K system, I ran some benchmarks of DragonFlyBSD 5.6.0 freshly installed with HAMMER2 and then again when returning to the original HAMMER file-system that remains available via its installer. No other changes were made to the setup during testing. \n\nAnd then for the more synthetic workloads it was just a mix. But overall HAMMER2 was performing well during the initial testing and great to see it continuing to offer noticeable leads in real-world workloads compared to the aging HAMMER file-system. HAMMER2 also offers better clustering, online deduplication, snapshots, compression, encryption, and many other modern file-system features.\n\n\n\n\nBeastie Bits\n\n\nUnix CLI relational database\nThe TTY demystified\nRanger, a console file manager with VI keybindings\nSome Unix Humor\nOpenBSD -import vulkan-loader for Vulkan API support\nFreeBSD ZFS without drives\n\n\n\n\nFeedback/Questions\n\n\nMoritz - ARM Builds\nDave - Videos\nChris - Raspberry Pi4\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.</p>\n\n<hr>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://polprog.net/blog/486/\" rel=\"nofollow\">Polprog&#39;s Am5x86 based retro UNIX build log</a></h3>\n\n<blockquote>\n<p>I have recently acquired an Am5x86 computer, in a surprisingly good condition. This is an ongoing project, check this page often for updates!</p>\n\n<p>I began by connecting a front panel. The panel came from a different chassis and is slightly too wide, so I had to attach it with a couple of zip-ties. However, that makes it stick out from the PC front at an angle, allowing easy access when the computer sits at the floor - and thats where it is most of the time. It&#39;s not that bad, to be honest, and its way easier to access than it would be, if mounted vertically</p>\n\n<p>There is a mains switch on the front panel because the computer uses an older style power supply. Those power supplies instead of relying on a PSON signal, like modern ATX supplies, run a 4 wire cable to a mains switch. The cable carries live and neutral both ways, and the switch keys in or out the power. The system powers on as soon as the switch is enabled.</p>\n\n<p>Originally there was no graphics card in it. Since a PC will not boot with out a GPU, I had to find one. The mainboard only has PCI and ISA slots, and all the GPUs I had were AGP. Fortunately, I bought a PCI GPU hoping it would solve my issue...</p>\n\n<p>However the GPU turned out to be faulty. It took me some time to repair it. I had to repair a broken trace leading to one of the EEPROM pins, and replace a contact in the EEPROM&#39;s socket. Then I replaced all the electrolytic capacitors on it, and that fixed it for good.</p>\n\n<p>Having used up only one of the three PCI slots, I populated the remaining pair with two ethernet cards. I still have a bunch of ISA slots available, but I have nothing to install there. Yet.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest of the writeup</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/services-in-freenas-jail/\" rel=\"nofollow\">Setting up services in a FreeNAS Jail</a></h3>\n\n<blockquote>\n<p>This piece demonstrates the setup of a server service in a FreeNAS jail and how to share files with a jail using Apache 2.4 as an example. Jails are powerful, self-contained FreeBSD environments with separate network settings, package management, and access to thousands of FreeBSD application packages. Popular packages such as Apache, NGINX, LigHTTPD, MySQL, and PHP can be found and installed with the pkg search and pkg install commands. </p>\n\n<p>This example shows creating a jail, installing an Apache web server, and setting up a simple web page. </p>\n\n<p>NOTE: Do not directly attach FreeNAS to an external network (WAN). Use port forwarding, proper firewalls and DDoS protections when using FreeNAS for external web sites. This example demonstrates expanding the functionality of FreeNAS in an isolated LAN environment.</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://nanxiao.me/en/first-taste-of-dragonfly-bsd/\" rel=\"nofollow\">First taste of DragonflyBSD</a></h3>\n\n<blockquote>\n<p>Last week, I needed to pick a BSD Operating System which supports NUMA to do some testing, so I decided to give Dragonfly BSD a shot. Dragonfly BSDonly can run on X86_64 architecture, which reminds me of Arch Linux, and after some tweaking, I feel Dragonfly BSD may be a “developer-friendly” Operating System, at least for me.</p>\n\n<p>I mainly use Dragonfly BSD as a server, so I don’t care whether GUI is fancy or not. But I have high requirements of developer tools, i.e., compiler and debugger. The default compiler of Dragonfly BSD is gcc 8.3, and I can also install clang 8.0.0 from package. This means I can test state-of-the-art features of compilers, and it is really important for me. gdb‘s version is 7.6.1, a little lag behind, but still OK.</p>\n\n<p>Furthermore, the upgradation of Dragonfly BSD is pretty simple and straightforward. I followed document to upgrade my Operating System to 5.6.0 this morning, just copied and pasted, no single error, booted successfully.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.unitedbsd.com/d/68-streaming-netflix-on-netbsd\" rel=\"nofollow\">Streaming Netflix on NetBSD</a></h3>\n\n<blockquote>\n<p>Here&#39;s a step-by-step guide that allows streaming Netflix media on NetBSD using a intel-haxm accelerated QEMU vm.</p>\n\n<p>Heads-up! Sound doesn&#39;t work, but everything else is fine. Please read the rest of this thread for a solution to this!!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://mwl.io/archives/4320\" rel=\"nofollow\">“Sudo Mastery 2nd Edition” cover art reveal</a></h3>\n\n<blockquote>\n<p>I’m about halfway through the new edition of Sudo Mastery. Assuming nothing terrible happens, should have a complete first draft in four to six weeks. Enough stuff has changed in sudo that I need to carefully double-check every single feature. (I’m also horrified by the painfully obsolete versions of sudo shipped in the latest versions of CentOS and Debian, but people running those operating systems are already accustomed to their creaky obsolescence.)</p>\n\n<p>But the reason for this blog post? I have Eddie Sharam’s glorious cover art. My Patronizers saw it last month, so now the rest of you get a turn.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://tenfourfox.blogspot.com/2019/06/and-now-for-something-completely.html\" rel=\"nofollow\">NetBSD on the last G4 Mac mini</a></h3>\n\n<blockquote>\n<p>I&#39;m a big fan of NetBSD. I&#39;ve run it since 2000 on a Mac IIci (of course it&#39;s still running it) and I ran it for several years on a Power Mac 7300 with a G3 card which was the second incarnation of the Floodgap gopher server. Today I also still run it on a MIPS-based Cobalt RaQ 2 and an HP Jornada 690. I think NetBSD is a better match for smaller or underpowered systems than current-day Linux, and is fairly easy to harden and keep secure even though none of these systems are exposed to the outside world.</p>\n\n<p>Recently I had a need to set up a bridge system that would be fast enough to connect two networks and I happened to have two of the &quot;secret&quot; last-of-the-line 1.5GHz G4 Mac minis sitting on the shelf doing nothing. Yes, they&#39;re probably outclassed by later Raspberry Pi models, but I don&#39;t have to buy anything and I like putting old hardware to good use.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://phoronix.com/scan.php?page=news_item&px=DragonFlyBSD-5.6-HAMMER2-Perf\" rel=\"nofollow\">Hammer vs Hammer2</a></h3>\n\n<blockquote>\n<p>With the newly released DragonFlyBSD 5.6 there are improvements to its original HAMMER2 file-system to the extent that it&#39;s now selected by its installer as the default file-system choice for new installations. Curious how the performance now compares between HAMMER and HAMMER2, here are some initial benchmarks on an NVMe solid-state drive using DragonFlyBSD 5.6.0. </p>\n\n<p>With a 120GB Toshiba NVMe SSD on an Intel Core i7 8700K system, I ran some benchmarks of DragonFlyBSD 5.6.0 freshly installed with HAMMER2 and then again when returning to the original HAMMER file-system that remains available via its installer. No other changes were made to the setup during testing. </p>\n\n<p>And then for the more synthetic workloads it was just a mix. But overall HAMMER2 was performing well during the initial testing and great to see it continuing to offer noticeable leads in real-world workloads compared to the aging HAMMER file-system. HAMMER2 also offers better clustering, online deduplication, snapshots, compression, encryption, and many other modern file-system features.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://spin.atomicobject.com/2019/06/16/unix-cli-relational-database/\" rel=\"nofollow\">Unix CLI relational database</a></li>\n<li><a href=\"https://www.linusakesson.net/programming/tty/index.php\" rel=\"nofollow\">The TTY demystified</a></li>\n<li><a href=\"https://ranger.github.io/\" rel=\"nofollow\">Ranger, a console file manager with VI keybindings</a></li>\n<li><a href=\"https://www.reddit.com/r/unix/comments/c6o5ze/some_unix_humor/\" rel=\"nofollow\">Some Unix Humor</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-ports-cvs&m=156121732625604&w=2\" rel=\"nofollow\">OpenBSD -import vulkan-loader for Vulkan API support</a></li>\n<li><a href=\"https://savagedlight.me/2019/06/09/freebsd-zfs-without-drives/\" rel=\"nofollow\">FreeBSD ZFS without drives</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Moritz - <a href=\"http://dpaste.com/175RRAZ\" rel=\"nofollow\">ARM Builds</a></li>\n<li>Dave - <a href=\"http://dpaste.com/2DYK85B\" rel=\"nofollow\">Videos</a></li>\n<li>Chris - <a href=\"http://dpaste.com/1B16QVN\" rel=\"nofollow\">Raspberry Pi4</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0306.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Am5x86 based retro UNIX build log, setting up services in a FreeNAS Jail, first taste of DragonflyBSD, streaming Netflix on NetBSD, NetBSD on the last G4 Mac mini, Hammer vs Hammer2, and more.","date_published":"2019-07-11T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2e907009-f426-4bbd-a592-d91329f11f0f.mp3","mime_type":"audio/mp3","size_in_bytes":27620333,"duration_in_seconds":2301}]},{"id":"3ad52b9d-03b4-4c00-a16f-cc4be091e6ff","title":"305: Changing face of Unix","url":"https://www.bsdnow.tv/305","content_text":"Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.\n\nHeadlines\n\nWebsite protection with OPNsense\n\n\nwith nginx plugin OPNsense become a strong full featured Web Application Firewall (WAF)\n\n\n\nThe OPNsense security platform can help you to protect your network and your webservers with the nginx plugin addition.\nIn old days, install an open source firewall was a very trick task, but today it can be done with few clicks (or key strokes). In this article I'll not describe the detailed OPNsense installation process, but you can watch this video that was extracted from my OPNsense course available in Udemy. The video is in portuguese language, but with the translation CC Youtube feature you may be able to follow it without problems (if you don't are a portuguese speaker ofcourse) :-)\n\n\nSee the article for the rest of the writeup\n\n\n\n\n\nFreeBSD Support Pull Request against the ZFS-on-Linux repo\n\n\nThis pull request integrates the sysutils/openzfs port’s sources into the upstream ZoL repo\n&gt; Adding FreeBSD support to ZoL will make it easier to move changes back and forth between FreeBSD and Linux\n&gt; Refactor tree to separate out Linux and FreeBSD specific code\n&gt; import FreeBSD's SPL\n&gt; add ifdefs in common code where it made more sense to do so than duplicate the code in separate files\n&gt; Adapted ZFS Test Suite to run on FreeBSD and all tests that pass on ZoL passing on ZoF\nThe plan to officially rename the common repo from ZFSonLinux to OpenZFS was announced at the ZFS Leadership Meeting on June 25th\nVideo of Leadership Meeting\nMeeting Agenda and Notes\nThis will allow improvements made on one OS to be made available more easily (and more quickly) to the other platforms\nFor example, mav@’s recent work:\nAdd wakeup_any(), cheaper version of wakeup_one() for taskqueue(9)\n&gt; As result, on 72-core Xeon v4 machine sequential ZFS write to 12 ZVOLs with 16KB block size spend 34% less time in wakeup_any() and descendants then it was spending in wakeup_one(), and total write throughput increased by ~10% with the same as before CPU usage.\n\n\n\n\nNews Roundup\n\nEpisode 5 Notes - How much has UNIX changed?\n\n\nUNIX-like systems have dominated computing for decades, and with the rise of the internet and mobile devices their reach has become even larger. True, most systems now use more modern OSs like Linux, but how much has the UNIX-like landscape changed since the early days?\nSo, my question was this: how close is a modern *NIX userland to some of the earliest UNIX releases? To do this I'm going to compare a few key points of a modern Linux system with the earliest UNIX documentation I can get my hands on. The doc I am going to be covering(https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf) is from November 1971, predating v1 of the system.\nI think the best place to start this comparison is to look at one of the highest-profile parts of the OS, that being the file system. Under the hood modern EXT file systems are completely different from the early UNIX file systems. However, they are still presented in basically the same way, as a heirerarchicat structure of directories with device files. So paths still look identical, and navigating the file system still functions the same. Often used commands like ls, cp, mv, du, and df function the same. So are mount and umount. But, there are some key differences. For instance, cd didn't exist, yet instead chdir filled its place. Also, chmod is somewhat different. Instead of the usual 3-digit octal codes for permissions, this older version only uses 2 digits. Really, that difference is due to the underlying file system using a different permission set than modern systems. For the most part, all the file handling is actually pretty close to a Linux system from 2019.\n\n\n\nSee the article for the rest of the writeup\n\n\n\n\nPorting Wine to amd64 on NetBSD\n\n\nI have been working on porting Wine to amd64 on NetBSD as a GSoC 2019 project. Wine is a compatibility layer which allows running Microsoft Windows applications on POSIX-complaint operating systems. This report provides an overview of the progress of the project during the first coding period.\nInitially, when I started working on getting Wine-4.4 to build and run on NetBSD i386 the primary issue that I faced was Wine displaying black windows instead of UI, and this applied to any graphical program I tried running with Wine.\nI suspected it , as it is related to graphics, to be an issue with the graphics driver or Xorg. Subsequently, I tried building modular Xorg, and I tried running Wine on it only to realize that Xorg being modular didn't affect it in the least. After having tried a couple of configurations, I realized that trying to hazard out every other probability is going to take an awful lot of time that I didn't have. This motivated me to bisect the repo using git, and find the first version of Wine which failed on NetBSD.\n\n\nSee the article for the rest of the writeup\n\n\n\n\n\nFreeBSD Enterprise 1 PB Storage\n\n\nToday FreeBSD operating system turns 26 years old. 19 June is an International FreeBSD Day. This is why I got something special today :). How about using FreeBSD as an Enterprise Storage solution on real hardware? This where FreeBSD shines with all its storage features ZFS included.\nToday I will show you how I have built so called Enterprise Storage based on FreeBSD system along with more then 1 PB (Petabyte) of raw capacity.\nThis project is different. How much storage space can you squeeze from a single 4U system? It turns out a lot! Definitely more then 1 PB (1024 TB) of raw storage space.\n\n\n\nSee the article for the rest of the writeup\n\n\n\n\nThe death watch for the X Window System (aka X11) has probably started\n\n\nOnce we are done with this we expect X.org to go into hard maintenance mode fairly quickly. The reality is that X.org is basically maintained by us and thus once we stop paying attention to it there is unlikely to be any major new releases coming out and there might even be some bitrot setting in over time. We will keep an eye on it as we will want to ensure X.org stays supportable until the end of the RHEL8 lifecycle at a minimum, but let this be a friendly notice for everyone who rely the work we do maintaining the Linux graphics stack, get onto Wayland, that is where the future is.\nI have no idea how true this is about X.org X server maintenance, either now or in the future, but I definitely think it's a sign that developers have started saying this. If Gnome developers feel that X.org is going to be in hard maintenance mode almost immediately, they're probably pretty likely to also put the Gnome code that deals with X into hard maintenance mode. And public Gnome statements about this (and public action or lack of it) provide implicit support for KDE and any other desktop to move in this direction if they want to (and probably create some pressure to do so). I've known that Wayland was the future for some time, but I would still like it to not arrive any time soon.\n\n\n\n\nBeastie Bits\n\n\nPorting NetBSD to Risc-V -- Video\nFreeBSD 11.3RC3 Available\nOpen Source Could Be a Casualty of the Trade War\nCelebrate UNIX50 and SDF32\ndoas environmental security\n\n\n\n\nFeedback/Questions\n\n\nMatt - BSD or Older Hardware\nMJRodriguez - Some Playstation news\nMoritz - bhyve VT-x passthrough\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://medium.com/@jccwbb/website-protection-with-opnsense-3586a529d487\" rel=\"nofollow\">Website protection with OPNsense</a></h3>\n\n<ul>\n<li>with nginx plugin OPNsense become a strong full featured Web Application Firewall (WAF)</li>\n</ul>\n\n<blockquote>\n<p>The OPNsense security platform can help you to protect your network and your webservers with the nginx plugin addition.<br>\nIn old days, install an open source firewall was a very trick task, but today it can be done with few clicks (or key strokes). In this article I&#39;ll not describe the detailed OPNsense installation process, but you can watch this video that was extracted from my OPNsense course available in Udemy. The video is in portuguese language, but with the translation CC Youtube feature you may be able to follow it without problems (if you don&#39;t are a portuguese speaker ofcourse) :-)</p>\n\n<ul>\n<li>See the article for the rest of the writeup</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://github.com/zfsonlinux/zfs/pull/8987\" rel=\"nofollow\">FreeBSD Support Pull Request against the ZFS-on-Linux repo</a></h3>\n\n<ul>\n<li>This pull request integrates the sysutils/openzfs port’s sources into the upstream ZoL repo\n&gt; Adding FreeBSD support to ZoL will make it easier to move changes back and forth between FreeBSD and Linux\n&gt; Refactor tree to separate out Linux and FreeBSD specific code\n&gt; import FreeBSD&#39;s SPL\n&gt; add ifdefs in common code where it made more sense to do so than duplicate the code in separate files\n&gt; Adapted ZFS Test Suite to run on FreeBSD and all tests that pass on ZoL passing on ZoF</li>\n<li>The plan to officially rename the common repo from ZFSonLinux to OpenZFS was announced at the ZFS Leadership Meeting on June 25th</li>\n<li><a href=\"https://www.youtube.com/watch?v=TJwykiJmH0M\" rel=\"nofollow\">Video of Leadership Meeting</a></li>\n<li><a href=\"https://docs.google.com/document/d/1w2jv2XVYFmBVvG1EGf-9A5HBVsjAYoLIFZAnWHhV-BM/edit\" rel=\"nofollow\">Meeting Agenda and Notes</a></li>\n<li>This will allow improvements made on one OS to be made available more easily (and more quickly) to the other platforms</li>\n<li>For example, mav@’s recent work:</li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=349220\" rel=\"nofollow\">Add wakeup_any(), cheaper version of wakeup_one() for taskqueue(9)</a>\n&gt; As result, on 72-core Xeon v4 machine sequential ZFS write to 12 ZVOLs with 16KB block size spend 34% less time in wakeup_any() and descendants then it was spending in wakeup_one(), and total write throughput increased by ~10% with the same as before CPU usage.</li>\n</ul>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://adventofcomputing.libsyn.com/episode-5-notes-how-much-has-unix-changed\" rel=\"nofollow\">Episode 5 Notes - How much has UNIX changed?</a></h3>\n\n<blockquote>\n<p>UNIX-like systems have dominated computing for decades, and with the rise of the internet and mobile devices their reach has become even larger. True, most systems now use more modern OSs like Linux, but how much has the UNIX-like landscape changed since the early days?<br>\nSo, my question was this: how close is a modern *NIX userland to some of the earliest UNIX releases? To do this I&#39;m going to compare a few key points of a modern Linux system with the earliest UNIX documentation I can get my hands on. The doc I am going to be covering(<a href=\"https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf\" rel=\"nofollow\">https://www.tuhs.org/Archive/Distributions/Research/Dennis_v1/UNIX_ProgrammersManual_Nov71.pdf</a>) is from November 1971, predating v1 of the system.<br>\nI think the best place to start this comparison is to look at one of the highest-profile parts of the OS, that being the file system. Under the hood modern EXT file systems are completely different from the early UNIX file systems. However, they are still presented in basically the same way, as a heirerarchicat structure of directories with device files. So paths still look identical, and navigating the file system still functions the same. Often used commands like <code>ls</code>, <code>cp</code>, <code>mv</code>, <code>du</code>, and <code>df</code> function the same. So are <code>mount</code> and <code>umount</code>. But, there are some key differences. For instance, <code>cd</code> didn&#39;t exist, yet instead <code>chdir</code> filled its place. Also, <code>chmod</code> is somewhat different. Instead of the usual 3-digit octal codes for permissions, this older version only uses 2 digits. Really, that difference is due to the underlying file system using a different permission set than modern systems. For the most part, all the file handling is actually pretty close to a Linux system from 2019.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest of the writeup</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/porting_wine_to_amd64_on\" rel=\"nofollow\">Porting Wine to amd64 on NetBSD</a></h3>\n\n<blockquote>\n<p>I have been working on porting Wine to amd64 on NetBSD as a GSoC 2019 project. Wine is a compatibility layer which allows running Microsoft Windows applications on POSIX-complaint operating systems. This report provides an overview of the progress of the project during the first coding period.<br>\nInitially, when I started working on getting Wine-4.4 to build and run on NetBSD i386 the primary issue that I faced was Wine displaying black windows instead of UI, and this applied to any graphical program I tried running with Wine.<br>\nI suspected it , as it is related to graphics, to be an issue with the graphics driver or Xorg. Subsequently, I tried building modular Xorg, and I tried running Wine on it only to realize that Xorg being modular didn&#39;t affect it in the least. After having tried a couple of configurations, I realized that trying to hazard out every other probability is going to take an awful lot of time that I didn&#39;t have. This motivated me to bisect the repo using git, and find the first version of Wine which failed on NetBSD.</p>\n\n<ul>\n<li>See the article for the rest of the writeup</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://vermaden.wordpress.com/2019/06/19/freebsd-enterprise-1-pb-storage/?utm_source=discoverbsd\" rel=\"nofollow\">FreeBSD Enterprise 1 PB Storage</a></h3>\n\n<blockquote>\n<p>Today FreeBSD operating system turns 26 years old. 19 June is an International FreeBSD Day. This is why I got something special today :). How about using FreeBSD as an Enterprise Storage solution on real hardware? This where FreeBSD shines with all its storage features ZFS included.<br>\nToday I will show you how I have built so called Enterprise Storage based on FreeBSD system along with more then 1 PB (Petabyte) of raw capacity.<br>\nThis project is different. How much storage space can you squeeze from a single 4U system? It turns out a lot! Definitely more then 1 PB (1024 TB) of raw storage space.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest of the writeup</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/XDeathwatchStarts\" rel=\"nofollow\">The death watch for the X Window System (aka X11) has probably started</a></h3>\n\n<blockquote>\n<p>Once we are done with this we expect X.org to go into hard maintenance mode fairly quickly. The reality is that X.org is basically maintained by us and thus once we stop paying attention to it there is unlikely to be any major new releases coming out and there might even be some bitrot setting in over time. We will keep an eye on it as we will want to ensure X.org stays supportable until the end of the RHEL8 lifecycle at a minimum, but let this be a friendly notice for everyone who rely the work we do maintaining the Linux graphics stack, get onto Wayland, that is where the future is.<br>\nI have no idea how true this is about X.org X server maintenance, either now or in the future, but I definitely think it&#39;s a sign that developers have started saying this. If Gnome developers feel that X.org is going to be in hard maintenance mode almost immediately, they&#39;re probably pretty likely to also put the Gnome code that deals with X into hard maintenance mode. And public Gnome statements about this (and public action or lack of it) provide implicit support for KDE and any other desktop to move in this direction if they want to (and probably create some pressure to do so). I&#39;ve known that Wayland was the future for some time, but I would still like it to not arrive any time soon.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=2vQXGomKoxA\" rel=\"nofollow\">Porting NetBSD to Risc-V -- Video</a></li>\n<li><a href=\"https://www.freebsd.org/news/newsflash.html#event20190628:01\" rel=\"nofollow\">FreeBSD 11.3RC3 Available</a></li>\n<li><a href=\"https://www.bunniestudios.com/blog/?p=5590\" rel=\"nofollow\">Open Source Could Be a Casualty of the Trade War</a></li>\n<li><a href=\"https://sdf.org/sdf32/\" rel=\"nofollow\">Celebrate UNIX50 and SDF32</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20190621104048\" rel=\"nofollow\">doas environmental security</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Matt - <a href=\"http://dpaste.com/1RP09F0#wrap\" rel=\"nofollow\">BSD or Older Hardware</a></li>\n<li>MJRodriguez - <a href=\"http://dpaste.com/046SPPB#wrap\" rel=\"nofollow\">Some Playstation news</a></li>\n<li>Moritz - <a href=\"http://dpaste.com/1H4PJXW\" rel=\"nofollow\">bhyve VT-x passthrough</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0305.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Website protection with OPNsense, FreeBSD Support Pull Request for ZFS-on-Linux, How much has Unix changed, Porting Wine to amd64 on NetBSD, FreeBSD Enterprise 1 PB Storage, the death watch for X11 has started, and more.","date_published":"2019-07-03T22:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/3ad52b9d-03b4-4c00-a16f-cc4be091e6ff.mp3","mime_type":"audio/mp3","size_in_bytes":40433394,"duration_in_seconds":3369}]},{"id":"6da25674-3858-4ebc-b4a5-257e1eefcbf4","title":"304: Prospering with Vulkan","url":"https://www.bsdnow.tv/304","content_text":"DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.\n\nHeadlines\n\nDragonflyBSD 5.6 is out\n\n\nVersion 5.6.0 released 17 June 2019\nVersion 5.6.1 released 19 June 2019\nBig-ticket items\nImproved VM\n\n\nInformal test results showing the changes from 5.4 to 5.6 are available.\nReduce stalls in the kernel vm_page_alloc() code (vm_page_list_find()).\nImprove page allocation algorithm to avoid re-iterating the same queues as the search is widened.\nAdd a vm_page_hash*() API that allows the kernel to do heuristical lockless lookups of VM pages.\nChange vm_hold() and vm_unhold() semantics to not require any spin-locks.\nChange vm_page_wakeup() to not require any spin-locks.\nChange wiring vm_page's no longer manipulates the queue the page is on, saving a lot of overhead. Instead, the page will be removed from its queue only if the pageout demon encounters it. This allows pages to enter and leave the buffer cache quickly.\nRefactor the handling of fictitious pages.\nRemove m-&gt;md.pv_list entirely. VM pages in mappings no longer allocate pv_entry's, saving an enormous amount of memory when multiple processes utilize large shared memory maps (e.g. postgres database cache).\nRefactor vm_object shadowing, disconnecting the backing linkages from the vm_object itself and instead organizing the linkages in a new structure called vm_map_backing which hangs off the vm_map_entry.\npmap operations now iterate vm_map_backing structures (rather than spin-locked page lists based on the vm_page and pv_entry's), and will test/match operations against the PTE found in the pmap at the requisite location. This doubles VM fault performance on shared pages and reduces the locking overhead for fault and pmap operations.\nSimplify the collapse code, removing most of the original code and replacing it with simpler per-vm_map_entry optimizations to limit the shadow depth.\n\nDRM\n\n\nMajor updates to the radeon and ttm (amd support code) drivers. We have not quite gotten the AMD support up to the more modern cards or Ryzen APUs yet, however.\nImprove UEFI framebuffer support.\nA major deadlock has been fixed in the radeon/ttm code.\nRefactor the startup delay designed to avoid conflicts between the i915 driver initialization and X startup.\nAdd DRM_IOCTL_GET_PCIINFO to improve mesa/libdrm support.\nFix excessive wired memory build-ups.\nFix Linux/DragonFly PAGE_MASK confusion in the DRM code.\nFix idr_*() API bugs.\n\nHAMMER2\n\n\nThe filesystem sync code has been rewritten to significantly improve performance.\nSequential write performance also improved.\nAdd simple dependency tracking to prevent directory/file splits during create/rename/remove operations, for better consistency after a crash.\nRefactor the snapshot code to reduce flush latency and to ensure a consistent snapshot.\nAttempt to pipeline the flush code against the frontend, improving flush vs frontend write concurrency.\nImprove umount operation.\nFix an allocator race that could lead to corruption.\nNumerous other bugs fixed.\nImprove verbosity of CHECK (CRC error) console messages.\n\n\n\n\n\nOpenBSD Vulkan Support\n\n\nSomewhat surprisingly, OpenBSD has added the Vulkan library and ICD loader support as their newest port. \nThis new graphics/vulkan-loader port provides the generic Vulkan library and ICD support that is the common code for Vulkan implementations on the system. This doesn't enable any Vulkan hardware drivers or provide something new not available elsewhere, but is rare seeing Vulkan work among the BSDs. There is also in ports the related components like the SPIR-V headers and tools, glsllang, and the Vulkan tools and validation layers. \nThis is of limited usefulness, at least for the time being considering OpenBSD like the other BSDs lag behind in their DRM kernel driver support that is ported over from the mainline Linux kernel tree but generally years behind the kernel upstream. Particularly with Vulkan, newer kernel releases are needed for some Vulkan features as well as achieving decent performance. The Vulkan drivers of relevance are the open-source Intel ANV Vulkan driver and Radeon RADV drivers, both of which are in Mesa though we haven't seen any testing results to know how well they would work if at all currently on OpenBSD, but they're at least in Mesa and obviously open-source. \n\n\nA note: The BSDs are no longer that far behind.\nFreeBSD 12.0 uses DRM from Linux 4.16 (April 2018), and the drm-devel port is based on Linux 5.0 (March 2019)\nOpenBSD -current as of April 2019 uses DRM from Linux 4.19.34\n***\n\n\n\nNews Roundup\n\nBad utmp implementations in glibc and freebsd\n\n\nI recently released another version – 0.5.0 – of Dinit, the service manager / init system. There were a number of minor improvements, including to the build system (just running “make” or “gmake” should be enough on any of the systems which have a pre-defined configuration, no need to edit mconfig by hand), but the main features of the release were S6-compatible readiness notification, and support for updating the utmp database.\nIn other words, utmp is a record of who is currently logged in to the system (another file, “wtmp”, records all logins and logouts, as well as, potentially, certain system events such as reboots and time updates). This is a hint at the main motivation for having utmp support in Dinit – I wanted the “who” command to correctly report current logins (and I wanted boot time to be correctly recorded in the wtmp file).\nI wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.\nThen I wondered: if a user process is able to lock the utmp file, and this prevents updates, what’s to stop a user process from manually acquiring and then holding such a lock for a long – even practically infinite – duration? This would prevent the database from being updated, and would perhaps even prevent logins/logouts from completing. Unfortunately, the answer is – nothing; and yes, it is possible on different systems to prevent the database from being correctly updated or even to prevent all other users – including root – from logging in to the system.\n\n\nA good find\nOn FreeBSD, even though write(2) can be asynchronous, once the write syscall returns, the data is in the buffer cache (or ARC), and any future read(2) will see that new data even if it has not yet been written to disk.\n***\n\n\n\nOpenSSH gets an update to protect against Side Channel attacks\n\n\nLast week, Damien Miller, a Google security researcher, and one of the popular OpenSSH and OpenBSD developers announced an update to the existing OpenSSH code that can help protect against the side-channel attacks that leak sensitive data from computer’s memory. This protection, Miller says, will protect the private keys residing in the RAM against Spectre, Meltdown, Rowhammer, and the latest RAMBleed attack.\nSSH private keys can be used by malicious threat actors to connect to remote servers without the need of a password. According to CSO, “The approach used by OpenSSH could be copied by other software projects to protect their own keys and secrets in memory”.\nHowever, if the attacker is successful in extracting the data from a computer or server’s RAM, they will only obtain an encrypted version of an SSH private key, rather than the cleartext version.\nIn an email to OpenBSD, Miller writes, “this change encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large ‘prekey’ consisting of random data (currently 16KB).”\n\n\n\n\nZFS vs OpenZFS\n\n\nYou’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. \nFrom its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.\nOracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.\n\n\nThere was further discussion of how the ZFSOnLinux repo will become the OpenZFS repo in the future once it also contains the bits to build on FreeBSD as well during the June 25th ZFS Leadership Meeting. The videos for all of the meetings are available here\n***\n\n\n\nBeastie Bits\n\n\nHow to safely and portably close a file descriptor in a multithreaded process without running into problems with EINTR\nKnoxBug Meetup June 27th at 6pm\nBSD Pizza Night, June 27th at 7pm, Flying Pie Pizzeria, 3 Monroe Pkwy, Ste S, Lake Oswego, OR\nDifference between $x and ${x}\nBeware of Software Engineering Media Sites\nHow Verizon and a BGP optimizer knocked large parts of the internet offline today\nDragonflyBSD - MDS mitigation added a while ago\nReminder: Register for EuroBSDcon 2019 in Lillehammer, Norway\n\n\n\n\nFeedback/Questions\n\n\nDave - CheriBSD\nNeb - Hello from Norway\nLars - Ansible tutorial?\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.dragonflybsd.org/release56\" rel=\"nofollow\">DragonflyBSD 5.6 is out</a></h3>\n\n<ul>\n<li>Version 5.6.0 released 17 June 2019</li>\n<li><p><a href=\"https://www.dragonflydigest.com/2019/06/19/23091.html\" rel=\"nofollow\">Version 5.6.1 released 19 June 2019</a></p></li>\n<li><p>Big-ticket items</p></li>\n<li><p>Improved VM</p>\n\n<ul>\n<li>Informal test results showing the changes from 5.4 to 5.6 are available.</li>\n<li>Reduce stalls in the kernel vm_page_alloc() code (vm_page_list_find()).</li>\n<li>Improve page allocation algorithm to avoid re-iterating the same queues as the search is widened.</li>\n<li>Add a vm_page_hash*() API that allows the kernel to do heuristical lockless lookups of VM pages.</li>\n<li>Change vm_hold() and vm_unhold() semantics to not require any spin-locks.</li>\n<li>Change vm_page_wakeup() to not require any spin-locks.</li>\n<li>Change wiring vm_page&#39;s no longer manipulates the queue the page is on, saving a lot of overhead. Instead, the page will be removed from its queue only if the pageout demon encounters it. This allows pages to enter and leave the buffer cache quickly.</li>\n<li>Refactor the handling of fictitious pages.</li>\n<li>Remove m-&gt;md.pv_list entirely. VM pages in mappings no longer allocate pv_entry&#39;s, saving an enormous amount of memory when multiple processes utilize large shared memory maps (e.g. postgres database cache).</li>\n<li>Refactor vm_object shadowing, disconnecting the backing linkages from the vm_object itself and instead organizing the linkages in a new structure called vm_map_backing which hangs off the vm_map_entry.</li>\n<li>pmap operations now iterate vm_map_backing structures (rather than spin-locked page lists based on the vm_page and pv_entry&#39;s), and will test/match operations against the PTE found in the pmap at the requisite location. This doubles VM fault performance on shared pages and reduces the locking overhead for fault and pmap operations.</li>\n<li>Simplify the collapse code, removing most of the original code and replacing it with simpler per-vm_map_entry optimizations to limit the shadow depth.</li>\n</ul></li>\n<li><p>DRM</p>\n\n<ul>\n<li>Major updates to the radeon and ttm (amd support code) drivers. We have not quite gotten the AMD support up to the more modern cards or Ryzen APUs yet, however.</li>\n<li>Improve UEFI framebuffer support.</li>\n<li>A major deadlock has been fixed in the radeon/ttm code.</li>\n<li>Refactor the startup delay designed to avoid conflicts between the i915 driver initialization and X startup.</li>\n<li>Add DRM_IOCTL_GET_PCIINFO to improve mesa/libdrm support.</li>\n<li>Fix excessive wired memory build-ups.</li>\n<li>Fix Linux/DragonFly PAGE_MASK confusion in the DRM code.</li>\n<li>Fix idr_*() API bugs.</li>\n</ul></li>\n<li><p>HAMMER2</p>\n\n<ul>\n<li>The filesystem sync code has been rewritten to significantly improve performance.</li>\n<li>Sequential write performance also improved.</li>\n<li>Add simple dependency tracking to prevent directory/file splits during create/rename/remove operations, for better consistency after a crash.</li>\n<li>Refactor the snapshot code to reduce flush latency and to ensure a consistent snapshot.</li>\n<li>Attempt to pipeline the flush code against the frontend, improving flush vs frontend write concurrency.</li>\n<li>Improve umount operation.</li>\n<li>Fix an allocator race that could lead to corruption.</li>\n<li>Numerous other bugs fixed.</li>\n<li>Improve verbosity of CHECK (CRC error) console messages.</li>\n</ul></li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=news_item&px=OpenBSD-Vulkan-Support\" rel=\"nofollow\">OpenBSD Vulkan Support</a></h3>\n\n<blockquote>\n<p>Somewhat surprisingly, OpenBSD has added the Vulkan library and ICD loader support as their newest port. <br>\nThis new graphics/vulkan-loader port provides the generic Vulkan library and ICD support that is the common code for Vulkan implementations on the system. This doesn&#39;t enable any Vulkan hardware drivers or provide something new not available elsewhere, but is rare seeing Vulkan work among the BSDs. There is also in ports the related components like the SPIR-V headers and tools, glsllang, and the Vulkan tools and validation layers. <br>\nThis is of limited usefulness, at least for the time being considering OpenBSD like the other BSDs lag behind in their DRM kernel driver support that is ported over from the mainline Linux kernel tree but generally years behind the kernel upstream. Particularly with Vulkan, newer kernel releases are needed for some Vulkan features as well as achieving decent performance. The Vulkan drivers of relevance are the open-source Intel ANV Vulkan driver and Radeon RADV drivers, both of which are in Mesa though we haven&#39;t seen any testing results to know how well they would work if at all currently on OpenBSD, but they&#39;re at least in Mesa and obviously open-source. </p>\n\n<ul>\n<li>A note: The BSDs are no longer that far behind.</li>\n<li>FreeBSD 12.0 uses DRM from Linux 4.16 (April 2018), and the drm-devel port is based on Linux 5.0 (March 2019)</li>\n<li>OpenBSD -current as of April 2019 uses DRM from Linux 4.19.34\n***</li>\n</ul>\n</blockquote>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://davmac.wordpress.com/2019/05/04/bad-utmp-implementations-in-glibc-and-freebsd/\" rel=\"nofollow\">Bad utmp implementations in glibc and freebsd</a></h3>\n\n<blockquote>\n<p>I recently released another version – 0.5.0 – of Dinit, the service manager / init system. There were a number of minor improvements, including to the build system (just running “make” or “gmake” should be enough on any of the systems which have a pre-defined configuration, no need to edit mconfig by hand), but the main features of the release were S6-compatible readiness notification, and support for updating the utmp database.<br>\nIn other words, utmp is a record of who is currently logged in to the system (another file, “wtmp”, records all logins and logouts, as well as, potentially, certain system events such as reboots and time updates). This is a hint at the main motivation for having utmp support in Dinit – I wanted the “who” command to correctly report current logins (and I wanted boot time to be correctly recorded in the wtmp file).<br>\nI wondered: If the files consist of fixed-sized records, and are readable by regular users, how is consistency maintained? That is – how can a process ensure that, when it updates the database, it doesn’t conflict with another process also attempting to update the database at the same time? Similarly, how can a process reading an entry from the database be sure that it receives a consistent, full record and not a record which has been partially updated? (after all, POSIX allows that a write(2) call can return without having written all the requested bytes, and I’m not aware of Linux or any of the *BSDs documenting that this cannot happen for regular files). Clearly, some kind of locking is needed; a process that wants to write to or read from the database locks it first, performs its operation, and then unlocks the database. Once again, this happens under the hood, in the implementation of the getutent/pututline functions or their equivalents.<br>\nThen I wondered: if a user process is able to lock the utmp file, and this prevents updates, what’s to stop a user process from manually acquiring and then holding such a lock for a long – even practically infinite – duration? This would prevent the database from being updated, and would perhaps even prevent logins/logouts from completing. Unfortunately, the answer is – nothing; and yes, it is possible on different systems to prevent the database from being correctly updated or even to prevent all other users – including root – from logging in to the system.</p>\n\n<ul>\n<li>A good find</li>\n<li>On FreeBSD, even though write(2) can be asynchronous, once the write syscall returns, the data is in the buffer cache (or ARC), and any future read(2) will see that new data even if it has not yet been written to disk.\n***</li>\n</ul>\n</blockquote>\n\n<h3><a href=\"https://securityboulevard.com/2019/06/openssh-code-gets-an-update-to-protect-against-side-channel-attacks/\" rel=\"nofollow\">OpenSSH gets an update to protect against Side Channel attacks</a></h3>\n\n<blockquote>\n<p>Last week, Damien Miller, a Google security researcher, and one of the popular OpenSSH and OpenBSD developers announced an update to the existing OpenSSH code that can help protect against the side-channel attacks that leak sensitive data from computer’s memory. This protection, Miller says, will protect the private keys residing in the RAM against Spectre, Meltdown, Rowhammer, and the latest RAMBleed attack.<br>\nSSH private keys can be used by malicious threat actors to connect to remote servers without the need of a password. According to CSO, “The approach used by OpenSSH could be copied by other software projects to protect their own keys and secrets in memory”.<br>\nHowever, if the attacker is successful in extracting the data from a computer or server’s RAM, they will only obtain an encrypted version of an SSH private key, rather than the cleartext version.<br>\nIn an email to OpenBSD, Miller writes, “this change encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large ‘prekey’ consisting of random data (currently 16KB).”</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://www.ixsystems.com/blog/zfs-vs-openzfs/\" rel=\"nofollow\">ZFS vs OpenZFS</a></h3>\n\n<blockquote>\n<p>You’ve probably heard us say a mix of “ZFS” and “OpenZFS” and an explanation is long-overdue. <br>\nFrom its inception, “ZFS” has referred to the “Zettabyte File System” developed at Sun Microsystems and published under the CDDL Open Source license in 2005 as part of the OpenSolaris operating system. ZFS was revolutionary for completely decoupling the file system from specialized storage hardware and even a specific computer platform. The portable nature and advanced features of ZFS led FreeBSD, Linux, and even Apple developers to start porting ZFS to their operating systems and by 2008, FreeBSD shipped with ZFS in the 7.0 release. For the first time, ZFS empowered users of any budget with enterprise-class scalability and data integrity and management features like checksumming, compression and snapshotting, and those features remain unrivaled at any price to this day. On any ZFS platform, administrators use the zpool and zfs utilities to configure and manage their storage devices and file systems respectively. Both commands employ a user-friendly syntax such as‘zfs create mypool/mydataset’ and I welcome you to watch the appropriately-titled webinar “Why we love ZFS &amp; you should too” or try a completely-graphical ZFS experience with FreeNAS.<br>\nOracle has steadily continued to develop its own proprietary branch of ZFS and Matt Ahrens points out that over 50% of the original OpenSolaris ZFS code has been replaced in OpenZFS with community contributions. This means that there are, sadly, two politically and technologically-incompatible branches of “ZFS” but fortunately, OpenZFS is orders of magnitude more popular thanks to its open nature. The two projects should be referred to as “Oracle ZFS” and “OpenZFS” to distinguish them as development efforts, but the user still types the ‘zfs’ command, which on FreeBSD relies on the ‘zfs.ko’ kernel module. My impression is that the terms of the CDDL license under which the OpenZFS branch of ZFS is published protects its users from any patent and trademark risks. Hopefully, this all helps you distinguish the OpenZFS project from the ZFS technology.</p>\n\n<ul>\n<li>There was further discussion of how the ZFSOnLinux repo will become the OpenZFS repo in the future once it also contains the bits to build on FreeBSD as well during the June 25th ZFS Leadership Meeting. The videos for all of the meetings are available <a href=\"https://www.youtube.com/channel/UC0IK6Y4Go2KtRueHDiQcxow\" rel=\"nofollow\">here</a>\n***</li>\n</ul>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://twitter.com/cperciva/status/1141852451756105729?s=03\" rel=\"nofollow\">How to safely and portably close a file descriptor in a multithreaded process without running into problems with EINTR</a></li>\n<li><a href=\"http://knoxbug.org/2019-06-27\" rel=\"nofollow\">KnoxBug Meetup June 27th at 6pm</a></li>\n<li><a href=\"https://www.flying-pie.com/locations/lake-oswego/\" rel=\"nofollow\">BSD Pizza Night, June 27th at 7pm, Flying Pie Pizzeria, 3 Monroe Pkwy, Ste S, Lake Oswego, OR</a></li>\n<li><a href=\"https://moopost.blogspot.com/2019/06/difference-between-x-and-x.html\" rel=\"nofollow\">Difference between $x and ${x}</a></li>\n<li><a href=\"https://www.nemil.com/on-software-engineering/beware-engineering-media.html\" rel=\"nofollow\">Beware of Software Engineering Media Sites</a></li>\n<li><a href=\"https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today/\" rel=\"nofollow\">How Verizon and a BGP optimizer knocked large parts of the internet offline today</a></li>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-May/718899.html\" rel=\"nofollow\">DragonflyBSD - MDS mitigation added a while ago</a></li>\n<li><a href=\"https://eurobsdcon.org\" rel=\"nofollow\">Reminder: Register for EuroBSDcon 2019 in Lillehammer, Norway</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Dave - <a href=\"http://dpaste.com/38233JC\" rel=\"nofollow\">CheriBSD</a></li>\n<li>Neb - <a href=\"http://dpaste.com/0B8XKXT#wrap\" rel=\"nofollow\">Hello from Norway</a></li>\n<li>Lars - <a href=\"http://dpaste.com/3N85SHR\" rel=\"nofollow\">Ansible tutorial?</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0304.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"DragonflyBSD 5.6 is out, OpenBSD Vulkan Support, bad utmp implementations in glibc and FreeBSD, OpenSSH protects itself against Side Channel attacks, ZFS vs OpenZFS, and more.","date_published":"2019-06-27T03:45:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6da25674-3858-4ebc-b4a5-257e1eefcbf4.mp3","mime_type":"audio/mp3","size_in_bytes":45762060,"duration_in_seconds":3813}]},{"id":"1ed8b630-10c4-44f6-9a48-2ffcb4a8b6fe","title":"303: OpenZFS in Ports","url":"https://www.bsdnow.tv/303","content_text":"OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.\n\nHeadlines\n\nZFSonFreeBSD ports renamed OpenZFS\n\n\nThe ZFS on FreeBSD project has renamed the userland and kernel ports from zol and zol-kmod to openzfs and openzfs-kmod\nThe new versions from this week are IOCTL compatible with the command line tools in FreeBSD 12.0, so you can use the old userland with the new kernel module (although obviously not the new features)\nWith the renaming it is easier to specify which kernel module you want to load in /boot/loader.conf:\n&gt; zfs_load=”YES”\nor\n&gt; openzfs_load=”YES”\nTo load traditional or the newer version of ZFS\nThe kmod still requires FreeBSD 12-stable or 13-current because it depends on the newer crypto support in the kernel for the ZFS native encryption feature. Allan is looking at ways to work around this, but it may not be practical.\nWe would like to do an unofficial poll on how people would the userland to co-exist. Add a suffix to the new commands in /usr/local (zfs.new zpool.new or whatever). One idea i’ve had is to move the zfs and zpool commands to /libexec and make /sbin/zfs and /sbin/zpool a switcher script, that will call the base or ports version based on a config file (or just based on if the port is installed)\nFor testing purposes, generally you should be fine as long as you don’t run ‘zpool upgrade’, which will make your pool only importable using the newer ZFS.\nFor extra safety, you can create a ‘zpool checkpoint’, which will allow you to undo any changes that are made to the pool during your testing with the new openzfs tools. Note: the checkpoint will undo EVERYTHING. So don’t save new data you want to keep.\nNote: Checkpoints disable all freeing operations, to prevent any data from being overwritten so that you can re-import at the checkpoint and undo any operation (including zfs destroy-ing a dataset), so also be careful you don’t run out of space during testing.\nPlease test and provide feedback.\n\n\n\n\nHow to use blacklistd(8) with NPF as a fail2ban replacement\n\n\nAbout blacklistd(8)\n\n\n\nblacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.\nThe interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf\nNow, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use. \nUnfortunately (dont' ask me why :P) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen\n\n\n\n\nNews Roundup\n\n[WIP] raidz expansion, alpha preview 1\n\n\nMotivation and Context\n&gt; This is a alpha-quality preview of RAID-Z expansion. This feature allows disks to be added one at a time to a RAID-Z group, expanding its capacity incrementally. This feature is especially useful for small pools (typically with only one RAID-Z group), where there isn't sufficient hardware to add capacity by adding a whole new RAID-Z group (typically doubling the number of disks).\n&gt; For additional context as well as a design overview, see my short talk from the 2017 OpenZFS Developer Summit: slides video\n\n\n\n\nRant: running audio VU-meter increases my CO2 footprint\n\n\nA couple months ago I noticed that the monitor on my workstation never power off anymore. Screensaver would go on, but DPMs (to do the poweroff) never kicked in.\nI grovels the output of various tools that display DPMS settings, which as usual in Xorg were useless. Everybody said DPMS is on with a timeout. I even wrote my own C program to use every available Xlib API call and even the xscreensaver library calls. (should make it available) No go, everybody says that DPMs is on, enabled and set on a timeout. Didn’t matter whether I let xscreeensaver do the job or just the X11 server.\nAfter a while I noticed that DPMS actually worked between starting my X11 server and starting all my clients. I have a minimal .xinitrc and start the actual session from a script, that is how I could notice. If I used a regular desktop login I wouldn’t have noticed. A server state bug was much more likely than a client bug.\n\n\nSee the article for the rest...\n\n\n\n\n\nXSAVE and compat32 kernel work for LLDB\n\n\nUpstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD's ptrace interface to cover more register types. You can read more about that in my Apr 2019 report.\nIn May, I was primarily continuing the work on new ptrace interface. Besides that, I've found and fixed a bug in ptrace() compat32 code, pushed LLVM buildbot to ‘green’ status and found some upstream LLVM regressions. More below.\n\n\n\n\nSome things about where icons for modern X applications come from\n\n\nIf you have a traditional window manager like fvwm, one of the things it can do is iconify X windows so that they turn into icons on the root window (which would often be called the 'desktop'). Even modern desktop environments that don't iconify programs to the root window (or their desktop) may have per-program icons for running programs in their dock or taskbar. If your window manager or desktop environment can do this, you might reasonably wonder where those icons come from by default.\nAlthough I don't know how it was done in the early days of X, the modern standard for this is part of the Extended Window Manager Hints. In EWMH, applications give the window manager a number of possible icons, generally in different sizes, as ARGB bitmaps (instead of, say, SVG format). The window manager or desktop environment can then pick whichever icon size it likes best, taking into account things like the display resolution and so on, and display it however it wants to (in its original size or scaled up or down).\nHow this is communicated in specific is through the only good interprocess communication method that X supplies, namely X properties. In the specific case of icons, the _NET_WM_ICON property is what is used, and xprop can display the size information and an ASCII art summary of what each icon looks like. It's also possible to use some additional magic to read out the raw data from _NET_WM_ICON in a useful format; see, for example, this Stackoverflow question and its answers.\n\n\n\n\nBeastie Bits\n\n\nRecent Security Innovations\nOld Unix books + Solaris\nPro-Desktop - A Tiling Desktop Environment\nThe Tar Pipe\nAt least one vim trick you might not know\n\n\n\n\nFeedback/Questions\n\n\nJohnny - listener feedback\nBrian - Questions\nMark - ZFS Question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freshports.org/sysutils/openzfs-kmod\" rel=\"nofollow\">ZFSonFreeBSD ports renamed OpenZFS</a></h3>\n\n<ul>\n<li>The ZFS on FreeBSD project has renamed the userland and kernel ports from zol and zol-kmod to openzfs and openzfs-kmod</li>\n<li>The new versions from this week are IOCTL compatible with the command line tools in FreeBSD 12.0, so you can use the old userland with the new kernel module (although obviously not the new features)</li>\n<li>With the renaming it is easier to specify which kernel module you want to load in /boot/loader.conf:\n&gt; zfs_load=”YES”</li>\n<li>or\n&gt; openzfs_load=”YES”</li>\n<li>To load traditional or the newer version of ZFS</li>\n<li>The kmod still requires FreeBSD 12-stable or 13-current because it depends on the newer crypto support in the kernel for the ZFS native encryption feature. Allan is looking at ways to work around this, but it may not be practical.</li>\n<li>We would like to do an unofficial poll on how people would the userland to co-exist. Add a suffix to the new commands in /usr/local (zfs.new zpool.new or whatever). One idea i’ve had is to move the zfs and zpool commands to /libexec and make /sbin/zfs and /sbin/zpool a switcher script, that will call the base or ports version based on a config file (or just based on if the port is installed)</li>\n<li>For testing purposes, generally you should be fine as long as you don’t run ‘zpool upgrade’, which will make your pool only importable using the newer ZFS.</li>\n<li>For extra safety, you can create a ‘zpool checkpoint’, which will allow you to undo any changes that are made to the pool during your testing with the new openzfs tools. Note: the checkpoint will undo EVERYTHING. So don’t save new data you want to keep.</li>\n<li>Note: Checkpoints disable all freeing operations, to prevent any data from being overwritten so that you can re-import at the checkpoint and undo any operation (including zfs destroy-ing a dataset), so also be careful you don’t run out of space during testing.</li>\n<li>Please test and provide feedback.</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.unitedbsd.com/d/63-how-to-use-blacklistd8-with-npf-as-a-fail2ban-replacement\" rel=\"nofollow\">How to use blacklistd(8) with NPF as a fail2ban replacement</a></h3>\n\n<ul>\n<li>About blacklistd(8)</li>\n</ul>\n\n<blockquote>\n<p>blacklistd(8) provides an API that can be used by network daemons to communicate with a packet filter via a daemon to enforce opening and closing ports dynamically based on policy.<br>\nThe interface to the packet filter is in /libexec/blacklistd-helper (this is currently designed for npf) and the configuration file (inspired from inetd.conf) is in etc/blacklistd.conf<br>\nNow, blacklistd(8) will require bpfjit(4) (Just-In-Time compiler for Berkeley Packet Filter) in order to properly work, in addition to, naturally, npf(7) as frontend and syslogd(8), as a backend to print diagnostic messages. Also remember npf shall rely on the npflog* virtual network interface to provide logging for tcpdump() to use. <br>\nUnfortunately (dont&#39; ask me why :P) in 8.1 all the required kernel components are still not compiled by default in the GENERIC kernel (though they are in HEAD), and are rather provided as modules. Enabling NPF and blacklistd services would normally result in them being automatically loaded as root, but predictably on securelevel=1 this is not going to happen</p>\n</blockquote>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://github.com/zfsonlinux/zfs/pull/8853\" rel=\"nofollow\">[WIP] raidz expansion, alpha preview 1</a></h3>\n\n<ul>\n<li>Motivation and Context\n&gt; This is a alpha-quality preview of RAID-Z expansion. This feature allows disks to be added one at a time to a RAID-Z group, expanding its capacity incrementally. This feature is especially useful for small pools (typically with only one RAID-Z group), where there isn&#39;t sufficient hardware to add capacity by adding a whole new RAID-Z group (typically doubling the number of disks).\n&gt; For additional context as well as a design overview, see my short talk from the 2017 OpenZFS Developer Summit: slides video</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://medium.com/@MartinCracauer/bug-rant-running-audio-vu-meter-increases-my-co2-footprint-871d5c1bee5a\" rel=\"nofollow\">Rant: running audio VU-meter increases my CO2 footprint</a></h3>\n\n<blockquote>\n<p>A couple months ago I noticed that the monitor on my workstation never power off anymore. Screensaver would go on, but DPMs (to do the poweroff) never kicked in.<br>\nI grovels the output of various tools that display DPMS settings, which as usual in Xorg were useless. Everybody said DPMS is on with a timeout. I even wrote my own C program to use every available Xlib API call and even the xscreensaver library calls. (should make it available) No go, everybody says that DPMs is on, enabled and set on a timeout. Didn’t matter whether I let xscreeensaver do the job or just the X11 server.<br>\nAfter a while I noticed that DPMS actually worked between starting my X11 server and starting all my clients. I have a minimal .xinitrc and start the actual session from a script, that is how I could notice. If I used a regular desktop login I wouldn’t have noticed. A server state bug was much more likely than a client bug.</p>\n\n<ul>\n<li>See the article for the rest...</li>\n</ul>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/xsave_and_compat32_kernel_work\" rel=\"nofollow\">XSAVE and compat32 kernel work for LLDB</a></h3>\n\n<blockquote>\n<p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.<br>\nIn February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I&#39;ve been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and lately extending NetBSD&#39;s ptrace interface to cover more register types. You can read more about that in my Apr 2019 report.<br>\nIn May, I was primarily continuing the work on new ptrace interface. Besides that, I&#39;ve found and fixed a bug in ptrace() compat32 code, pushed LLVM buildbot to ‘green’ status and found some upstream LLVM regressions. More below.</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/unix/ModernXAppIcons\" rel=\"nofollow\">Some things about where icons for modern X applications come from</a></h3>\n\n<blockquote>\n<p>If you have a traditional window manager like fvwm, one of the things it can do is iconify X windows so that they turn into icons on the root window (which would often be called the &#39;desktop&#39;). Even modern desktop environments that don&#39;t iconify programs to the root window (or their desktop) may have per-program icons for running programs in their dock or taskbar. If your window manager or desktop environment can do this, you might reasonably wonder where those icons come from by default.<br>\nAlthough I don&#39;t know how it was done in the early days of X, the modern standard for this is part of the Extended Window Manager Hints. In EWMH, applications give the window manager a number of possible icons, generally in different sizes, as ARGB bitmaps (instead of, say, SVG format). The window manager or desktop environment can then pick whichever icon size it likes best, taking into account things like the display resolution and so on, and display it however it wants to (in its original size or scaled up or down).<br>\nHow this is communicated in specific is through the only good interprocess communication method that X supplies, namely X properties. In the specific case of icons, the _NET_WM_ICON property is what is used, and xprop can display the size information and an ASCII art summary of what each icon looks like. It&#39;s also possible to use some additional magic to read out the raw data from _NET_WM_ICON in a useful format; see, for example, this Stackoverflow question and its answers.</p>\n</blockquote>\n\n<hr>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://undeadly.org/cgi?action=article;sid=20190605110020\" rel=\"nofollow\">Recent Security Innovations</a></li>\n<li><a href=\"https://imgur.com/a/HbSYtQI\" rel=\"nofollow\">Old Unix books + Solaris</a></li>\n<li><a href=\"https://bitcannon.net/post/pro-desktop/\" rel=\"nofollow\">Pro-Desktop - A Tiling Desktop Environment</a></li>\n<li><a href=\"https://blog.extracheese.org/2010/05/the-tar-pipe.html\" rel=\"nofollow\">The Tar Pipe</a></li>\n<li><a href=\"https://www.hillelwayne.com/post/intermediate-vim/\" rel=\"nofollow\">At least one vim trick you might not know</a></li>\n</ul>\n\n<hr>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Johnny - <a href=\"http://dpaste.com/0ZQCQ8Y#wrap\" rel=\"nofollow\">listener feedback</a></li>\n<li>Brian - <a href=\"http://dpaste.com/1843RNX#wrap\" rel=\"nofollow\">Questions</a></li>\n<li>Mark - <a href=\"http://dpaste.com/3M83X9G#wrap\" rel=\"nofollow\">ZFS Question</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<hr>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0303.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"OpenZFS-kmod port available, using blacklistd with NPF as fail2ban replacement, ZFS raidz expansion alpha preview 1, audio VU-meter increases CO2 footprint rant, XSAVE and compat32 kernel work for LLDB, where icons for modern X applications come from, and more.","date_published":"2019-06-19T22:30:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/1ed8b630-10c4-44f6-9a48-2ffcb4a8b6fe.mp3","mime_type":"audio/mp3","size_in_bytes":37840062,"duration_in_seconds":3153}]},{"id":"42938801-0d4a-4cf9-a297-c1eeddac85dc","title":"302: Contention Reduction","url":"https://www.bsdnow.tv/302","content_text":"DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.\n\nHeadlines\n\nDragonFlyBSD's Kernel Optimizations Are Paying Off\n\n\nDragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.\nThe work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)\nWith Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it's mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it's increasing the competition against FreeBSD 12 and Linux distributions.\n\n\n\n\nWhat are the differences between OpenBSD and Linux?\n\n\nMaybe you have been reading recently about the release of OpenBSD 6.5 and wonder, \"What are the differences between Linux and OpenBSD?\"\nI've also been there at some point in the past and these are my conclusions.\nThey also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.\nThis list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.\nPlease bear with me.\n\n\n\nA terminal is a terminal is a terminal\nPractical differences\nSecurity and system administration\nWhy philosophical differences matter\nSo what do I choose?\nHow to try OpenBSD\n***\n\n\nNews Roundup\n\nNetBSD 2019 Google Summer of Code\n\n\nWe are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:\n\n\n\nAkul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing\nManikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration\nSiddharth Muralee - Enhancing Syzkaller support for NetBSD\nSurya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel\nJason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD\nSaurav Prakash - Porting NetBSD to HummingBoard Pulse\nNaveen Narayanan - Porting WINE to amd64 architecture on NetBSD\n\n\n\nThe communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.\nPlease welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!\n\n\n\n\nReducing that contention\n\n\nThe opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let's dive into the issue!\n\n\n\nState of affairs\n\n\n\nMost of OpenBSD's kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).\nI believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.\n\n\n\nNext steps\n\n\n\nIn the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren't performance critical. \n\n\n\nSee the Article for the rest of the post\n\n\n\n\nfnaify 1.3 released - more games are \"fnaify &amp; run\" now\n\n\nThis release finally addresses some of the problems that prevent simple running of several games.\nThis happens for example when an old FNA.dll library comes with the games that doesn't match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. \n\nAnother blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn't found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.\nThis may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. \n\n\nvmctl(8): command line syntax changed\n\n\nThe order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. \nFor example, the old syntax looked like this:\n\n\n# vmctl create disk.qcow2 -s 50G\n\n\nThe new syntax specifies the command options before the argument:\n\n\n# vmctl create -s 50G disk.qcow2\n\n\n\nSomething that Linux distributions should not do when packaging things\n\n\nRight now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.\nFor reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).\nRecently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package 'grafana'. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the 'grafana' package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com 'grafana-6.1.5-1' package to the Fedora 'grafana-6.1.6-1.fc29' one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.\nWhy is this a problem? It's simple. If you're going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don't keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to 'upgrade' it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make 'dnf upgrade' into a minefield (because it will frequently try to give me a 'grafana' upgrade that I don't want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the 'grafana' package version on me.\n\n\n\n\nBeastie Bits\n\n\n[talk] ZFS v UFS on APU2 msata SSD with FreeBSD\nNetBSD 8.1 is out\nlazyboi – the laziest possible way to send raw HTTP POST data\nA Keyboard layout that changes by markov frequency\nOpen Source Game Clones\nEuroBSDcon program &amp; registration open\n***\n\n\nFeedback/Questions\n\n\nJohn - A segment idea\nJohnny - Audio only format please don't\nAlex - Thanks and some Linux Snaps vs PBI feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n***\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>DragonFlyBSD&#39;s kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&item=dragonfly-55-threadripper&num=1\" rel=\"nofollow\">DragonFlyBSD&#39;s Kernel Optimizations Are Paying Off</a></h3>\n\n<blockquote>\n<p>DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.<br>\nThe work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)<br>\nWith Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it&#39;s mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it&#39;s increasing the competition against FreeBSD 12 and Linux distributions.</p>\n\n<hr>\n</blockquote>\n\n<h3><a href=\"https://cfenollosa.com/blog/what-are-the-differences-between-openbsd-and-linux.html\" rel=\"nofollow\">What are the differences between OpenBSD and Linux?</a></h3>\n\n<blockquote>\n<p>Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, &quot;What are the differences between Linux and OpenBSD?&quot;<br>\nI&#39;ve also been there at some point in the past and these are my conclusions.<br>\nThey also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.<br>\nThis list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.<br>\nPlease bear with me.</p>\n</blockquote>\n\n<ul>\n<li>A terminal is a terminal is a terminal</li>\n<li>Practical differences</li>\n<li>Security and system administration</li>\n<li>Why philosophical differences matter</li>\n<li>So what do I choose?</li>\n<li>How to try OpenBSD\n***</li>\n</ul>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code1\" rel=\"nofollow\">NetBSD 2019 Google Summer of Code</a></h3>\n\n<blockquote>\n<p>We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:</p>\n</blockquote>\n\n<ul>\n<li>Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing</li>\n<li>Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration</li>\n<li>Siddharth Muralee - Enhancing Syzkaller support for NetBSD</li>\n<li>Surya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel</li>\n<li>Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD</li>\n<li>Saurav Prakash - Porting NetBSD to HummingBoard Pulse</li>\n<li>Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD</li>\n</ul>\n\n<blockquote>\n<p>The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.<br>\nPlease welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!</p>\n</blockquote>\n\n<hr>\n\n<h3><a href=\"http://www.grenadille.net/post/2019/05/09/Reducing-that-contention\" rel=\"nofollow\">Reducing that contention</a></h3>\n\n<blockquote>\n<p>The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let&#39;s dive into the issue!</p>\n</blockquote>\n\n<ul>\n<li>State of affairs</li>\n</ul>\n\n<blockquote>\n<p>Most of OpenBSD&#39;s kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).<br>\nI believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.</p>\n</blockquote>\n\n<ul>\n<li>Next steps</li>\n</ul>\n\n<blockquote>\n<p>In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren&#39;t performance critical. </p>\n</blockquote>\n\n<ul>\n<li>See the Article for the rest of the post</li>\n</ul>\n\n<hr>\n\n<h3><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/btste9/fnaify_13_released_more_games_are_fnaify_run_now/\" rel=\"nofollow\">fnaify 1.3 released - more games are &quot;fnaify &amp; run&quot; now</a></h3>\n\n<blockquote>\n<p>This release finally addresses some of the problems that prevent simple running of several games.<br>\nThis happens for example when an old FNA.dll library comes with the games that doesn&#39;t match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. </p>\n\n<p>Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn&#39;t found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.<br>\nThis may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. </p>\n</blockquote>\n\n<h3><a href=\"https://www.openbsd.org/faq/current.html#r20190529\" rel=\"nofollow\">vmctl(8): command line syntax changed</a></h3>\n\n<blockquote>\n<p>The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. <br>\nFor example, the old syntax looked like this:</p>\n</blockquote>\n\n<p><code># vmctl create disk.qcow2 -s 50G</code></p>\n\n<blockquote>\n<p>The new syntax specifies the command options before the argument:</p>\n</blockquote>\n\n<p><code># vmctl create -s 50G disk.qcow2</code></p>\n\n<hr>\n\n<h3><a href=\"https://utcc.utoronto.ca/%7Ecks/space/blog/linux/PackageNameClashProblem\" rel=\"nofollow\">Something that Linux distributions should not do when packaging things</a></h3>\n\n<blockquote>\n<p>Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.<br>\nFor reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).<br>\nRecently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package &#39;grafana&#39;. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the &#39;grafana&#39; package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com &#39;grafana-6.1.5-1&#39; package to the Fedora &#39;grafana-6.1.6-1.fc29&#39; one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.<br>\nWhy is this a problem? It&#39;s simple. If you&#39;re going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don&#39;t keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to &#39;upgrade&#39; it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make &#39;dnf upgrade&#39; into a minefield (because it will frequently try to give me a &#39;grafana&#39; upgrade that I don&#39;t want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the &#39;grafana&#39; package version on me.</p>\n\n<hr>\n</blockquote>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.nycbug.org:8080/pipermail/talk/2019-May/017885.html\" rel=\"nofollow\">[talk] ZFS v UFS on APU2 msata SSD with FreeBSD</a></li>\n<li><a href=\"http://www.netbsd.org/releases/formal-8/NetBSD-8.1.html\" rel=\"nofollow\">NetBSD 8.1 is out</a></li>\n<li><a href=\"https://github.com/ctsrc/lazyboi\" rel=\"nofollow\">lazyboi – the laziest possible way to send raw HTTP POST data</a></li>\n<li><a href=\"https://github.com/shapr/markovkeyboard\" rel=\"nofollow\">A Keyboard layout that changes by markov frequency</a></li>\n<li><a href=\"https://osgameclones.com/\" rel=\"nofollow\">Open Source Game Clones</a></li>\n<li><a href=\"https://eurobsdcon.org\" rel=\"nofollow\">EuroBSDcon program &amp; registration open</a>\n***</li>\n</ul>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>John - <a href=\"http://dpaste.com/3YTBQTX#wrap\" rel=\"nofollow\">A segment idea</a></li>\n<li>Johnny - <a href=\"http://dpaste.com/3WD0A25#wrap\" rel=\"nofollow\">Audio only format please don&#39;t</a></li>\n<li>Alex - <a href=\"http://dpaste.com/1RQF4QM#wrap\" rel=\"nofollow\">Thanks and some Linux Snaps vs PBI feedback</a></li>\n</ul>\n\n<hr>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a>\n***</li>\n</ul>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0302.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.","date_published":"2019-06-12T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/42938801-0d4a-4cf9-a297-c1eeddac85dc.mp3","mime_type":"audio/mp3","size_in_bytes":50043425,"duration_in_seconds":4170}]},{"id":"d11a1228-2ac2-4e13-9d11-7a4c5a2dc0c1","title":"301: GPU Passthrough","url":"https://www.bsdnow.tv/301","content_text":"GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.\n\nHeadlines\n\nGPU Passthrough Reported Working on Bhyve\n\n\n  Normally we cover news focused on KVM and sometimes Xen, but something very special has happened with their younger cousin in the BSD world, Bhyve.\n  For those that don’t know, Bhyve (pronounced bee-hive) is the native hypervisor in FreeBSD. It has many powerful features, but one that’s been a pain point for some years now is VGA passthrough. Consumer GPUs have not been useable until very recently despite limited success with enterprise cards.\n  However, Twitter user Michael Yuji found a workaround that enables passing through a consumer card to any *nix system configured to use X11:\n\n\n\nhttps://twitter.com/michael_yuji/status/1127136891365658625\n\n\n\n  All you have to do is add a line pointing the X server to the Bus ID of the passed card and the VM will boot, with acceleration and everything. He theorizes that this may not be possible on windows because of the way it looks for display devices, but it’s a solid start.\n  As soon as development surrounding VGA passthrough matures on Bhyve, it will become a very attractive alternative to more common tools like Hyper-V and Qemu, because it makes many powerful features available in the host system like jails, boot environments, BSD networking, and tight ZFS integration. For example, you could potentially run your Router, NAS, preferred workstation OS and any number of other things in one box, and only have to spin up a single VM because of the flexibility afforded by jails over Linux-based containers.\n  The user who found this workaround also announced they’d be writing it up at some point, so stay tuned for details on the process.\n  It’s been slow going on Bhyve passthrough development for a while, but this new revelation is encouraging. We’ll be closely monitoring the situation and report on any other happenings.\n  \n  \n\n\nConfusion with used/free disk space in ZFS\n\n\n  I use ZFS extensively. ZFS is my favorite file system. I write articles and give lectures about it. I work with it every day. In traditional file systems we use df(1) to determine free space on partitions. We can also use du(1) to count the size of the files in the directory. But it’s different on ZFS and this is the most confusing thing EVER. I always forget which tool reports what disk space usage! Every time somebody asks me, I need to google it. For this reason I decided to document it here - for myself - because if I can’t remember it at least I will not need to google it, as it will be on my blog, but maybe you will also benefit from this blog post if you have the same problem or you are starting your journey with ZFS.\n  \n  The understanding of how ZFS is uses space and how to determine which value means what is a crucial thing. I hope thanks to this article I will finally remember it!\n\n\n\n\nNews Roundup\n\nOmniOS Community Edition\n\n\n  The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.\n  OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.\n  This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.\n  If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.\n  The OmniOS team and the illumos community have been very active in creating new features and improving existing ones over the last 6 months.\n\n\n\n\npfSense 2.4.4 Release p3 is available\n\n\n  We are pleased to announce the release of pfSense® software version 2.4.4-p3, now available for new installations and upgrades!\n  pfSense software version 2.4.4-p3 is a maintenance release, bringing a number of security enhancements as well as a handful of fixes for issues present in the 2.4.4-p2 release.\n  pfSense 2.4.4-RELEASE-p3 updates and installation images are available now!\n  To see a complete list of changes and find more detail, see the Release Notes.\n  We had hoped to bring you this release a few days earlier, but given the announcement last Tuesday of the Intel Microarchitectural Data Sampling (MDS) issue, we did not have sufficient time to fully incorporate those corrections and properly test for release on Thursday. We felt that it was worth delaying for a few days, rather than making multiple releases within a week.\n\n\n\nUpgrade Notes\n\n\n\n  Due to the significant nature of the changes in 2.4.4 and later, \n  warnings and error messages, particularly from PHP and package updates, are likely to occur during the upgrade process. In nearly all cases these errors are a harmless side effect of the changes between FreeBSD 11.1 and 11.2 and between PHP 5.6 and PHP 7.2.\n  Always take a backup of the firewall configuration prior to any major change to the firewall, such as an upgrade.\n  Do not update packages before upgrading pfSense! Either remove all packages or do not update packages before running the upgrade.\n  The upgrade will take several minutes to complete. The exact time varies based on download speed, hardware speed, and other factors such installed packages. Be patient during the upgrade and allow the firewall enough time to complete the entire process. After the update packages finish downloading it could take 10-20 minutes or more until the upgrade process ends. The firewall may reboot several times during the upgrade process. Monitor the upgrade from the firewall console for the most accurate view.\n\n\n\n\nNetBSD 8.1 RC1 is out\n\n\n  The NetBSD Project is pleased to announce NetBSD 8.1, the first update of the NetBSD 8 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.\n  \n  Some highlights of the 8.1 release are:\n\n\n\nx86: Mitigation for INTEL-SA-00233 (MDS)\n\nVarious local user kernel data leaks fixed.\n\nx86: new rc.conf(5) setting smtoff to disable Simultaneous Multi-Threading\n\nVarious network driver fixes and improvements.\n\nFixes for thread local storage (TLS) in position independent executables (PIE).\n\nFixes to reproducible builds.\n\nFixed a performance regression in tmpfs.\n\nDRM/KMS improvements.\n\nbwfm(4) wireless driver for Broadcom FullMAC PCI and USB devices added.\n\nVarious sh(1) fixes.\n\nmfii(4) SAS driver added.\n\nhcpcd(8) updated to 7.2.2\n\nhttpd(8) updated.\n\n\n\n\nFreeNAS as your Server OS\n\n\n  What if you could have a server OS that had built in RAID, NAS and SAN functionality, and could manage packages, containers and VMs in a GUI? What if that server OS was also free to download and install? Wouldn’t that be kind of awesome? Wouldn’t that be FreeNAS?\n  FreeNAS is the world’s number one, open source storage OS, but it also comes equipped with all the jails, plugins, and VMs you need to run additional server-level services for things like email and web site hosting. File, Block, and even Object storage is all built-in and can be enabled with a few clicks. The ZFS file system scales to more drives than you could ever buy, with no limits for dataset sizes, snapshots, and restores.\n  FreeNAS is also 100% FreeBSD. This is the OS used in the Netflix CDN, your PS4, and the basis for iOS. Set up a jail and get started downloading packages like Apache or NGINX for web hosting or Postfix for email service.\n  Just released, our new TrueCommand management platform also streamlines alerts and enables multi-system monitoring.\n\n\n\n\nBeastie Bits\n\n\nKeep Crashing Daemons Running on FreeBSD\n\nLook what I found today... my first set of BSD CDs...\n\nNetBSD - Intel MDS\n\nFreeBSD 11.3-BETA2 -- Please test!\n\n\n\n\nFeedback/Questions\n\n\nAnthony - Question\n\nGuntbert - Podcast\n\nGuillaume - Another suggestion for Ales from Serbia\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"gpupassthroughreportedworkingonbhyvehttpspassthroughpostgpupassthroughreportedworkingonbhyve\"><a href=\"https://passthroughpo.st/gpu-passthrough-reported-working-on-bhyve/\">GPU Passthrough Reported Working on Bhyve</a></h3>\n\n<blockquote>\n  <p>Normally we cover news focused on KVM and sometimes Xen, but something very special has happened with their younger cousin in the BSD world, Bhyve.\n  For those that don’t know, Bhyve (pronounced bee-hive) is the native hypervisor in FreeBSD. It has many powerful features, but one that’s been a pain point for some years now is VGA passthrough. Consumer GPUs have not been useable until very recently despite limited success with enterprise cards.\n  However, Twitter user Michael Yuji found a workaround that enables passing through a consumer card to any *nix system configured to use X11:</p>\n</blockquote>\n\n<ul>\n<li>https://twitter.com/michael_yuji/status/1127136891365658625</li>\n</ul>\n\n<blockquote>\n  <p>All you have to do is add a line pointing the X server to the Bus ID of the passed card and the VM will boot, with acceleration and everything. He theorizes that this may not be possible on windows because of the way it looks for display devices, but it’s a solid start.\n  As soon as development surrounding VGA passthrough matures on Bhyve, it will become a very attractive alternative to more common tools like Hyper-V and Qemu, because it makes many powerful features available in the host system like jails, boot environments, BSD networking, and tight ZFS integration. For example, you could potentially run your Router, NAS, preferred workstation OS and any number of other things in one box, and only have to spin up a single VM because of the flexibility afforded by jails over Linux-based containers.\n  The user who found this workaround also announced they’d be writing it up at some point, so stay tuned for details on the process.\n  It’s been slow going on Bhyve passthrough development for a while, but this new revelation is encouraging. We’ll be closely monitoring the situation and report on any other happenings.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"confusionwithusedfreediskspaceinzfshttpsoshogbovexilliumorgblog65\"><a href=\"https://oshogbo.vexillium.org/blog/65/\">Confusion with used/free disk space in ZFS</a></h3>\n\n<blockquote>\n  <p>I use ZFS extensively. ZFS is my favorite file system. I write articles and give lectures about it. I work with it every day. In traditional file systems we use df(1) to determine free space on partitions. We can also use du(1) to count the size of the files in the directory. But it’s different on ZFS and this is the most confusing thing EVER. I always forget which tool reports what disk space usage! Every time somebody asks me, I need to google it. For this reason I decided to document it here - for myself - because if I can’t remember it at least I will not need to google it, as it will be on my blog, but maybe you will also benefit from this blog post if you have the same problem or you are starting your journey with ZFS.</p>\n  \n  <p>The understanding of how ZFS is uses space and how to determine which value means what is a crucial thing. I hope thanks to this article I will finally remember it!</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"omnioscommunityeditionhttpsomniosceorgarticlerelease030html\"><a href=\"https://omniosce.org/article/release-030.html\">OmniOS Community Edition</a></h3>\n\n<blockquote>\n  <p>The OmniOS Community Edition Association is proud to announce the general availability of OmniOS - r151030.\n  OmniOS is published according to a 6-month release cycle, r151030 LTS takes over from r151028, published in November 2018; and since it is a LTS release it also takes over from r151022. The r151030 LTS release will be supported for 3 Years. It is the first LTS release published by the OmniOS CE Association since taking over the reins from OmniTI in 2017. The next LTS release is scheduled for May 2021. The old stable r151026 release is now end-of-life. See the release schedule for further details.\n  This is only a small selection of the new features, and bug fixes in the new release; review the release notes for full details.\n  If you upgrade from r22 and want to see all new features added since then, make sure to also read the release notes for r24, r26 and r28.\n  The OmniOS team and the illumos community have been very active in creating new features and improving existing ones over the last 6 months.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"pfsense244releasep3isavailablehttpswwwnetgatecomblogpfsense244releasep3nowavailablehtml\"><a href=\"https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html\">pfSense 2.4.4 Release p3 is available</a></h3>\n\n<blockquote>\n  <p>We are pleased to announce the release of pfSense® software version 2.4.4-p3, now available for new installations and upgrades!\n  pfSense software version 2.4.4-p3 is a maintenance release, bringing a number of security enhancements as well as a handful of fixes for issues present in the 2.4.4-p2 release.\n  pfSense 2.4.4-RELEASE-p3 updates and installation images are available now!\n  To see a complete list of changes and find more detail, see the Release Notes.\n  We had hoped to bring you this release a few days earlier, but given the announcement last Tuesday of the Intel Microarchitectural Data Sampling (MDS) issue, we did not have sufficient time to fully incorporate those corrections and properly test for release on Thursday. We felt that it was worth delaying for a few days, rather than making multiple releases within a week.</p>\n</blockquote>\n\n<ul>\n<li>Upgrade Notes</li>\n</ul>\n\n<blockquote>\n  <p>Due to the significant nature of the changes in 2.4.4 and later, \n  warnings and error messages, particularly from PHP and package updates, are likely to occur during the upgrade process. In nearly all cases these errors are a harmless side effect of the changes between FreeBSD 11.1 and 11.2 and between PHP 5.6 and PHP 7.2.\n  Always take a backup of the firewall configuration prior to any major change to the firewall, such as an upgrade.\n  Do not update packages before upgrading pfSense! Either remove all packages or do not update packages before running the upgrade.\n  The upgrade will take several minutes to complete. The exact time varies based on download speed, hardware speed, and other factors such installed packages. Be patient during the upgrade and allow the firewall enough time to complete the entire process. After the update packages finish downloading it could take 10-20 minutes or more until the upgrade process ends. The firewall may reboot several times during the upgrade process. Monitor the upgrade from the firewall console for the most accurate view.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"netbsd81rc1isouthttpswwwnetbsdorgreleasesformal8netbsd81html\"><a href=\"https://www.netbsd.org/releases/formal-8/NetBSD-8.1.html\">NetBSD 8.1 RC1 is out</a></h3>\n\n<blockquote>\n  <p>The NetBSD Project is pleased to announce NetBSD 8.1, the first update of the NetBSD 8 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>\n  \n  <p>Some highlights of the 8.1 release are:</p>\n</blockquote>\n\n<ul>\n<li>x86: Mitigation for INTEL-SA-00233 (MDS)</li>\n\n<li>Various local user kernel data leaks fixed.</li>\n\n<li>x86: new rc.conf(5) setting smtoff to disable Simultaneous Multi-Threading</li>\n\n<li>Various network driver fixes and improvements.</li>\n\n<li>Fixes for thread local storage (TLS) in position independent executables (PIE).</li>\n\n<li>Fixes to reproducible builds.</li>\n\n<li>Fixed a performance regression in tmpfs.</li>\n\n<li>DRM/KMS improvements.</li>\n\n<li>bwfm(4) wireless driver for Broadcom FullMAC PCI and USB devices added.</li>\n\n<li>Various sh(1) fixes.</li>\n\n<li>mfii(4) SAS driver added.</li>\n\n<li>hcpcd(8) updated to 7.2.2</li>\n\n<li>httpd(8) updated.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"freenasasyourserveroshttpswwwixsystemscomblogfreenasasyourserveros\"><a href=\"https://www.ixsystems.com/blog/freenas-as-your-server-os/\">FreeNAS as your Server OS</a></h3>\n\n<blockquote>\n  <p>What if you could have a server OS that had built in RAID, NAS and SAN functionality, and could manage packages, containers and VMs in a GUI? What if that server OS was also free to download and install? Wouldn’t that be kind of awesome? Wouldn’t that be FreeNAS?\n  FreeNAS is the world’s number one, open source storage OS, but it also comes equipped with all the jails, plugins, and VMs you need to run additional server-level services for things like email and web site hosting. File, Block, and even Object storage is all built-in and can be enabled with a few clicks. The ZFS file system scales to more drives than you could ever buy, with no limits for dataset sizes, snapshots, and restores.\n  FreeNAS is also 100% FreeBSD. This is the OS used in the Netflix CDN, your PS4, and the basis for iOS. Set up a jail and get started downloading packages like Apache or NGINX for web hosting or Postfix for email service.\n  Just released, our new TrueCommand management platform also streamlines alerts and enables multi-system monitoring.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.babaei.net/blog/keep-crashing-daemons-running-on-freebsd/\">Keep Crashing Daemons Running on FreeBSD</a></li>\n\n<li><a href=\"https://old.reddit.com/r/freebsd/comments/btksgf/look_what_i_found_today_my_first_set_of_bsd_cds/\">Look what I found today... my first set of BSD CDs...</a></li>\n\n<li><a href=\"https://wiki.netbsd.org/security/intel_mds/\">NetBSD - Intel MDS</a></li>\n\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091227.html\">FreeBSD 11.3-BETA2 -- Please test!</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Anthony - <a href=\"http://dpaste.com/33S61HH#wrap\">Question</a></li>\n\n<li>Guntbert - <a href=\"http://dpaste.com/0NDACM2\">Podcast</a></li>\n\n<li>Guillaume - <a href=\"http://dpaste.com/0N3Q9TN\">Another suggestion for Ales from Serbia</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0301.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"GPU passthrough on bhyve, confusion with used/free disk space on ZFS, OmniOS Community Edition, pfSense 2.4.4 Release p3, NetBSD 8.1 RC1, FreeNAS as your Server OS, and more.","date_published":"2019-06-05T23:15:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d11a1228-2ac2-4e13-9d11-7a4c5a2dc0c1.mp3","mime_type":"audio/mp3","size_in_bytes":32812013,"duration_in_seconds":2734}]},{"id":"f4d00ce6-8060-4be0-9049-570b73a6adbd","title":"300: The Big Three","url":"https://www.bsdnow.tv/300","content_text":"FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. \n\nHeadlines\n\nFreeBSD 11.3-b1 is out\n\nBSDCan 2019 Recap\n\n\nWe’re back from BSDCan and it was a packed week as always.\n\nIt started with bhyvecon on Tuesday. Meanwhile, Benedict spent the whole day in productive meetings: annual FreeBSD Foundation board meeting and FreeBSD Journal editorial board meeting.\n\nOn Wednesday, tutorials for BSDCan started as well as the FreeBSD Developer Summit. In the mornings, there were presentations in the big auditorium, while working groups about networking, failsafe bootcode, development web services, swap space management, and testing/CI were held. Friday had a similar format with an update from the FreeBSD core team and the “have, need, want” session for FreeBSD 13. In the afternoon, there were working groups about translation tools, package base, GSoC/Outreachy, or general hacking. Benedict held his Icinga tutorial in the afternoon with about 15 people attending.\nDevsummit presentation slides can be found on the wiki page and video recordings done by ScaleEngine are available on FreeBSD’s youtube channel.\n\nThe conference program was a good mixture of sysadmin and tech talks across the major BSDs. Benedict saw the following talks: How ZFS snapshots really work by Matt Ahrens, 20 years in Jail by Michael W. Lucas, OpenZFS BOF session, the future of OpenZFS and FreeBSD, MQTT for system administrators by Jan-Piet Mens, and spent the rest of the time in between in the hallway track. \n\nPhotos from the event are available on Ollivier Robert’s talegraph\n and Diane Bruce’s website for day 1, day 2, conference day 1, and conference day 2.\n\nThanks to all the sponsors, supporters, organizers, speakers, and attendees for making this yet another great BSDCan. Next year’s BSDCan will be from June 2 - 6, 2020.\n\n\n\n\nOpenIndiana 2019.04 is out\n\n\n  We have released a new OpenIndiana Hipster snapshot 2019.04. The noticeable changes:\n\n\n\nFirefox was updated to 60.6.3 ESR\n\nVirtualbox packages were added (including guest additions)\n\nMate was updated to 1.22\n\nIPS has received updates from OmniOS CE and Oracle IPS repos, including automatic boot environment naming\n\nSome OI-specific applications have been ported from Python 2.7/GTK 2 to Python 3.5/GTK 3\n\nQuick Demo Video: https://www.youtube.com/watch?v=tQ0-fo3XNrg\n\n\n\n\nNews Roundup\n\nOverview of ZFS Pools in FreeNAS\n\n\n  FreeNAS uses the OpenZFS (ZFS) file system, which handles both disk and volume management. ZFS offers RAID options mirror, stripe, and its own parity distribution called RAIDZ that functions like RAID5 on hardware RAID. The file system is extremely flexible and secure, with various drive combinations, checksums, snapshots, and replication all possible. For a deeper dive on ZFS technology, read the ZFS Primer section of the FreeNAS documentation.\n  \n  SUGGEST LAYOUT attempts to balance usable capacity and redundancy by automatically choosing an ideal vdev layout for the number of available disks.\n\n\n\nThe following vdev layout options are available when creating a pool:\n\n\n\nStripe data is shared on two drives, similar to RAID0)\n\nMirror copies data on two drives, similar to RAID1 but not limited to 2 disks)\n\nRAIDZ1 single parity similar to RAID5\n\nRAIDZ2 double parity similar to RAID6\n\nRAIDZ3 which uses triple parity and has no RAID equivalent\n\n\n\n\n\nWhy OpenSource Firmware is Important for Security\n\n\nRoots of Trust\n\n\n\n  The goal of the root of trust should be to verify that the software installed in every component of the hardware is the software that was intended. This way you can know without a doubt and verify if hardware has been hacked. Since we have very little to no visibility into the code running in a lot of places in our hardware it is hard to do this. How do we really know that the firmware in a component is not vulnerable or that is doesn’t have any backdoors? Well we can’t. Not unless it was all open source.\n  Every cloud and vendor seems to have their own way of doing a root of trust. Microsoft has Cerberus, Google has Titan, and Amazon has Nitro. These seem to assume an explicit amount of trust in the proprietary code (the code we cannot see). This leaves me with not a great feeling. Wouldn’t it be better to be able to use all open source code? Then we could verify without a doubt that the code you can read and build yourself is the same code running on hardware for all the various places we have firmware. We could then verify that a machine was in a correct state without a doubt of it being vulnerable or with a backdoor.\n  It makes me wonder what the smaller cloud providers like DigitalOcean or Packet have for a root of trust. Often times we only hear of these projects from the big three or five. \n\n\n\n\nOPNsense\n\n\n  This update addresses several privilege escalation issues in the access control implementation and new memory disclosure issues in Intel CPUs. We would like to thank Arnaud Cordier and Bill Marquette for the top-notch reports and coordination.\n\n\n\nHere are the full patch notes:\n\nsystem: address CVE-2019-11816 privilege escalation bugs[1] (reported by Arnaud Cordier)\n\nsystem: /etc/hosts generation without interfacehasgateway()\n\nsystem: show correct timestamp in config restore save message (contributed by nhirokinet)\n\nsystem: list the commands for the pluginctl utility when n+ argument is given\n\nsystem: introduce and use userIsAdmin() helper function instead of checking for 'page-all' privilege directly\n\nsystem: use absolute path in widget ACLs (reported by Netgate)\n\nsystem: RRD-related cleanups for less code exposure\n\ninterfaces: add EN DUID Generation using OPNsense PEN (contributed by Team Rebellion)\n\ninterfaces: replace legacygetallinterface_addresses() usage\n\nfirewall: fix port validation in aliases with leading / trailing spaces\n\nfirewall: fix outbound NAT translation display in overview page\n\nfirewall: prevent CARP outgoing packets from using the configured gateway\n\nfirewall: use CARP net.inet.carp.demotion to control current demotion in status page\n\nfirewall: stop live log poller on error result\n\ndhcpd: change rule priority to 1 to avoid bogon clash\n\ndnsmasq: only admins may edit custom options field\n\nfirmware: use insecure mode for base and kernel sets when package fingerprints are disabled\n\nfirmware: add optional device support for base and kernel sets\n\nfirmware: add Hostcentral mirror (HTTP, Melbourne, Australia)\n\nipsec: always reset rightallowany to default when writing configuration\n\nlang: say \"hola\" to Spanish as the newest available GUI language\n\nlang: updates for Chinese, Czech, Japanese, German, French, Russian and Portuguese\n\nnetwork time: only admins may edit custom options field\n\nopenvpn: call openvpnrefreshcrls() indirectly via plugin_configure() for less code exposure\n\nopenvpn: only admins may edit custom options field to prevent privilege escalation (reported by Bill Marquette)\n\nopenvpn: remove custom options field from wizard\n\nunbound: only admins may edit custom options field\n\nwizard: translate typehint as well\n\nplugins: os-freeradius 1.9.3 fixes string interpolation in LDAP filters (contributed by theq86)\n\nplugins: os-nginx 1.12[2]\n\nplugins: os-theme-cicada 1.17 (contributed by Team Rebellion)\n\nplugins: os-theme-tukan 1.17 (contributed by Team Rebellion)\n\nsrc: timezone database information update[3]\n\nsrc: install(1) broken with partially matching relative paths[4]\n\nsrc: microarchitectural Data Sampling (MDS) mitigation[5]\n\nports: carootnss 3.44\n\nports: php 7.2.18[6]\n\nports: sqlite 3.28.0[7]\n\nports: strongswan custom XAuth generic patch removed\n\n\n\n\nwiregaurd on OpenBSD\n\n\n  Earlier this week I imported a port for WireGuard into the OpenBSD ports tree. At the moment we have the userland daemon and the tools available. The in-kernel implementation is only available for Linux. At the time of writing there are packages available for -current.\n  Jason A. Donenfeld (WireGuard author) has worked to support OpenBSD in WireGuard and as such his post on ports@ last year got me interested in WireGuard, since then others have toyed with WireGuard on OpenBSD before and as such I've used Ted's article as a reference. Note however that some of the options mentioned there are no longer valid. Also, I'll be using two OpenBSD peers here.\n  The setup will be as follows: two OpenBSD peers, of which we'll dub wg1 the server and wg2 the client. The WireGuard service on wg1 is listening on 100.64.4.3:51820.\n\n\n\nConclusion\n\n\n\n  WireGuard (cl)aims to be easier to setup and faster than OpenVPN and while I haven't been able to verify the latter, the first is certainly true...once you've figured it out. Most documentation out there is for Linux so I had to figure out the wireguardgo service and the tun parameters. But all in all, sure, it's easier. Especially the client configuration on iOS which I didn't cover here because it's essentially pkgadd libqrencode ; cat client.conf | qrencode -t ansiutf8, scan the code with the WireGuard app and you're good to go. What is particularly neat is that WireGuard on iOS supports Always-on.\n\n\n\n\nBeastie Bits\n\n\nSerenity OS\n\nvkernels vs pmap\n\nBrian Kernighan interviews Ken Thompson\n\nImprovements in forking, threading, and signal code\n\nDragonFly 5.4.3\n\nNetBSD on the Odroid C2\n\n\n\n\nFeedback/Questions\n\n\nPaulo - Laptops\n\nA Listener - Thanks\n\nBostjan - Extend a pool and lower RAM footprint\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. </p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"freebsd113b1isouthttpslistsfreebsdorgpipermailfreebsdstable2019may091210html\"><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2019-May/091210.html\">FreeBSD 11.3-b1 is out</a></h3>\n\n<h3 id=\"bsdcan2019recaphttpswwwbsdcanorg2019\"><a href=\"https://www.bsdcan.org/2019/\">BSDCan 2019 Recap</a></h3>\n\n<ul>\n<li>We’re back from BSDCan and it was a packed week as always.</li>\n\n<li>It started with <a href=\"http://bhyvecon.org/\">bhyvecon</a> on Tuesday. Meanwhile, Benedict spent the whole day in productive meetings: annual FreeBSD Foundation board meeting and FreeBSD Journal editorial board meeting.</li>\n\n<li>On Wednesday, tutorials for BSDCan started as well as the <a href=\"https://wiki.freebsd.org/DevSummit/201905\">FreeBSD Developer Summit</a>. In the mornings, there were presentations in the big auditorium, while working groups about networking, failsafe bootcode, development web services, swap space management, and testing/CI were held. Friday had a similar format with an update from the FreeBSD core team and the “have, need, want” session for FreeBSD 13. In the afternoon, there were working groups about translation tools, package base, GSoC/Outreachy, or general hacking. Benedict held his Icinga tutorial in the afternoon with about 15 people attending.\nDevsummit presentation slides can be found on the wiki page and video recordings done by <a href=\"https://www.scaleengine.com/\">ScaleEngine</a> are available on <a href=\"https://www.youtube.com/channel/UCxLxR_oW-NAmChIcSkAyZGQ\">FreeBSD’s youtube channel</a>.</li>\n\n<li>The conference program was a good mixture of sysadmin and tech talks across the major BSDs. Benedict saw the following talks: How ZFS snapshots really work by Matt Ahrens, 20 years in Jail by Michael W. Lucas, OpenZFS BOF session, the future of OpenZFS and FreeBSD, MQTT for system administrators by Jan-Piet Mens, and spent the rest of the time in between in the hallway track. </li>\n\n<li>Photos from the event are available on <a href=\"https://www.talegraph.com/tales/Qg446T5bKT\">Ollivier Robert’s talegraph\n</a> and Diane Bruce’s website for <a href=\"http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web/\">day 1</a>, <a href=\"http://www.db.net/gallery/BSDCan/2019_FreeBSD_Dev_Summit_day_2_web\">day 2</a>, <a href=\"http://www.db.net/gallery/BSDCan/2019_BSDCan_day_1_web\">conference day 1</a>, and <a href=\"http://www.db.net/gallery/BSDCan/2019_BSDCan_day_2_web\">conference day 2</a>.</li>\n\n<li>Thanks to all the sponsors, supporters, organizers, speakers, and attendees for making this yet another great BSDCan. Next year’s BSDCan will be from June 2 - 6, 2020.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"openindiana201904isouthttpswwwopenindianaorg20190512openindianahipster201904ishere\"><a href=\"https://www.openindiana.org/2019/05/12/openindiana-hipster-2019-04-is-here/\">OpenIndiana 2019.04 is out</a></h3>\n\n<blockquote>\n  <p>We have released a new OpenIndiana Hipster snapshot 2019.04. The noticeable changes:</p>\n</blockquote>\n\n<ul>\n<li><p>Firefox was updated to 60.6.3 ESR</p></li>\n\n<li><p>Virtualbox packages were added (including guest additions)</p></li>\n\n<li><p>Mate was updated to 1.22</p></li>\n\n<li><p>IPS has received updates from OmniOS CE and Oracle IPS repos, including automatic boot environment naming</p></li>\n\n<li><p>Some OI-specific applications have been ported from Python 2.7/GTK 2 to Python 3.5/GTK 3</p></li>\n\n<li><p>Quick Demo Video: https://www.youtube.com/watch?v=tQ0-fo3XNrg</p></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"overviewofzfspoolsinfreenashttpswwwixsystemscomblogzfspoolsinfreenas\"><a href=\"https://www.ixsystems.com/blog/zfs-pools-in-freenas/\">Overview of ZFS Pools in FreeNAS</a></h3>\n\n<blockquote>\n  <p>FreeNAS uses the OpenZFS (ZFS) file system, which handles both disk and volume management. ZFS offers RAID options mirror, stripe, and its own parity distribution called RAIDZ that functions like RAID5 on hardware RAID. The file system is extremely flexible and secure, with various drive combinations, checksums, snapshots, and replication all possible. For a deeper dive on ZFS technology, read the ZFS Primer section of the FreeNAS documentation.</p>\n  \n  <p>SUGGEST LAYOUT attempts to balance usable capacity and redundancy by automatically choosing an ideal vdev layout for the number of available disks.</p>\n</blockquote>\n\n<ul>\n<li>The following vdev layout options are available when creating a pool:\n\n\n<ul>\n<li>Stripe data is shared on two drives, similar to RAID0)</li>\n\n<li>Mirror copies data on two drives, similar to RAID1 but not limited to 2 disks)</li>\n\n<li>RAIDZ1 single parity similar to RAID5</li>\n\n<li>RAIDZ2 double parity similar to RAID6</li>\n\n<li>RAIDZ3 which uses triple parity and has no RAID equivalent</li></ul>\n</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"whyopensourcefirmwareisimportantforsecurityhttpsblogjessfrazcompostwhyopensourcefirmwareisimportantforsecurity\"><a href=\"https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/\">Why OpenSource Firmware is Important for Security</a></h3>\n\n<ul>\n<li>Roots of Trust</li>\n</ul>\n\n<blockquote>\n  <p>The goal of the root of trust should be to verify that the software installed in every component of the hardware is the software that was intended. This way you can know without a doubt and verify if hardware has been hacked. Since we have very little to no visibility into the code running in a lot of places in our hardware it is hard to do this. How do we really know that the firmware in a component is not vulnerable or that is doesn’t have any backdoors? Well we can’t. Not unless it was all open source.\n  Every cloud and vendor seems to have their own way of doing a root of trust. Microsoft has Cerberus, Google has Titan, and Amazon has Nitro. These seem to assume an explicit amount of trust in the proprietary code (the code we cannot see). This leaves me with not a great feeling. Wouldn’t it be better to be able to use all open source code? Then we could verify without a doubt that the code you can read and build yourself is the same code running on hardware for all the various places we have firmware. We could then verify that a machine was in a correct state without a doubt of it being vulnerable or with a backdoor.\n  It makes me wonder what the smaller cloud providers like DigitalOcean or Packet have for a root of trust. Often times we only hear of these projects from the big three or five. </p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"opnsensehttpsopnsenseorgopnsense1918released\"><a href=\"https://opnsense.org/opnsense-19-1-8-released/\">OPNsense</a></h3>\n\n<blockquote>\n  <p>This update addresses several privilege escalation issues in the access control implementation and new memory disclosure issues in Intel CPUs. We would like to thank Arnaud Cordier and Bill Marquette for the top-notch reports and coordination.</p>\n</blockquote>\n\n<ul>\n<li><p>Here are the full patch notes:</p></li>\n\n<li><p>system: address CVE-2019-11816 privilege escalation bugs[1] (reported by Arnaud Cordier)</p></li>\n\n<li><p>system: /etc/hosts generation without interface<em>has</em>gateway()</p></li>\n\n<li><p>system: show correct timestamp in config restore save message (contributed by nhirokinet)</p></li>\n\n<li><p>system: list the commands for the pluginctl utility when n+ argument is given</p></li>\n\n<li><p>system: introduce and use userIsAdmin() helper function instead of checking for 'page-all' privilege directly</p></li>\n\n<li><p>system: use absolute path in widget ACLs (reported by Netgate)</p></li>\n\n<li><p>system: RRD-related cleanups for less code exposure</p></li>\n\n<li><p>interfaces: add EN DUID Generation using OPNsense PEN (contributed by Team Rebellion)</p></li>\n\n<li><p>interfaces: replace legacy<em>getall</em>interface_addresses() usage</p></li>\n\n<li><p>firewall: fix port validation in aliases with leading / trailing spaces</p></li>\n\n<li><p>firewall: fix outbound NAT translation display in overview page</p></li>\n\n<li><p>firewall: prevent CARP outgoing packets from using the configured gateway</p></li>\n\n<li><p>firewall: use CARP net.inet.carp.demotion to control current demotion in status page</p></li>\n\n<li><p>firewall: stop live log poller on error result</p></li>\n\n<li><p>dhcpd: change rule priority to 1 to avoid bogon clash</p></li>\n\n<li><p>dnsmasq: only admins may edit custom options field</p></li>\n\n<li><p>firmware: use insecure mode for base and kernel sets when package fingerprints are disabled</p></li>\n\n<li><p>firmware: add optional device support for base and kernel sets</p></li>\n\n<li><p>firmware: add Hostcentral mirror (HTTP, Melbourne, Australia)</p></li>\n\n<li><p>ipsec: always reset rightallowany to default when writing configuration</p></li>\n\n<li><p>lang: say \"hola\" to Spanish as the newest available GUI language</p></li>\n\n<li><p>lang: updates for Chinese, Czech, Japanese, German, French, Russian and Portuguese</p></li>\n\n<li><p>network time: only admins may edit custom options field</p></li>\n\n<li><p>openvpn: call openvpn<em>refresh</em>crls() indirectly via plugin_configure() for less code exposure</p></li>\n\n<li><p>openvpn: only admins may edit custom options field to prevent privilege escalation (reported by Bill Marquette)</p></li>\n\n<li><p>openvpn: remove custom options field from wizard</p></li>\n\n<li><p>unbound: only admins may edit custom options field</p></li>\n\n<li><p>wizard: translate typehint as well</p></li>\n\n<li><p>plugins: os-freeradius 1.9.3 fixes string interpolation in LDAP filters (contributed by theq86)</p></li>\n\n<li><p>plugins: os-nginx 1.12[2]</p></li>\n\n<li><p>plugins: os-theme-cicada 1.17 (contributed by Team Rebellion)</p></li>\n\n<li><p>plugins: os-theme-tukan 1.17 (contributed by Team Rebellion)</p></li>\n\n<li><p>src: timezone database information update[3]</p></li>\n\n<li><p>src: install(1) broken with partially matching relative paths[4]</p></li>\n\n<li><p>src: microarchitectural Data Sampling (MDS) mitigation[5]</p></li>\n\n<li><p>ports: ca<em>root</em>nss 3.44</p></li>\n\n<li><p>ports: php 7.2.18[6]</p></li>\n\n<li><p>ports: sqlite 3.28.0[7]</p></li>\n\n<li><p>ports: strongswan custom XAuth generic patch removed</p></li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"wiregaurdonopenbsdhttpsblogjasperlawireguardonopenbsdhtml\"><a href=\"https://blog.jasper.la/wireguard-on-openbsd.html\">wiregaurd on OpenBSD</a></h3>\n\n<blockquote>\n  <p>Earlier this week I imported a port for WireGuard into the OpenBSD ports tree. At the moment we have the userland daemon and the tools available. The in-kernel implementation is only available for Linux. At the time of writing there are packages available for -current.\n  Jason A. Donenfeld (WireGuard author) has worked to support OpenBSD in WireGuard and as such his post on ports@ last year got me interested in WireGuard, since then others have toyed with WireGuard on OpenBSD before and as such I've used Ted's article as a reference. Note however that some of the options mentioned there are no longer valid. Also, I'll be using two OpenBSD peers here.\n  The setup will be as follows: two OpenBSD peers, of which we'll dub wg1 the server and wg2 the client. The WireGuard service on wg1 is listening on 100.64.4.3:51820.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n  <p>WireGuard (cl)aims to be easier to setup and faster than OpenVPN and while I haven't been able to verify the latter, the first is certainly true...once you've figured it out. Most documentation out there is for Linux so I had to figure out the wireguard<em>go service and the tun parameters. But all in all, sure, it's easier. Especially the client configuration on iOS which I didn't cover here because it's essentially pkg</em>add libqrencode ; cat client.conf | qrencode -t ansiutf8, scan the code with the WireGuard app and you're good to go. What is particularly neat is that WireGuard on iOS supports Always-on.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://github.com/SerenityOS/serenity\">Serenity OS</a></li>\n\n<li><a href=\"https://www.dragonflydigest.com/2019/05/27/22985.html\">vkernels vs pmap</a></li>\n\n<li><a href=\"https://www.youtube.com/watch?v=EY6q5dv_B-o\">Brian Kernighan interviews Ken Thompson</a></li>\n\n<li><a href=\"http://blog.netbsd.org/tnf/entry/improvements_in_forking_threading_and\">Improvements in forking, threading, and signal code</a></li>\n\n<li><a href=\"https://www.dragonflydigest.com/2019/05/21/22946.html\">DragonFly 5.4.3</a></li>\n\n<li><a href=\"https://magazine.odroid.com/article/netbsd-for-the-the-odroid-c2/\">NetBSD on the Odroid C2</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Paulo - <a href=\"http://dpaste.com/3VXMGX8\">Laptops</a></li>\n\n<li>A Listener - <a href=\"http://dpaste.com/0SWJNRX#wrap\">Thanks</a></li>\n\n<li>Bostjan - <a href=\"http://dpaste.com/35NRF40#wrap\">Extend a pool and lower RAM footprint</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0300.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD 11.3-beta 1 is out, BSDCan 2019 recap, OpenIndiana 2019.04 is out, Overview of ZFS Pools in FreeNAS, why open source firmware is important for security, a new Opnsense release, wireguard on OpenBSD, and more. ","date_published":"2019-05-30T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f4d00ce6-8060-4be0-9049-570b73a6adbd.mp3","mime_type":"audio/mp3","size_in_bytes":44983170,"duration_in_seconds":4446}]},{"id":"22eb77a0-e162-4fce-bb37-987c1d34c477","title":"299: The NAS Fleet","url":"https://www.bsdnow.tv/299","content_text":"Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.\n\nHeadlines\n\nRunning AiX on QEMU on Linux on Windows\n\n\n  YES it’s real!\n  I’m using the Linux subsystem on Windows, as it’s easier to build this Qemu tree from source. I’m using Debian, but these steps will work on other systems that use Debian as a base.\n  first thing first, you need to get your system with the needed pre-requisites to compile\n  Great with those in place, now clone Artyom Tarasenko’s source repository\n  Since the frame buffer apparently isn’t quite working just yet, I configure for something more like a text mode build.\n  Now for me, GCC 7 didn’t build the source cleanly. I had to make a change to the file config-host.mak and remove all references to -Werror. Also I removed the sound hooks, as we won’t need them.\n  Now you can build Qemu.\n  Okay, all being well you now have a Qemu. Now following the steps from Artyom Tarasenko’s blog post, we can get started on the install!\n\n\n\nSee article for rest of walkthrough.\n\n\n\n\nTake Command of Your NAS Fleet with TrueCommand\n\n\n  Hundreds of thousands of FreeNAS and TrueNAS systems are deployed around the world, with many sites having dozens of systems.  Managing multiple systems individually can be time-consuming. iXsystems has responded to the challenge by creating a “single pane of glass” application to simplify the scaling of data, drive management, and administration of iXsystems NAS platforms. We are proud to introduce TrueCommand.\n  TrueCommand is a ZFS-aware management application that manages TrueNAS and FreeNAS systems. \n  The public Beta of TrueCommand is available for download now. TrueCommand can be used with small iXsystems NAS fleets for free. Licenses can be purchased for large-scale deployments and enterprise support.\n  TrueCommand expands on the ease of use and power of TrueNAS and FreeNAS systems with multi-system management and reporting.\n\n\n\n\nNews Roundup\n\nUnleashed 1.3 Released\n\n\n  This is the fourth release of Unleashed - an operating system fork of illumos.  For more information about Unleashed itself and the download links, see our website.\n  As one might expect, this release removes a few things.\n  The most notable being the removal of ksh93 along with all its libs.\n  As far as libc interfaces are concerned, a number of non-standard functions were removed.  In general, they have been replaced by the standards-compliant versions.  (getgrentr, fgetgrentr, getgrgidr, getgrnamr, ttynamer, getloginr, shmdt, sigwait, gethostname, putmsg, putpmsg, and getaddrinfo)\n  Additionally, wordexp and wordfree have been removed from libc.  Even though they are technically required by POSIX, software doesn't seem to use them. Because of the fragile implementation (shelling out), we took the OpenBSD approach and just removed them.\n  The default compilation environment now includes XOPENSOURCE=700 and EXTENSIONS.  Additionally, all applications now use 64-bit file offsets, making use of LARGEFILESOURCE, LARGEFILE64SOURCE, and FILEOFFSET_BITS unnecessary.\n  Last but not least, nightly.sh is no more.  In short, to build one simply runs 'make'.  (See README for detailed build instructions.)\n\n\n\nWhy Unleashed\n\n\n\n  Why did we decide to fork illumos? After all, there are already many illumos distributions available to choose from. We felt we could do better than any of them by taking a more aggressive stance toward compatibility and reducing cruft from code and community interactions alike.\n\n\n\n\nLLDB: extending CPU register inspection support\n\n\n  Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n  In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and updating NetBSD distribution to LLVM 8 (which is still stalled by unresolved regressions in inline assembly syntax). You can read more about that in my Mar 2019 report.\n  In April, my main focus was on fixing and enhancing the support for reading and writing CPU registers. In this report, I'd like to shortly summarize what I have done, what I have learned in the process and what I still need to do.\n\n\n\nFuture plans\n\n\n\n  My work continues with the two milestones from last month, plus a third that's closely related:\n  Add support for FPU registers support for NetBSD/i386 and NetBSD/amd64.\n  Support XSAVE, XSAVEOPT, ... registers in core(5) files on NetBSD/amd64.\n  Add support for Debug Registers support for NetBSD/i386 and NetBSD/amd64.\n  The most important point right now is deciding on the format for passing the remaining registers, and implementing the missing ptrace interface kernel-side. The support for core files should follow using the same format then.\n  Userland-side, I will work on adding matching ATF tests for ptrace features and implement LLDB side of support for the new ptrace interface and core file notes. Afterwards, I will start working on improving support for the same things on 32-bit (i386) executables.\n\n\n\n\nV7 Unix programs are often not written the way you would expect\n\n\n  Yesterday I wrote that V7 ed read its terminal input in cooked mode a line at a time, which was an efficient, low-CPU design that was important on V7's small and low-power hardware. Then in comments, frankg pointed out that I was wrong about part of that, namely about how ed read its input.\n\n\n\nSidebar: An interesting undocumented ed feature\n\n\n\n  Reading this section of the source code for ed taught me that it has an interesting, undocumented, and entirely characteristic little behavior. Officially, ed commands that have you enter new text have that new text terminate by a . on a line by itself:\n  \n  In other words, it turns a single line with '.' into an EOF. The consequence of this is that if you type a real EOF at the start of a line, you get the same result, thus saving you one character (you use Control-D instead of '.' plus newline). This is very V7 Unix behavior, including the lack of documentation.\n  \n  This is also a natural behavior in one sense. A proper program has to react to EOF here in some way, and it might as well do so by ending the input mode. It's also natural to go on to try reading from the terminal again for subsequent commands; if this was a real and persistent EOF, for example because the pty closed, you'll just get EOF again and eventually quit. V7 ed is slightly unusual here in that it deliberately converts '.' by itself to EOF, instead of signaling this in a different way, but in a way that's also the simplest approach; if you have to have some signal for each case and you're going to treat them the same, you might as well have the same signal for both cases.\n  \n  Modern versions of ed appear to faithfully reimplement this convenient behavior, although they don't appear to document it. I haven't checked OpenBSD, but both FreeBSD ed and GNU ed work like this in a quick test. I haven't checked their source code to see if they implement it the same way.\n  \n  \n\n\nBeastie Bits\n\n\nCarolinaCon 15: Writing Exploit-Resistant Code With OpenBSD\n\nCFT: FreeBSD Package Base\n\nInitial FUSE support in DragonFly\n\nTwo significant bugfixes for 5.4\n\nLibretto 100ct: 166mhz Pentium, 16gb compactflash, 32mb ram running OpenBSD\n\n\n\n\nFeedback/Questions\n\n\nDJ - Feedback\n\nFabian - ZFS ARC\n\nCaleb - Question\n\nA small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"runningaixonqemuonlinuxonwindowshttpsvirtuallyfuncomwordpress20190422installingaixonqemu\"><a href=\"https://virtuallyfun.com/wordpress/2019/04/22/installing-aix-on-qemu/\">Running AiX on QEMU on Linux on Windows</a></h3>\n\n<blockquote>\n  <p>YES it’s real!\n  I’m using the Linux subsystem on Windows, as it’s easier to build this Qemu tree from source. I’m using Debian, but these steps will work on other systems that use Debian as a base.\n  first thing first, you need to get your system with the needed pre-requisites to compile\n  Great with those in place, now clone Artyom Tarasenko’s source repository\n  Since the frame buffer apparently isn’t quite working just yet, I configure for something more like a text mode build.\n  Now for me, GCC 7 didn’t build the source cleanly. I had to make a change to the file config-host.mak and remove all references to -Werror. Also I removed the sound hooks, as we won’t need them.\n  Now you can build Qemu.\n  Okay, all being well you now have a Qemu. Now following the steps from Artyom Tarasenko’s blog post, we can get started on the install!</p>\n</blockquote>\n\n<ul>\n<li>See article for rest of walkthrough.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"takecommandofyournasfleetwithtruecommandhttpswwwixsystemscomblogtruecommand\"><a href=\"https://www.ixsystems.com/blog/truecommand/\">Take Command of Your NAS Fleet with TrueCommand</a></h3>\n\n<blockquote>\n  <p>Hundreds of thousands of FreeNAS and TrueNAS systems are deployed around the world, with many sites having dozens of systems.  Managing multiple systems individually can be time-consuming. iXsystems has responded to the challenge by creating a “single pane of glass” application to simplify the scaling of data, drive management, and administration of iXsystems NAS platforms. We are proud to introduce TrueCommand.\n  TrueCommand is a ZFS-aware management application that manages TrueNAS and FreeNAS systems. \n  The public Beta of TrueCommand is available for download now. TrueCommand can be used with small iXsystems NAS fleets for free. Licenses can be purchased for large-scale deployments and enterprise support.\n  TrueCommand expands on the ease of use and power of TrueNAS and FreeNAS systems with multi-system management and reporting.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"unleashed13releasedhttplists31bitsnetarchivesdevel2019april000052html\"><a href=\"http://lists.31bits.net/archives/devel/2019-April/000052.html\">Unleashed 1.3 Released</a></h3>\n\n<blockquote>\n  <p>This is the fourth release of Unleashed - an operating system fork of illumos.  For more information about Unleashed itself and the download links, see our website.\n  As one might expect, this release removes a few things.\n  The most notable being the removal of ksh93 along with all its libs.\n  As far as libc interfaces are concerned, a number of non-standard functions were removed.  In general, they have been replaced by the standards-compliant versions.  (getgrent<em>r, fgetgrent</em>r, getgrgid<em>r, getgrnam</em>r, ttyname<em>r, getlogin</em>r, shmdt, sigwait, gethostname, putmsg, putpmsg, and getaddrinfo)\n  Additionally, wordexp and wordfree have been removed from libc.  Even though they are technically required by POSIX, software doesn't seem to use them. Because of the fragile implementation (shelling out), we took the OpenBSD approach and just removed them.\n  The default compilation environment now includes <em>XOPEN</em>SOURCE=700 and <strong>EXTENSIONS</strong>.  Additionally, all applications now use 64-bit file offsets, making use of <em>LARGEFILE</em>SOURCE, <em>LARGEFILE64</em>SOURCE, and <em>FILE</em>OFFSET_BITS unnecessary.\n  Last but not least, nightly.sh is no more.  In short, to build one simply runs 'make'.  (See README for detailed build instructions.)</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://www.unleashed-os.org/why.html\">Why Unleashed</a></li>\n</ul>\n\n<blockquote>\n  <p>Why did we decide to fork illumos? After all, there are already many illumos distributions available to choose from. We felt we could do better than any of them by taking a more aggressive stance toward compatibility and reducing cruft from code and community interactions alike.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"lldbextendingcpuregisterinspectionsupporthttpblognetbsdorgtnfentrylldb_extending_cpu_register_inspection\"><a href=\"http://blog.netbsd.org/tnf/entry/lldb_extending_cpu_register_inspection\">LLDB: extending CPU register inspection support</a></h3>\n\n<blockquote>\n  <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.\n  In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support and updating NetBSD distribution to LLVM 8 (which is still stalled by unresolved regressions in inline assembly syntax). You can read more about that in my Mar 2019 report.\n  In April, my main focus was on fixing and enhancing the support for reading and writing CPU registers. In this report, I'd like to shortly summarize what I have done, what I have learned in the process and what I still need to do.</p>\n</blockquote>\n\n<ul>\n<li>Future plans</li>\n</ul>\n\n<blockquote>\n  <p>My work continues with the two milestones from last month, plus a third that's closely related:\n  Add support for FPU registers support for NetBSD/i386 and NetBSD/amd64.\n  Support XSAVE, XSAVEOPT, ... registers in core(5) files on NetBSD/amd64.\n  Add support for Debug Registers support for NetBSD/i386 and NetBSD/amd64.\n  The most important point right now is deciding on the format for passing the remaining registers, and implementing the missing ptrace interface kernel-side. The support for core files should follow using the same format then.\n  Userland-side, I will work on adding matching ATF tests for ptrace features and implement LLDB side of support for the new ptrace interface and core file notes. Afterwards, I will start working on improving support for the same things on 32-bit (i386) executables.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"v7unixprogramsareoftennotwrittenthewayyouwouldexpecthttpsutccutorontocatcksspaceblogunixedv7codedunusually\"><a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/EdV7CodedUnusually\">V7 Unix programs are often not written the way you would expect</a></h3>\n\n<blockquote>\n  <p>Yesterday I wrote that V7 ed read its terminal input in cooked mode a line at a time, which was an efficient, low-CPU design that was important on V7's small and low-power hardware. Then in comments, frankg pointed out that I was wrong about part of that, namely about how ed read its input.</p>\n</blockquote>\n\n<ul>\n<li>Sidebar: An interesting undocumented ed feature</li>\n</ul>\n\n<blockquote>\n  <p>Reading this section of the source code for ed taught me that it has an interesting, undocumented, and entirely characteristic little behavior. Officially, ed commands that have you enter new text have that new text terminate by a . on a line by itself:</p>\n  \n  <p>In other words, it turns a single line with '.' into an EOF. The consequence of this is that if you type a real EOF at the start of a line, you get the same result, thus saving you one character (you use Control-D instead of '.' plus newline). This is very V7 Unix behavior, including the lack of documentation.</p>\n  \n  <p>This is also a natural behavior in one sense. A proper program has to react to EOF here in some way, and it might as well do so by ending the input mode. It's also natural to go on to try reading from the terminal again for subsequent commands; if this was a real and persistent EOF, for example because the pty closed, you'll just get EOF again and eventually quit. V7 ed is slightly unusual here in that it deliberately converts '.' by itself to EOF, instead of signaling this in a different way, but in a way that's also the simplest approach; if you have to have some signal for each case and you're going to treat them the same, you might as well have the same signal for both cases.</p>\n  \n  <p>Modern versions of ed appear to faithfully reimplement this convenient behavior, although they don't appear to document it. I haven't checked OpenBSD, but both FreeBSD ed and GNU ed work like this in a quick test. I haven't checked their source code to see if they implement it the same way.</p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://lteo.net/blog/2019/04/27/carolinacon-15-writing-exploit-resistant-code-with-openbsd/\">CarolinaCon 15: Writing Exploit-Resistant Code With OpenBSD</a></li>\n\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-pkgbase/2019-April/000396.html\">CFT: FreeBSD Package Base</a></li>\n\n<li><a href=\"https://www.dragonflydigest.com/2019/05/02/22862.html\">Initial FUSE support in DragonFly</a></li>\n\n<li><a href=\"https://www.dragonflydigest.com/2019/05/03/22869.html\">Two significant bugfixes for 5.4</a></li>\n\n<li><a href=\"https://www.reddit.com/r/openbsd/comments/bkb2zk/surprised_this_can_still_run_current/\">Libretto 100ct: 166mhz Pentium, 16gb compactflash, 32mb ram running OpenBSD</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>DJ - <a href=\"http://dpaste.com/0DSYJAH#wrap\">Feedback</a></li>\n\n<li>Fabian - <a href=\"http://dpaste.com/2EC7S10#wrap\">ZFS ARC</a></li>\n\n<li>Caleb - <a href=\"http://dpaste.com/3ZX177B#wrap\">Question</a></li>\n\n<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0299.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Running AIX on QEMU on Linux on Windows, your NAS fleet with TrueCommand, Unleashed 1.3 is available, LLDB: CPU register inspection support extension, V7 Unix programs often not written as expected, and more.","date_published":"2019-05-22T14:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/22eb77a0-e162-4fce-bb37-987c1d34c477.mp3","mime_type":"audio/mp3","size_in_bytes":32188343,"duration_in_seconds":3167}]},{"id":"85a43874-a080-4a57-9fb0-2a0210e9718e","title":"298: BSD On The Road","url":"https://www.bsdnow.tv/298","content_text":"36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.\n\nHeadlines\n\n36+ year old bug in FFS/UFS discovered and patched \n\n\n  This update eliminates a kernel stack disclosure bug in UFS/FFS directory entries that is caused by uninitialized directory entry padding written to the disk.\n  \n  \n  When the directory entry is written to disk, it is written as a full 32bit entry, and the unused bytes were not initialized, so could possibly contain sensitive data from the kernel stack\n  It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundary. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created.\n  This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed.\n  It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now.\n  This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running.\n  Submitted by: David G. Lawrence dg@dglawrence.com\n  \n  So a patched kernel will no longer leak this data, and running the fsck_ffs -z command will erase any leaked data that may exist on your system\n  \n  OpenBSD commit with additional detail on mitigations\n  The impact on OpenBSD is very limited:\n  1 - such stack bytes can be found in raw-device reads, from group operator. If you can read the raw disks you can undertake other more powerful actions.\n  2 - read(2) upon directory fd was disabled July 1997 because I didn't like how grep * would display garbage and mess up the tty, and applying vis(3) for just directory reads seemed silly.  read(2) was changed to return 0 (EOF).  Sep 2016 this was further changed to EISDIR, so you still cannot see the bad bytes.\n  3 - In 2013 when guenther adapted the getdents(2) directory-reading system call to 64-bit ino_t, the userland data format changed to 8-byte-alignment, making it incompatible with the 4-byte-alignment UFS on-disk format.  As a result of code refactoring the bad bytes were not copied to userland. Bad bytes will remain in old directories on old filesystems, but nothing makes those bytes user visible.\n  There will be no errata or syspatch issued.  I urge other systems which do expose the information to userland to issue errata quickly, since this is a 254 byte infoleak of the stack which is great for ROP-chain building to attack some other bug. Especially if the kernel has no layout/link-order randomization ...\n  \n  \n  \n\n\nNomadBSD, a BSD for the Road\n\n\n  As regular It’s FOSS readers should know, I like diving into the world of BSDs. Recently, I came across an interesting BSD that is designed to live on a thumb drive. Let’s take a look at NomadBSD.\n  NomadBSD is different than most available BSDs. NomadBSD is a live system based on FreeBSD. It comes with automatic hardware detection and an initial config tool. NomadBSD is designed to “be used as a desktop system that works out of the box, but can also be used for data recovery, for educational purposes, or to test FreeBSD’s hardware compatibility.”\n  This German BSD comes with an OpenBox-based desktop with the Plank application dock. NomadBSD makes use of the DSB project. DSB stands for “Desktop Suite (for) (Free)BSD” and consists of a collection of programs designed to create a simple and working environment without needing a ton of dependencies to use one tool. DSB is created by Marcel Kaiser one of the lead devs of NomadBSD.\n  Just like the original BSD projects, you can contact the NomadBSD developers via a mailing list.\n\n\n\nVersion 1.2 Released\n\n\n\n  NomadBSD recently released version 1.2 on April 21, 2019. This means that NomadBSD is now based on FreeBSD 12.0-p3. TRIM is now enabled by default. One of the biggest changes is that the initial command-line setup was replaced with a Qt graphical interface. They also added a Qt5 tool to install NomadBSD to your hard drive. A number of fixes were included to improve graphics support. They also added support for creating 32-bit images.\n\n\n\nThoughts on NomadBSD\n\n\n\n  I first discovered NomadBSD back in January when they released 1.2-RC1. At the time, I had been unable to install Project Trident on my laptop and was very frustrated with BSDs. I downloaded NomadBSD and tried it out. I initially ran into issues reaching the desktop, but RC2 fixed that issue. However, I was unable to get on the internet, even though I had an Ethernet cable plugged in. Luckily, I found the wifi manager in the menu and was able to connect to my wifi.\n  Overall, my experience with NomadBSD was pleasant. Once I figured out a few things, I was good to go. I hope that NomadBSD is the first of a new generation of BSDs that focus on mobility and ease of use. BSD has conquered the server world, it’s about time they figured out how to be more user-friendly.\n  \n  \n\n\nNews Roundup\n\n[OpenBSD automatic\n\nupgrade](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/)\n\n\n  OpenBSD 6.5 advertises for an installer improvement: rdsetroot(8) (a build-time tool) is now available for general use. Used in combination with autoinstall.8, it is now really easy to do automatic upgrades of your OpenBSD instances.\n  I first manually upgraded my OpenBSD sandbox to 6.5. Once that was done, I could use the stock rdsetroot(8) tool. The plan is quite simple: write an unattended installation response file, insert it to a bsd.rd 6.5 installation image and reboot my other OpenBSD instances using that image.\n\n\n\nExtra notes\n\n\n\n  There must be a way to run onetime commands (in the manner of fw_update) to automatically run sysmerge and packages upgrades. As for now, I’d rather do it manually.\n  This worked like a charm on two Synology KVM instances using a single sd0 disk, on my Thinkpad X260 using Encrypted root with Keydisk and on a Vultr instance using Encrypted root with passphrase. And BTW, the upgrade on the X260 used the (iwn0) wireless connection.\n  I just read that florian@ has released the sysupgrade(8) utility which should be released with OpenBSD 6.6. That will make upgrades even easier! Until then, happy upgrading.\n\n\n\n\nFreeBSD Dtrace ext2fs Support\n\n\nWhich logs were replaced by dtrace-probes:\n\n\nMisc printf's under DEBUG macro in the blocks allocation path.\n\nDifferent on-disk structures validation errors, now the filesystem will silently return EIO's.\n\nMisc checksum errors, same as above.\n\nThe only debug macro, which was leaved is EXT2FSPRINTEXTENTS.\n\nIt is impossible to replace it by dtrace-probes, because the additional logic is required to walk thru file extents.\n\nThe user still be able to see mount errors in the dmesg in case of:\n\n\nFilesystem features incompatibility.\n\nSuperblock checksum error.\n\n\n\n\n\n\nCreate a dedicated user for ssh tunneling only\n\n\n  I use ssh tunneling A LOT, for everything. Yesterday, I removed the public access of my IMAP server, it’s now only available through ssh tunneling to access the daemon listening on localhost. I have plenty of daemons listening only on localhost that I can only reach through a ssh tunnel. If you don’t want to bother with ssh and redirect ports you need, you can also make a VPN (using ssh, openvpn, iked, tinc…) between your system and your server. I tend to avoid setting up VPN for the current use case as it requires more work and more maintenance than running ssh server and a ssh client.\n  The last change, for my IMAP server, added an issue. I want my phone to access the IMAP server but I don’t want to connect to my main account from my phone for security reasons. So, I need a dedicated user that will only be allowed to forward ports.\n  This is done very easily on OpenBSD.\n  The steps are: 1. generate ssh keys for the new user 2. add an user with no password 3. allow public key for port forwarding\n  Obviously, you must allow users (or only this one) to make port forwarding in your sshd_config.\n  \n  \n\n\nThat was easy. Some info on upgrading VMM VMs to 6.5\n\n\n  We're running dedicated vmm(4)/vmd(8) servers to host opinionated VMs.\n  OpenBSD 6.5 is released! There are two ways you can upgrade your VM.\n  Either do a manual upgrade or leverage autoinstall(8). You can take care of it via the console with vmctl(8).\n\n\n\nUpgrade yourself\n\n\n\n  To get connected to the console you need to have access to the host your VM is running on. The same username and public SSH key, as provided for the VM, are used to create a local user on the host.\n  When this is done you can use vmctl(8) to manage your VM. The options you have are:\n\n\n```$ vmctl start id [-c]```\n\n\n$ vmctl stop id [-fw]```\n\n```-w Wait until the VM has been terminated.```\n\n\n-c Automatically connect to the VM console.```\n\n\nSee the Article for the rest of the guide\n\n\n\n\nBeastie Bits\n\n\npowerpc64 architecture support in FreeBSD ports\n\nGhostBSD 19.04 overview\n\nHardenedBSD will have two user selectable ASLR implementations\n\nNYCBUG 2016 Talk Shell-Fu Uploaded\n\nWhat is ZIL anyway?\n\n\n\n\nFeedback/Questions\n\n\nQuentin - Organize an Ada/BSD interview\n\nDJ - Update\n\nPatrick - Bhyve frontends\n\nA small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"36yearoldbuginffsufsdiscoveredandpatchedhttpssvnwebfreebsdorgbaseviewrevisionrevision347066\"><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=347066\">36+ year old bug in FFS/UFS discovered and patched </a></h3>\n\n<blockquote>\n  <p>This update eliminates a kernel stack disclosure bug in UFS/FFS directory entries that is caused by uninitialized directory entry padding written to the disk.</p>\n  \n  <ul>\n  <li>When the directory entry is written to disk, it is written as a full 32bit entry, and the unused bytes were not initialized, so could possibly contain sensitive data from the kernel stack\n  It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundary. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created.\n  This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed.\n  It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now.\n  This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running.\n  Submitted by: David G. Lawrence <a href=\"&#109;a&#105;&#108;&#116;&#111;:&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;\">&#x64;&#x67;&#64;&#100;&#103;&#x6c;&#97;&#x77;&#x72;&#101;n&#x63;&#101;&#x2e;&#x63;&#x6f;&#109;</a></li>\n  \n  <li>So a patched kernel will no longer leak this data, and running the <code>fsck_ffs -z</code> command will erase any leaked data that may exist on your system</li>\n  \n  <li><a href=\"https://marc.info/?l=openbsd-cvs&amp;m=155699268122858&amp;w=2\">OpenBSD commit with additional detail on mitigations</a>\n  The impact on OpenBSD is very limited:\n  1 - such stack bytes can be found in raw-device reads, from group operator. If you can read the raw disks you can undertake other more powerful actions.\n  2 - read(2) upon directory fd was disabled July 1997 because I didn't like how grep * would display garbage and mess up the tty, and applying vis(3) for just directory reads seemed silly.  read(2) was changed to return 0 (EOF).  Sep 2016 this was further changed to EISDIR, so you still cannot see the bad bytes.\n  3 - In 2013 when guenther adapted the getdents(2) directory-reading system call to 64-bit ino_t, the userland data format changed to 8-byte-alignment, making it incompatible with the 4-byte-alignment UFS on-disk format.  As a result of code refactoring the bad bytes were not copied to userland. Bad bytes will remain in old directories on old filesystems, but nothing makes those bytes user visible.\n  There will be no errata or syspatch issued.  I urge other systems which do expose the information to userland to issue errata quickly, since this is a 254 byte infoleak of the stack which is great for ROP-chain building to attack some other bug. Especially if the kernel has no layout/link-order randomization ...</li>\n  </ul>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"nomadbsdabsdfortheroadhttpsitsfosscomnomadbsd\"><a href=\"https://itsfoss.com/nomadbsd/\">NomadBSD, a BSD for the Road</a></h3>\n\n<blockquote>\n  <p>As regular It’s FOSS readers should know, I like diving into the world of BSDs. Recently, I came across an interesting BSD that is designed to live on a thumb drive. Let’s take a look at NomadBSD.\n  NomadBSD is different than most available BSDs. NomadBSD is a live system based on FreeBSD. It comes with automatic hardware detection and an initial config tool. NomadBSD is designed to “be used as a desktop system that works out of the box, but can also be used for data recovery, for educational purposes, or to test FreeBSD’s hardware compatibility.”\n  This German BSD comes with an OpenBox-based desktop with the Plank application dock. NomadBSD makes use of the DSB project. DSB stands for “Desktop Suite (for) (Free)BSD” and consists of a collection of programs designed to create a simple and working environment without needing a ton of dependencies to use one tool. DSB is created by Marcel Kaiser one of the lead devs of NomadBSD.\n  Just like the original BSD projects, you can contact the NomadBSD developers via a mailing list.</p>\n</blockquote>\n\n<ul>\n<li>Version 1.2 Released</li>\n</ul>\n\n<blockquote>\n  <p>NomadBSD recently released version 1.2 on April 21, 2019. This means that NomadBSD is now based on FreeBSD 12.0-p3. TRIM is now enabled by default. One of the biggest changes is that the initial command-line setup was replaced with a Qt graphical interface. They also added a Qt5 tool to install NomadBSD to your hard drive. A number of fixes were included to improve graphics support. They also added support for creating 32-bit images.</p>\n</blockquote>\n\n<ul>\n<li>Thoughts on NomadBSD</li>\n</ul>\n\n<blockquote>\n  <p>I first discovered NomadBSD back in January when they released 1.2-RC1. At the time, I had been unable to install Project Trident on my laptop and was very frustrated with BSDs. I downloaded NomadBSD and tried it out. I initially ran into issues reaching the desktop, but RC2 fixed that issue. However, I was unable to get on the internet, even though I had an Ethernet cable plugged in. Luckily, I found the wifi manager in the menu and was able to connect to my wifi.\n  Overall, my experience with NomadBSD was pleasant. Once I figured out a few things, I was good to go. I hope that NomadBSD is the first of a new generation of BSDs that focus on mobility and ease of use. BSD has conquered the server world, it’s about time they figured out how to be more user-friendly.</p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"openbsdautomatic\">[OpenBSD automatic</h3>\n\n<p>upgrade](https://www.tumfatig.net/20190426/openbsd-automatic-upgrade/)</p>\n\n<blockquote>\n  <p>OpenBSD 6.5 advertises for an installer improvement: rdsetroot(8) (a build-time tool) is now available for general use. Used in combination with autoinstall.8, it is now really easy to do automatic upgrades of your OpenBSD instances.\n  I first manually upgraded my OpenBSD sandbox to 6.5. Once that was done, I could use the stock rdsetroot(8) tool. The plan is quite simple: write an unattended installation response file, insert it to a bsd.rd 6.5 installation image and reboot my other OpenBSD instances using that image.</p>\n</blockquote>\n\n<ul>\n<li>Extra notes</li>\n</ul>\n\n<blockquote>\n  <p>There must be a way to run onetime commands (in the manner of fw_update) to automatically run sysmerge and packages upgrades. As for now, I’d rather do it manually.\n  This worked like a charm on two Synology KVM instances using a single sd0 disk, on my Thinkpad X260 using Encrypted root with Keydisk and on a Vultr instance using Encrypted root with passphrase. And BTW, the upgrade on the X260 used the (iwn0) wireless connection.\n  I just read that florian@ has released the sysupgrade(8) utility which should be released with OpenBSD 6.6. That will make upgrades even easier! Until then, happy upgrading.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"freebsddtraceext2fssupporthttpsreviewsfreebsdorgd19848\"><a href=\"https://reviews.freebsd.org/D19848\">FreeBSD Dtrace ext2fs Support</a></h3>\n\n<ul>\n<li><p>Which logs were replaced by dtrace-probes:</p>\n\n<ul>\n<li>Misc printf's under DEBUG macro in the blocks allocation path.</li>\n\n<li>Different on-disk structures validation errors, now the filesystem will silently return EIO's.</li>\n\n<li>Misc checksum errors, same as above.</li></ul></li>\n\n<li><p>The only debug macro, which was leaved is EXT2FS<em>PRINT</em>EXTENTS.</p></li>\n\n<li><p>It is impossible to replace it by dtrace-probes, because the additional logic is required to walk thru file extents.</p></li>\n\n<li><p>The user still be able to see mount errors in the dmesg in case of:</p>\n\n<p><ul>\n<li>Filesystem features incompatibility.</li></p>\n\n<p><li>Superblock checksum error.</li></ul>\n\n<p></p></li>\n</ul></p>\n\n<hr />\n\n<h3 id=\"createadedicateduserforsshtunnelingonlyhttpsdataswamporgtsolene20190417sshtunnelinghtml\"><a href=\"https://dataswamp.org/~solene/2019-04-17-ssh-tunneling.html\">Create a dedicated user for ssh tunneling only</a></h3>\n\n<blockquote>\n  <p>I use ssh tunneling A LOT, for everything. Yesterday, I removed the public access of my IMAP server, it’s now only available through ssh tunneling to access the daemon listening on localhost. I have plenty of daemons listening only on localhost that I can only reach through a ssh tunnel. If you don’t want to bother with ssh and redirect ports you need, you can also make a VPN (using ssh, openvpn, iked, tinc…) between your system and your server. I tend to avoid setting up VPN for the current use case as it requires more work and more maintenance than running ssh server and a ssh client.\n  The last change, for my IMAP server, added an issue. I want my phone to access the IMAP server but I don’t want to connect to my main account from my phone for security reasons. So, I need a dedicated user that will only be allowed to forward ports.\n  This is done very easily on OpenBSD.\n  The steps are: 1. generate ssh keys for the new user 2. add an user with no password 3. allow public key for port forwarding\n  Obviously, you must allow users (or only this one) to make port forwarding in your sshd_config.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"thatwaseasysomeinfoonupgradingvmmvmsto65httpsopenbsdamsterdamupgradehtml\"><a href=\"https://openbsd.amsterdam/upgrade.html\">That was easy. Some info on upgrading VMM VMs to 6.5</a></h3>\n\n<blockquote>\n  <p>We're running dedicated vmm(4)/vmd(8) servers to host opinionated VMs.\n  OpenBSD 6.5 is released! There are two ways you can upgrade your VM.\n  Either do a manual upgrade or leverage autoinstall(8). You can take care of it via the console with vmctl(8).</p>\n</blockquote>\n\n<ul>\n<li>Upgrade yourself</li>\n</ul>\n\n<blockquote>\n  <p>To get connected to the console you need to have access to the host your VM is running on. The same username and public SSH key, as provided for the VM, are used to create a local user on the host.\n  When this is done you can use vmctl(8) to manage your VM. The options you have are:</p>\n</blockquote>\n\n<pre><code class=\"$ vmctl console id``` language-$ vmctl console id```\">```$ vmctl start id [-c]```\n</code></pre>\n\n<p>$ vmctl stop id [-fw]```</p>\n\n<pre><code class=\"-f Forcefully stop the VM without attempting a graceful shutdown.``` language--f Forcefully stop the VM without attempting a graceful shutdown.```\">```-w Wait until the VM has been terminated.```\n</code></pre>\n\n<p>-c Automatically connect to the VM console.```</p>\n\n<ul>\n<li>See the Article for the rest of the guide</li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://inks.tedunangst.com/l/3791\">powerpc64 architecture support in FreeBSD ports</a></li>\n\n<li><a href=\"https://twitter.com/ribalinux/status/1117856218251517956\">GhostBSD 19.04 overview</a></li>\n\n<li><a href=\"https://twitter.com/lattera/status/1119018409575026688\">HardenedBSD will have two user selectable ASLR implementations</a></li>\n\n<li><a href=\"https://www.youtube.com/watch?v=S_aTzXVRRlM&amp;feature=youtu.be\">NYCBUG 2016 Talk Shell-Fu Uploaded</a></li>\n\n<li><a href=\"http://blog.zarfhome.com/2019/04/what-is-zil-anyway.html\">What is ZIL anyway?</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Quentin - <a href=\"http://dpaste.com/0K9PQW9#wrap\">Organize an Ada/BSD interview</a></li>\n\n<li>DJ - <a href=\"http://dpaste.com/3KTQ45G#wrap\">Update</a></li>\n\n<li>Patrick - <a href=\"http://dpaste.com/07V6ZJN\">Bhyve frontends</a></li>\n\n<li>A small programming note: After BSDNow episode 300, the podcast will switch to audio-only, using a new higher quality recording and production system. The live stream will likely still include video.</li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0298.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"36 year old UFS bug fixed, a BSD for the road, automatic upgrades with OpenBSD, DTrace ext2fs support in FreeBSD, Dedicated SSH tunnel user, upgrading VMM VMs to OpenBSD 6.5, and more.","date_published":"2019-05-15T23:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/85a43874-a080-4a57-9fb0-2a0210e9718e.mp3","mime_type":"audio/mp3","size_in_bytes":31937689,"duration_in_seconds":3142}]},{"id":"b83c5930-57a8-4c27-855a-97b6d88f5f00","title":"297: Dragonfly In The Wild","url":"https://www.bsdnow.tv/297","content_text":"FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.\n\nHeadlines\n\nFreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference\n\n\n  With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.\n  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.\n  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.\n  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.\n\n\n\n\nDragonFlyBSD 5.4.2 is out\n\nUpgrading guide\n\n\n  Here's the tag commit, for what has changed from 5.4.1 to 5.4.2\n  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.\n  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.\n\n\n&gt; cd /usr/src\n&gt; git pull\n&gt; make buildworld.\n&gt; make buildkernel.\n&gt; make installkernel.\n&gt; make installworld\n&gt; make upgrade\n\n\n\n  After your next reboot, you can optionally update your rescue system:\n\n\n&gt; cd /usr/src\n&gt; make initrd\n\n\n\n  As always, make sure your packages are up to date:\n\n\n&gt; pkg update\n&gt; pkg upgrade\n\n\n\n\nNews Roundup\n\nContaining web services with iocell\n\n\n  I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 \n  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U\n\n\n\nGetting started\n\n\n\n  There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.\n\n\n\nTo start, you'll need the following:\n\n\n\nA FreeBSD install (we'll be using 11.0)\n\nThe iocell package (available as a package, also in the ports tree)\n\nA ZFS pool for hosting the jails\n\n\n\n\n  Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.\n  \n  As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.\n\n\n\nSee Article for the rest of the walkthrough.\n\n\n\n\nOracle Solaris 11.4 SRU8\n\n\n  Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.\n  \n  \n  This SRU introduces the following enhancements:\n  \n  \n  \n  Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.\n  \n  UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4\n  \n  Re-introduction of the service fc-fabric.\n  \n  ibus has been updated to 1.5.19\n  \n  \n\n\n\nThe following components have also been updated to address security issues:\n\n\n\nNTP has been updated to 4.2.8p12\n\nFirefox has been updated to 60.6.0esr\n\nBIND has been updated to 9.11.6\n\nOpenSSL has been updated to 1.0.2r\n\nMySQL has been updated to 5.6.43 &amp; 5.7.25\n\nlibxml2 has been updated to 2.9.9\n\nlibxslt has been updated to 1.1.33\n\nWireshark has been updated to 2.6.7\n\nncurses has been updated to 6.1.0.20190105\n\nApache Web Server has been updated to 2.4.38\n\nperl 5.22\n\npkg.depot\n\n\n\n\n\nThe Problem with SSH Agent Forwarding\n\n\n  After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”\n  Here’s what man ssh_config has to say about ForwardAgent:  \"Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.\"\"\n  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!\n  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.\n\n\n\n\n[OpenBSD Upgrade Guide: 6.4 to 6.5\n\n\n  Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.\n  Alternatively, you can use the manual upgrade process.\n  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.\n\n\n\nBefore rebooting into the install kernel\n\nConfiguration and syntax changes\n\nFiles to remove\n\nSpecial packages\n\nUpgrade without the install kernel\n\n\n\n\nBeastie Bits\n\n\n2019 FreeBSD Community Survey\n\nSeagate runs Mach.2 demo on FreeBSD\n\nFreeBSD: Resizing and Growing Disks\n\nLoading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD\n\nOS108 MATE 20190422 released\n\n\n\n\nFeedback/Questions\n\n\nCasey - Oklahoma City &amp; James\n\nMichael - Question on SAS backplane (camcontrol?)\n\nAles - OpenBSD, FreeNAS, OpenZFS questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"freebsdzfsvszolperformanceubuntuzfsonlinuxreferencehttpswwwphoronixcomscanphppagearticleitemfreebsdzolaprilnum1\"><a href=\"https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-zol-april&amp;num=1\">FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference</a></h3>\n\n<blockquote>\n  <p>With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.\n  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.\n  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.\n  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"dragonflybsd542isouthttpswwwdragonflybsdorgrelease54\"><a href=\"https://www.dragonflybsd.org/release54/\">DragonFlyBSD 5.4.2 is out</a></h3>\n\n<p><a href=\"http://lists.dragonflybsd.org/pipermail/users/2019-April/358160.html\">Upgrading guide</a></p>\n\n<blockquote>\n  <p>Here's the tag commit, for what has changed from <a href=\"http://lists.dragonflybsd.org/pipermail/commits/2019-April/718697.html\">5.4.1 to 5.4.2</a>\n  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.\n  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.</p>\n</blockquote>\n\n<pre><code>&gt; cd /usr/src\n&gt; git pull\n&gt; make buildworld.\n&gt; make buildkernel.\n&gt; make installkernel.\n&gt; make installworld\n&gt; make upgrade\n</code></pre>\n\n<blockquote>\n  <p>After your next reboot, you can optionally update your rescue system:</p>\n</blockquote>\n\n<pre><code>&gt; cd /usr/src\n&gt; make initrd\n</code></pre>\n\n<blockquote>\n  <p>As always, make sure your packages are up to date:</p>\n</blockquote>\n\n<pre><code>&gt; pkg update\n&gt; pkg upgrade\n</code></pre>\n\n<p><hr /></p>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"containingwebserviceswithiocellhttpsgioarcme20170305containingwebserviceswithiocell\"><a href=\"https://gioarc.me/2017/03/05/containing-web-services-with-iocell/\">Containing web services with iocell</a></h3>\n\n<blockquote>\n  <p>I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 \n  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U</p>\n</blockquote>\n\n<ul>\n<li>Getting started</li>\n</ul>\n\n<blockquote>\n  <p>There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.</p>\n</blockquote>\n\n<ul>\n<li>To start, you'll need the following:\n\n\n<ul>\n<li>A FreeBSD install (we'll be using 11.0)</li>\n\n<li>The iocell package (available as a package, also in the ports tree)</li>\n\n<li>A ZFS pool for hosting the jails</li></ul>\n</li>\n</ul>\n\n<blockquote>\n  <p>Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.</p>\n  \n  <p>As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.</p>\n</blockquote>\n\n<ul>\n<li>See Article for the rest of the walkthrough.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"oraclesolaris114sru8httpsblogsoraclecomsolarisannouncingoraclesolaris114sru8\"><a href=\"https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru8\">Oracle Solaris 11.4 SRU8</a></h3>\n\n<blockquote>\n  <p>Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.</p>\n  \n  <ul>\n  <li>This SRU introduces the following enhancements:\n  \n  \n  <ul>\n  <li>Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.</li>\n  \n  <li>UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4</li>\n  \n  <li>Re-introduction of the service fc-fabric.</li>\n  \n  <li>ibus has been updated to 1.5.19</li></ul>\n  </li>\n  </ul>\n</blockquote>\n\n<ul>\n<li>The following components have also been updated to address security issues:\n\n\n<ul>\n<li>NTP has been updated to 4.2.8p12</li>\n\n<li>Firefox has been updated to 60.6.0esr</li>\n\n<li>BIND has been updated to 9.11.6</li>\n\n<li>OpenSSL has been updated to 1.0.2r</li>\n\n<li>MySQL has been updated to 5.6.43 &amp; 5.7.25</li>\n\n<li>libxml2 has been updated to 2.9.9</li>\n\n<li>libxslt has been updated to 1.1.33</li>\n\n<li>Wireshark has been updated to 2.6.7</li>\n\n<li>ncurses has been updated to 6.1.0.20190105</li>\n\n<li>Apache Web Server has been updated to 2.4.38</li>\n\n<li>perl 5.22</li>\n\n<li>pkg.depot</li></ul>\n</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"theproblemwithsshagentforwardinghttpsdefnio20190412sshforwarding\"><a href=\"https://defn.io/2019/04/12/ssh-forwarding/\">The Problem with SSH Agent Forwarding</a></h3>\n\n<blockquote>\n  <p>After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”\n  Here’s what man ssh_config has to say about ForwardAgent:  \"Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.\"\"\n  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!\n  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3 id=\"openbsdupgradeguide64to65httpswwwopenbsdorgfaqupgrade65html\">[<a href=\"https://www.openbsd.org/faq/upgrade65.html\">OpenBSD Upgrade Guide: 6.4 to 6.5</a></h3>\n\n<blockquote>\n  <p>Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.\n  Alternatively, you can use the manual upgrade process.\n  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.</p>\n</blockquote>\n\n<ul>\n<li>Before rebooting into the install kernel</li>\n\n<li>Configuration and syntax changes</li>\n\n<li>Files to remove</li>\n\n<li>Special packages</li>\n\n<li>Upgrade without the install kernel</li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2019-April/001873.html\">2019 FreeBSD Community Survey</a></li>\n\n<li><a href=\"https://blog.seagate.com/craftsman-ship/seagate-shows-dual-actuator-speed-gains-in-real-world-setup/\">Seagate runs Mach.2 demo on FreeBSD</a></li>\n\n<li><a href=\"https://www.youtube.com/watch?v=2KoD-jXjHok&amp;t=7s\">FreeBSD: Resizing and Growing Disks</a></li>\n\n<li><a href=\"https://old.reddit.com/r/freebsd/comments/bh1abv/loading_49_on_an_old_tandy_4025lx_386_16mb_1gb_hd/\">Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD</a></li>\n\n<li><a href=\"https://forums.os108.org/d/6-os108-mate-20190422-released\">OS108 MATE 20190422 released</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Casey - <a href=\"http://dpaste.com/39VJ7NH#wrap\">Oklahoma City &amp; James</a></li>\n\n<li>Michael - <a href=\"http://dpaste.com/2VSKEGW#wrap\">Question on SAS backplane (camcontrol?)</a></li>\n\n<li>Ales - <a href=\"http://dpaste.com/0AD0HBY#wrap\">OpenBSD, FreeNAS, OpenZFS questions</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0297.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.","date_published":"2019-05-09T00:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b83c5930-57a8-4c27-855a-97b6d88f5f00.mp3","mime_type":"audio/mp3","size_in_bytes":24677382,"duration_in_seconds":2416}]},{"id":"81313d3c-40f8-49f3-bc58-f34f5dfcf51d","title":"296: It’s Alive: OpenBSD 6.5","url":"https://www.bsdnow.tv/296","content_text":"OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.\n\nHeadlines\n\nOpenBSD 6.5 Released\n\n\nChangelog\n\nMirrors\n\n6.5 Includes\n\n\n\nOpenSMTPD 6.5.0\n\nLibreSSL 2.9.1\n\nOpenSSH 8.0\n\nMandoc 1.14.5\n\nXenocara\n\nLLVM/Clang 7.0.1 (+ patches)\n\nGCC 4.2.1 (+ patches) and 3.3.6 (+ patches)\n\n\nMany pre-built packages for each architecture:\n\n\n\naarch64: 9654\n\namd64: 10602\n\ni386: 10535\n\n\n\n\n\nMount your ZFS datasets anywhere you want\n\n\n  ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.\n  When you create zpool maintank, the default mountpoint is /maintank.\n  You might be happy with that, but you don’t have to be content. You can do magical things.\n\n\n\nSome highlights are:\n\n\n\nmount point can be inherited\n\nnot all filesystems in a zpool need to be mounted\n\neach filesystem (directory) can have different ZFS characteristics\n\nIn my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.\n\n\n\n\n\nNews Roundup\n\nBranch for netbsd 9 upcoming, please help and test -current\n\n\n  Folks,\n  once again we are quite late for branching the next NetBSD release (NetBSD 9).\n  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.\n  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.\n  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:\n  \n  \n  please test -current, on all the various machines you have\n  \n  especially interesting would be test results from uncommon architectures\n  or strange combinations (like the sparc userland on sparc64 kernel issue\n  I ran in yesterday)\n  Please test, report success, and file PRs for failures!\n  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.\n  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.\n  Our goal is to have an unprecedented short release cycle this time. But..\n  we always say that upfront.\n  \n  \n  \n\n\nLibreSSL 2.9.1 Released\n\n\n  We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL\n  directory of your local OpenBSD mirror soon. This is the first stable release\n  from the 2.9 series, which is also included with OpenBSD 6.5\n  \n  It includes the following changes and improvements from LibreSSL 2.8.x:\n\n\n\nAPI and Documentation Enhancements\n\n\nCRYPTO_LOCK is now automatically initialized, with the legacy\ncallbacks stubbed for compatibility.\n\nAdded the SM3 hash function from the Chinese standard GB/T 32905-2016.\n\nAdded the SM4 block cipher from the Chinese standard GB/T 32907-2016.\n\nAdded more OPENSSLNO* macros for compatibility with OpenSSL.\n\nPartial port of the OpenSSL ECKEYMETHOD API for use by OpenSSH.\n\nImplemented further missing OpenSSL 1.1 API.\n\nAdded support for XChaCha20 and XChaCha20-Poly1305.\n\nAdded support for AES key wrap constructions via the EVP interface.\n\nCompatibility Changes\n\n\nAdded pbkdf2 key derivation support to openssl(1) enc.\n\nChanged the default digest type of openssl(1) enc to sha256.\n\nChanged the default digest type of openssl(1) dgst to sha256.\n\nChanged the default digest type of openssl(1) x509 -fingerprint to sha256.\n\nChanged the default digest type of openssl(1) crl -fingerprint to sha256.\n\nTesting and Proactive Security\n\n\nAdded extensive interoperability tests between LibreSSL and OpenSSL\n1.0 and 1.1.\n\nAdded additional Wycheproof tests and related bug fixes.\n\nInternal Improvements\n\n\nSimplified sigalgs option processing and handshake signing\nalgorithm selection.\n\nAdded the ability to use the RSA PSS algorithm for handshake signatures.\n\nAdded bnrandinterval() and use it in code needing ranges of\nrandom bn values.\n\nAdded functionality to derive early, handshake, and application\nsecrets as per RFC8446.\n\nAdded handshake state machine from RFC8446.\n\nRemoved some ASN.1 related code from libcrypto that had not been\nused since around 2000.\n\nUnexported internal symbols and internalized more record layer structs.\n\nRemoved SHA224 based handshake signatures from consideration for\nuse in a TLS 1.2 handshake.\n\nPortable Improvements\n\n\nAdded support for assembly optimizations on 32-bit ARM ELF targets.\n\nAdded support for assembly optimizations on Mingw-w64 targets.\n\nImproved Android compatibility\n\nBug Fixes\n\n\nImproved protection against timing side channels in ECDSA signature\ngeneration.\n\nCoordinate blinding was added to some elliptic curves. This is the\nlast bit of the work by Brumley et al. to protect against the Portsmash\nvulnerability.\n\nEnsure transcript handshake is always freed with TLS 1.2.\n\n\n\n\n\n  The LibreSSL project continues improvement of the codebase to reflect modern,\n  safe programming practices. We welcome feedback and improvements from the\n  broader community. Thanks to all of the contributors who helped make this\n  release possible.\n  \n  \n\n\nFreeBSD Mastery: Jails – Bail Bond Denied Edition\n\n\n  I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)\n  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.\n  I downgraded my expectations and tried again. And again. And again.\n  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!\n  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.\n  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.\n  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.\n  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.\n  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.\n\n\n\n\nOne reason ed(1) was a good editor back in the days of V7 Unix\n\n\n  It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.\n  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.\n  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.\n\n\n\n\nBeastie Bits\n\n\nCFT for FreeBSD ZoL\n\nSimple DNS Adblock\n\nAT&amp;T Unix PC in 1985\n\nOpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake\n\n\"What are the differences between Linux and OpenBSD?\" - Twitter thread\n\nAnnouncing the pkgsrc-2019Q1 release (2019-04-10)\n\n\n\n\nFeedback/Questions\n\n\nBrad - iocage\n\nFrank - Video from Level1Tech and a question\n\nNiall - Revision Control\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"openbsd65releasedhttpswwwopenbsdorg65html\"><a href=\"https://www.openbsd.org/65.html\">OpenBSD 6.5 Released</a></h3>\n\n<ul>\n<li><a href=\"https://www.openbsd.org/plus65.html\">Changelog</a></li>\n\n<li><a href=\"https://www.openbsd.org/ftp.html\">Mirrors</a></li>\n\n<li>6.5 Includes\n\n\n<ul>\n<li>OpenSMTPD 6.5.0</li>\n\n<li>LibreSSL 2.9.1</li>\n\n<li>OpenSSH 8.0</li>\n\n<li>Mandoc 1.14.5</li>\n\n<li>Xenocara</li>\n\n<li>LLVM/Clang 7.0.1 (+ patches)</li>\n\n<li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)</li></ul>\n</li>\n\n<li>Many pre-built packages for each architecture:\n\n\n<ul>\n<li>aarch64: 9654</li>\n\n<li>amd64: 10602</li>\n\n<li>i386: 10535</li></ul>\n</li>\n</ul>\n\n<p><hr /></p>\n\n<h3 id=\"mountyourzfsdatasetsanywhereyouwanthttpsdanlangilleorg20190422mountyourzfsdatasetsanywhereyouwant\"><a href=\"https://dan.langille.org/2019/04/22/mount-your-zfs-datasets-anywhere-you-want/\">Mount your ZFS datasets anywhere you want</a></h3>\n\n<blockquote>\n  <p>ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.\n  When you create zpool main<em>tank, the default mountpoint is /main</em>tank.\n  You might be happy with that, but you don’t have to be content. You can do magical things.</p>\n</blockquote>\n\n<ul>\n<li>Some highlights are:\n\n\n<ul>\n<li>mount point can be inherited</li>\n\n<li>not all filesystems in a zpool need to be mounted</li>\n\n<li>each filesystem (directory) can have different ZFS characteristics</li>\n\n<li>In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.</li></ul>\n</li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"branchfornetbsd9upcomingpleasehelpandtestcurrenthttpsmailindexnetbsdorgcurrentusers20190424msg035645html\"><a href=\"https://mail-index.netbsd.org/current-users/2019/04/24/msg035645.html\">Branch for netbsd 9 upcoming, please help and test -current</a></h3>\n\n<blockquote>\n  <p>Folks,\n  once again we are quite late for branching the next NetBSD release (NetBSD 9).\n  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.\n  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.\n  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:</p>\n  \n  <ul>\n  <li>please test -current, on all the various machines you have</li>\n  \n  <li>especially interesting would be test results from uncommon architectures\n  or strange combinations (like the sparc userland on sparc64 kernel issue\n  I ran in yesterday)\n  Please test, report success, and file PRs for failures!\n  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.\n  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.\n  Our goal is to have an unprecedented short release cycle this time. But..\n  we always say that upfront.</li>\n  </ul>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"libressl291releasedhttpsmarcinfolopenbsdannouncem155590112606279w2\"><a href=\"https://marc.info/?l=openbsd-announce&amp;m=155590112606279&amp;w=2\">LibreSSL 2.9.1 Released</a></h3>\n\n<blockquote>\n  <p>We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL\n  directory of your local OpenBSD mirror soon. This is the first stable release\n  from the 2.9 series, which is also included with OpenBSD 6.5</p>\n  \n  <p>It includes the following changes and improvements from LibreSSL 2.8.x:</p>\n</blockquote>\n\n<ul>\n<li><p>API and Documentation Enhancements</p>\n\n<ul>\n<li>CRYPTO_LOCK is now automatically initialized, with the legacy\ncallbacks stubbed for compatibility.</li>\n\n<li>Added the SM3 hash function from the Chinese standard GB/T 32905-2016.</li>\n\n<li>Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.</li>\n\n<li>Added more OPENSSL<em>NO</em>* macros for compatibility with OpenSSL.</li>\n\n<li>Partial port of the OpenSSL EC<em>KEY</em>METHOD API for use by OpenSSH.</li>\n\n<li>Implemented further missing OpenSSL 1.1 API.</li>\n\n<li>Added support for XChaCha20 and XChaCha20-Poly1305.</li>\n\n<li>Added support for AES key wrap constructions via the EVP interface.</li></ul></li>\n\n<li><p>Compatibility Changes</p>\n\n<ul>\n<li>Added pbkdf2 key derivation support to openssl(1) enc.</li>\n\n<li>Changed the default digest type of openssl(1) enc to sha256.</li>\n\n<li>Changed the default digest type of openssl(1) dgst to sha256.</li>\n\n<li>Changed the default digest type of openssl(1) x509 -fingerprint to sha256.</li>\n\n<li>Changed the default digest type of openssl(1) crl -fingerprint to sha256.</li></ul></li>\n\n<li><p>Testing and Proactive Security</p>\n\n<ul>\n<li>Added extensive interoperability tests between LibreSSL and OpenSSL\n1.0 and 1.1.</li>\n\n<li>Added additional Wycheproof tests and related bug fixes.</li></ul></li>\n\n<li><p>Internal Improvements</p>\n\n<ul>\n<li>Simplified sigalgs option processing and handshake signing\nalgorithm selection.</li>\n\n<li>Added the ability to use the RSA PSS algorithm for handshake signatures.</li>\n\n<li>Added bn<em>rand</em>interval() and use it in code needing ranges of\nrandom bn values.</li>\n\n<li>Added functionality to derive early, handshake, and application\nsecrets as per RFC8446.</li>\n\n<li>Added handshake state machine from RFC8446.</li>\n\n<li>Removed some ASN.1 related code from libcrypto that had not been\nused since around 2000.</li>\n\n<li>Unexported internal symbols and internalized more record layer structs.</li>\n\n<li>Removed SHA224 based handshake signatures from consideration for\nuse in a TLS 1.2 handshake.</li></ul></li>\n\n<li><p>Portable Improvements</p>\n\n<ul>\n<li>Added support for assembly optimizations on 32-bit ARM ELF targets.</li>\n\n<li>Added support for assembly optimizations on Mingw-w64 targets.</li>\n\n<li>Improved Android compatibility</li></ul></li>\n\n<li><p>Bug Fixes</p>\n\n<p><ul>\n<li>Improved protection against timing side channels in ECDSA signature\ngeneration.</li></p>\n\n<p><li>Coordinate blinding was added to some elliptic curves. This is the\nlast bit of the work by Brumley et al. to protect against the Portsmash\nvulnerability.</li></p>\n\n<p><li>Ensure transcript handshake is always freed with TLS 1.2.</li></ul>\n\n<p></p></li>\n</ul></p>\n\n<blockquote>\n  <p>The LibreSSL project continues improvement of the codebase to reflect modern,\n  safe programming practices. We welcome feedback and improvements from the\n  broader community. Thanks to all of the contributors who helped make this\n  release possible.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"freebsdmasteryjailsbailbonddeniededitionhttpsmwlioarchives4227\"><a href=\"https://mwl.io/archives/4227\">FreeBSD Mastery: Jails – Bail Bond Denied Edition</a></h3>\n\n<blockquote>\n  <p>I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)\n  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.\n  I downgraded my expectations and tried again. And again. And again.\n  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!\n  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.\n  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.\n  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.\n  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.\n  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.</p>\n</blockquote>\n\n<hr />\n\n<h3 id=\"onereasoned1wasagoodeditorbackinthedaysofv7unixhttpsutccutorontocatcksspaceblogunixeddesignedforcookedinput\"><a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/EdDesignedForCookedInput\">One reason ed(1) was a good editor back in the days of V7 Unix</a></h3>\n\n<blockquote>\n  <p>It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.\n  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.\n  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.</p>\n</blockquote>\n\n<hr />\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-fs/2019-April/027603.html\">CFT for FreeBSD ZoL</a></li>\n\n<li><a href=\"https://github.com/wilyarti/simple-dns-adblock\">Simple DNS Adblock</a></li>\n\n<li><a href=\"https://twitter.com/unix_byte/status/1119904828182781958\">AT&amp;T Unix PC in 1985</a></li>\n\n<li><a href=\"https://marc.info/?l=openbsd-cvs&amp;m=155523690813457&amp;w=2\">OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake</a></li>\n\n<li><a href=\"https://twitter.com/cfenollosa/status/1122069042083323904\">\"What are the differences between Linux and OpenBSD?\" - Twitter thread</a></li>\n\n<li><a href=\"http://mail-index.netbsd.org/pkgsrc-users/2019/04/10/msg028308.html\">Announcing the pkgsrc-2019Q1 release (2019-04-10)</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Brad - <a href=\"http://dpaste.com/0K2QFTM#wrap\">iocage</a></li>\n\n<li>Frank - <a href=\"http://dpaste.com/3110R96#wrap\">Video from Level1Tech and a question</a></li>\n\n<li>Niall - <a href=\"http://dpaste.com/0A32XDK#wrap\">Revision Control</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0296.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.","date_published":"2019-05-03T13:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/81313d3c-40f8-49f3-bc58-f34f5dfcf51d.mp3","mime_type":"audio/mp3","size_in_bytes":37476669,"duration_in_seconds":3695}]},{"id":"f856e52d-1f51-46e1-9dd9-658045523279","title":"295: Fun with funlinkat()","url":"https://www.bsdnow.tv/295","content_text":"Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.\n\nHeadlines\n\nIntroducing funlinkat\n\n\nIt turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition\n\n\n\n  One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.\n  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:\n  \n  \n  We will remove an entry in the directory with the filename.\n  \n  We will decrease a file reference count (in inode).\n  \n  If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later\n  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.\n  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.\n  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.\n  \n  \n  \n  When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.\n  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.\n  \n  Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.\n  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor\n  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.\n  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.\n  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.\n  int funlinkat(int dfd, const char *path, int fd, int flags);\n  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.\n  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.\n  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.\n  \n  \n  \n  \n\n\nUsing an OpenBSD Router with AT&amp;T U-Verse\n\n\n  I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.\n  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.\n  \n  \n\n\nNews Roundup\n\nHow to use NetBSD on a Raspberry Pi\n\n\n  Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered \"yes\" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.\n  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.\n  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.\n  \n  \n\n\nZFS Encryption is still under development (as of March 2019)\n\n\n  One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.\n  \n  \n  CFT for FreeBSD + ZoL\n  \n  \n  \n\n\nTutorial On Rump Kernel Servers and Clients\n\n\n  The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server \"mini-operating systems\". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.\n  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.\n  \n  \n\n\nInstalling Snort on OpenBSD 6.4\n\n\n  As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!\n  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! \n  \n  \n\n\nBeastie Bits\n\n\nos108\n\nAT&amp;T Archives: The UNIX Operating System\n\nhttpd(8): Adapt to industry wide current best security practices\n\nQuotes From A Book That Bashes Unix\n\nOpenBSD QA wiki\n\n\n\n\nFeedback/Questions\n\n\nMalcolm - Laptop Experience : Dell XPS 13\n\nDJ - Feedback\n\nAlex - GhostBSD and Wifi : FIXED\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"introducingfunlinkathttpsoshogbovexilliumorgblog63\"><a href=\"https://oshogbo.vexillium.org/blog/63/\">Introducing funlinkat</a></h3>\n\n<ul>\n<li>It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition</li>\n</ul>\n\n<blockquote>\n  <p>One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.\n  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:</p>\n  \n  <ul>\n  <li>We will remove an entry in the directory with the filename.</li>\n  \n  <li>We will decrease a file reference count (in inode).</li>\n  \n  <li>If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later\n  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.\n  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.\n  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.\n  \n  \n  <ul>\n  <li>When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.\n  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.</li>\n  \n  <li>Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.\n  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor\n  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.\n  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.\n  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.\n  int funlinkat(int dfd, const char *path, int fd, int flags);\n  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.\n  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.\n  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.</li></ul>\n  </li>\n  </ul>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"usinganopenbsdrouterwithattuversehttpsjcsorg20190321uverse\"><a href=\"https://jcs.org/2019/03/21/uverse\">Using an OpenBSD Router with AT&amp;T U-Verse</a></h3>\n\n<blockquote>\n  <p>I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.\n  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.</p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"howtousenetbsdonaraspberrypihttpsopensourcecomarticle193netbsdraspberrypi\"><a href=\"https://opensource.com/article/19/3/netbsd-raspberry-pi\">How to use NetBSD on a Raspberry Pi</a></h3>\n\n<blockquote>\n  <p>Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered \"yes\" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.\n  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.\n  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"zfsencryptionisstillunderdevelopmentasofmarch2019httpsutccutorontocatcksspacebloglinuxzfsencryptionnotready\"><a href=\"https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSEncryptionNotReady\">ZFS Encryption is still under development (as of March 2019)</a></h3>\n\n<blockquote>\n  <p>One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.</p>\n  \n  <ul>\n  <li><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2019-April/090915.html\">CFT for FreeBSD + ZoL</a></li>\n  </ul>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"tutorialonrumpkernelserversandclientshttpswwwnetbsdorgdocsrumpsptuthtml\"><a href=\"https://www.netbsd.org/docs/rump/sptut.html\">Tutorial On Rump Kernel Servers and Clients</a></h3>\n\n<blockquote>\n  <p>The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server \"mini-operating systems\". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.\n  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"installingsnortonopenbsd64httpsfunctionallyparanoidcom20190318installingsnortonopenbsd64\"><a href=\"https://functionallyparanoid.com/2019/03/18/installing-snort-on-openbsd-6-4/\">Installing Snort on OpenBSD 6.4</a></h3>\n\n<blockquote>\n  <p>As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!\n  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! </p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://os108.org/\">os108</a></li>\n\n<li><a href=\"https://www.youtube.com/watch?v=tc4ROCJYbm0&amp;feature=youtu.be\">AT&amp;T Archives: The UNIX Operating System</a></li>\n\n<li><a href=\"https://marc.info/?l=openbsd-tech&amp;m=155407864604288&amp;w=2\">httpd(8): Adapt to industry wide current best security practices</a></li>\n\n<li><a href=\"https://codesmithdev.com/quotes-from-a-book-that-bashes-unix/\">Quotes From A Book That Bashes Unix</a></li>\n\n<li><a href=\"https://github.com/ligurio/openbsd-tests/wiki\">OpenBSD QA wiki</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Malcolm - <a href=\"http://dpaste.com/1AFFTNJ\">Laptop Experience : Dell XPS 13</a></li>\n\n<li>DJ - <a href=\"http://dpaste.com/0V74SZC#wrap\">Feedback</a></li>\n\n<li>Alex - <a href=\"http://dpaste.com/1WVV1W7\">GhostBSD and Wifi : FIXED</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0295.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Introducing funlinkat(), an OpenBSD Router with AT&T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.","date_published":"2019-04-25T16:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f856e52d-1f51-46e1-9dd9-658045523279.mp3","mime_type":"audio/mp3","size_in_bytes":37143014,"duration_in_seconds":3662}]},{"id":"b1d75436-414e-48d2-bc93-a09aae8e7d82","title":"294: The SSH Tarpit","url":"https://www.bsdnow.tv/294","content_text":"A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.\n\nHeadlines\n\nA Pi-Powered Plan 9 Cluster\n\n\n  Plan 9 from Bell Labs comes from the same stable as the UNIX operating system, which of course Linux was designed after, and Apple’s OS X runs on top of a certified UNIX operating system. Just like UNIX, Plan 9 was developed as a research O/S — a vehicle for trying out new concepts — with it building on key UNIX principles and taking the idea of devices are just files even further.\n  In this post, we take a quick look at the Plan 9 O/S and some of the notable features, before moving on to the construction of a self-contained 4-node Raspberry Pi cluster that will provide a compact platform for experimentation.\n  \n  \n\n\nEndlessh: an SSH Tarpit\n\n\n  I’m a big fan of tarpits: a network service that intentionally inserts delays in its protocol, slowing down clients by forcing them to wait. This arrests the speed at which a bad actor can attack or probe the host system, and it ties up some of the attacker’s resources that might otherwise be spent attacking another host. When done well, a tarpit imposes more cost on the attacker than the defender.\n  The Internet is a very hostile place, and anyone who’s ever stood up an Internet-facing IPv4 host has witnessed the immediate and continuous attacks against their server. I’ve maintained such a server for nearly six years now, and more than 99% of my incoming traffic has ill intent. One part of my defenses has been tarpits in various forms.\n  \n  \n\n\nNews Roundup\n\nrdist(1) – when Ansible is too much\n\n\n  The post written about rdist(1) on johan.huldtgren.com sparked\n  us to write one as well. It's a great, underappreciated, tool. And we wanted to show how we wrapped doas(1) around it.\n  There are two services in our infrastructure for which we were looking to keep the configuration in sync and to reload the process when the configuration had indeed changed. There is a pair of nsd(8)/unbound(8) hosts and a pair of hosts running relayd(8)/httpd(8) with carp(4) between them.\n  We didn't have a requirement to go full configuration management with tools like Ansible or Salt Stack. And there wasn't any interest in building additional logic on top of rsync or repositories. &gt; Enter rdist(1), rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing.\n  \n  \n\n\nFalling in love with OpenBSD again\n\n\n  I was checking the other day and was appalled at how long it has been since I posted here.  I had been working a job during 2018 that had me traveling 3,600 miles by air every week so that is at least a viable excuse.\n  So what is my latest project?  I wanted to get something better than the clunky old T500 “freedom laptop” that I could use as my daily driver.  Some background here.  My first paid gig as a programmer was on SunOS 4 (predecessor to Solaris) and Ultrix (on a DEC MicroVAX).  I went from there to a Commodore Amiga (preemptive multitasking in 1985!).  I went from there to OS/2 (I know, patron saint of lost causes) and then finally decided to “sell out” and move to Windows as the path of least resistance in the mid 90’s.\n  My wife bought me an iPod literally just as they started working with computers other than Macs and I watched with fascination as Apple made the big gamble and moved away from PowerPC chips to Intel.  That was the beginning of the Apple Fan Boi years for me.  My gateway drug was a G4 MacMini and I managed somehow to get in on the pre-production, developer build of an Intel-based Mac.  I was quite happy on the platform until about three years ago.\n  \n  \n\n\nHow I Created My First FreeBSD Port\n\n\n  I created my first FreeBSD port recently. I found that FreeBSD didn't have a port for GoCD, which is a continuous integration and continuous deployment (CI/CD) system. This was a great opportunity to learn how to build a FreeBSD port while also contributing back to the community\n  \n  \n\n\nThe Tilde Institute of OpenBSD Education\n\n\n  Welcome to tilde.institute! This is an OpenBSD machine whose purpose is to provide a space in the tildeverse for experimentation with and education of the OpenBSD operating system. A variety of editors, shells, and compilers are installed to allow for development in a native OpenBSD environment. OpenBSD's httpd(8) is configured with slowcgi(8) as the fastcgi provider and sqlite3 available. This allows users to experiment with web development using compiled CGI in C, aka the BCHS Stack. In addition to php7.0 and mysql (mariadb) by request, this provides an environment where the development of complex web apps is possible.\n  \n  \n\n\nBeastie Bits\n\n\nSoloBSD 19.03-STABLE\n\nWireGuard for NetBSD\n\n[NetBSD - Removing PF](https://mail-index.netbsd.org/tech-kern/2019/03/29/msg024883.html\n)\n\nWhat does the N in nmake stand for?\n\nA Map of the Internet from May 1973\n\nNSA-B-Gone : A sketchy hardware security device for your x220\n\n\n\n\nFeedback/Questions\n\n\nJake - A single jail as a VPN client\n\nMatt - Surprising BSD Features\n\ncia - Routing and ZFS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.</p>\n\n<h2 id=\"headlines\">Headlines</h2>\n\n<h3 id=\"apipoweredplan9clusterhttpswwwrsonlinecomdesignsparkapipoweredplan9cluster\"><a href=\"https://www.rs-online.com/designspark/a-pi-powered-plan-9-cluster\">A Pi-Powered Plan 9 Cluster</a></h3>\n\n<blockquote>\n  <p>Plan 9 from Bell Labs comes from the same stable as the UNIX operating system, which of course Linux was designed after, and Apple’s OS X runs on top of a certified UNIX operating system. Just like UNIX, Plan 9 was developed as a research O/S — a vehicle for trying out new concepts — with it building on key UNIX principles and taking the idea of devices are just files even further.\n  In this post, we take a quick look at the Plan 9 O/S and some of the notable features, before moving on to the construction of a self-contained 4-node Raspberry Pi cluster that will provide a compact platform for experimentation.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"endlesshansshtarpithttpsnullprogramcomblog20190322\"><a href=\"https://nullprogram.com/blog/2019/03/22/\">Endlessh: an SSH Tarpit</a></h3>\n\n<blockquote>\n  <p>I’m a big fan of tarpits: a network service that intentionally inserts delays in its protocol, slowing down clients by forcing them to wait. This arrests the speed at which a bad actor can attack or probe the host system, and it ties up some of the attacker’s resources that might otherwise be spent attacking another host. When done well, a tarpit imposes more cost on the attacker than the defender.\n  The Internet is a very hostile place, and anyone who’s ever stood up an Internet-facing IPv4 host has witnessed the immediate and continuous attacks against their server. I’ve maintained such a server for nearly six years now, and more than 99% of my incoming traffic has ill intent. One part of my defenses has been tarpits in various forms.</p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"newsroundup\">News Roundup</h2>\n\n<h3 id=\"rdist1whenansibleistoomuchhttpschargenoneobsdamsrdist1whenansibleistoomuch\"><a href=\"https://chargen.one/obsdams/rdist-1-when-ansible-is-too-much\">rdist(1) – when Ansible is too much</a></h3>\n\n<blockquote>\n  <p>The post written about rdist(1) on johan.huldtgren.com sparked\n  us to write one as well. It's a great, underappreciated, tool. And we wanted to show how we wrapped doas(1) around it.\n  There are two services in our infrastructure for which we were looking to keep the configuration in sync and to reload the process when the configuration had indeed changed. There is a pair of nsd(8)/unbound(8) hosts and a pair of hosts running relayd(8)/httpd(8) with carp(4) between them.\n  We didn't have a requirement to go full configuration management with tools like Ansible or Salt Stack. And there wasn't any interest in building additional logic on top of rsync or repositories. > Enter rdist(1), rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"fallinginlovewithopenbsdagainhttpsfunctionallyparanoidcom20190313wellitsbeenawhilefallinginlovewithopenbsdagain\"><a href=\"https://functionallyparanoid.com/2019/03/13/well-its-been-a-while-falling-in-love-with-openbsd-again/\">Falling in love with OpenBSD again</a></h3>\n\n<blockquote>\n  <p>I was checking the other day and was appalled at how long it has been since I posted here.  I had been working a job during 2018 that had me traveling 3,600 miles by air every week so that is at least a viable excuse.\n  So what is my latest project?  I wanted to get something better than the clunky old T500 “freedom laptop” that I could use as my daily driver.  Some background here.  My first paid gig as a programmer was on SunOS 4 (predecessor to Solaris) and Ultrix (on a DEC MicroVAX).  I went from there to a Commodore Amiga (preemptive multitasking in 1985!).  I went from there to OS/2 (I know, patron saint of lost causes) and then finally decided to “sell out” and move to Windows as the path of least resistance in the mid 90’s.\n  My wife bought me an iPod literally just as they started working with computers other than Macs and I watched with fascination as Apple made the big gamble and moved away from PowerPC chips to Intel.  That was the beginning of the Apple Fan Boi years for me.  My gateway drug was a G4 MacMini and I managed somehow to get in on the pre-production, developer build of an Intel-based Mac.  I was quite happy on the platform until about three years ago.</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"howicreatedmyfirstfreebsdporthttpsaikchardevbloghowicreatedmyfirstfreebsdporthtml\"><a href=\"https://aikchar.dev/blog/how-i-created-my-first-freebsd-port.html\">How I Created My First FreeBSD Port</a></h3>\n\n<blockquote>\n  <p>I created my first FreeBSD port recently. I found that FreeBSD didn't have a port for GoCD, which is a continuous integration and continuous deployment (CI/CD) system. This was a great opportunity to learn how to build a FreeBSD port while also contributing back to the community</p>\n  \n  <hr />\n</blockquote>\n\n<h3 id=\"thetildeinstituteofopenbsdeducationhttpstildeinstitute\"><a href=\"https://tilde.institute/\">The Tilde Institute of OpenBSD Education</a></h3>\n\n<blockquote>\n  <p>Welcome to tilde.institute! This is an OpenBSD machine whose purpose is to provide a space in the tildeverse for experimentation with and education of the OpenBSD operating system. A variety of editors, shells, and compilers are installed to allow for development in a native OpenBSD environment. OpenBSD's httpd(8) is configured with slowcgi(8) as the fastcgi provider and sqlite3 available. This allows users to experiment with web development using compiled CGI in C, aka the BCHS Stack. In addition to php7.0 and mysql (mariadb) by request, this provides an environment where the development of complex web apps is possible.</p>\n  \n  <hr />\n</blockquote>\n\n<h2 id=\"beastiebits\">Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.solobsd.org/index.php/2019/03/26/solobsd-19-03-stable/\">SoloBSD 19.03-STABLE</a></li>\n\n<li><a href=\"https://docs.google.com/presentation/d/1BbveYtY9IhuPCOLsEafwXMefkiY3REJBYl-opMAKQC0/edit#slide=id.p\">WireGuard for NetBSD</a></li>\n\n<li>[NetBSD - Removing PF](https://mail-index.netbsd.org/tech-kern/2019/03/29/msg024883.html\n)</li>\n\n<li><a href=\"https://devblogs.microsoft.com/oldnewthing/20190325-00/?p=102359\">What does the N in nmake stand for?</a></li>\n\n<li><a href=\"https://kottke.org/19/03/a-map-of-the-internet-from-may-1973\">A Map of the Internet from May 1973</a></li>\n\n<li><a href=\"https://hackaday.io/project/164343-nsa-b-gone\">NSA-B-Gone : A sketchy hardware security device for your x220</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2 id=\"feedbackquestions\">Feedback/Questions</h2>\n\n<ul>\n<li>Jake - <a href=\"http://dpaste.com/1Y22ZJM\">A single jail as a VPN client</a></li>\n\n<li>Matt - <a href=\"http://dpaste.com/2FAFC3A#wrap\">Surprising BSD Features</a></li>\n\n<li>cia - <a href=\"http://dpaste.com/2T4J7G3\">Routing and ZFS</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0294.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"A PI-powered Plan 9 cluster, an SSH tarpit, rdist for when Ansible is too much, falling in love with OpenBSD again, how I created my first FreeBSD port, the Tilde Institute of OpenBSD education and more.","date_published":"2019-04-18T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b1d75436-414e-48d2-bc93-a09aae8e7d82.mp3","mime_type":"audio/mp3","size_in_bytes":34751503,"duration_in_seconds":3423}]},{"id":"ca87df46-31a6-4c71-883e-e34d10e4fd2d","title":"293: Booking Jails","url":"https://www.bsdnow.tv/293","content_text":"This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.\n\n###Interview - Michael W. Lucas  - mwl@mwl.io / @mwlauthor\nFreeBSD Mastery: Jails\n\n\nBR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?\nAJ: How much research did you have to do about jails?\nBR: The book talks about something called ‘incomplete’ jails. What do you mean by that?\nAJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?\nBR: How many jails do you run yourself?\nAJ: Can you tell us a bit about how you handle book sponsorship these days?\nBR: What other books (fiction and non-fiction) are you currently working on?\nAJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?\nBR: How is the BSD user group going?\nAJ: Anything else you’d like to mention before we release you from our interview jail cell?\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.</p>\n\n<p>###Interview - Michael W. Lucas  - <a href=\"mailto:mwl@mwl.io\">mwl@mwl.io</a> / <a href=\"https://twitter.com/mwlauthor\">@mwlauthor</a><br>\nFreeBSD Mastery: Jails</p>\n\n<ul>\n<li>BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?</li>\n<li>AJ: How much research did you have to do about jails?</li>\n<li>BR: The book talks about something called ‘incomplete’ jails. What do you mean by that?</li>\n<li>AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?</li>\n<li>BR: How many jails do you run yourself?</li>\n<li>AJ: Can you tell us a bit about how you handle book sponsorship these days?</li>\n<li>BR: What other books (fiction and non-fiction) are you currently working on?</li>\n<li>AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?</li>\n<li>BR: How is the BSD user group going?</li>\n<li>AJ: Anything else you’d like to mention before we release you from our interview jail cell?</li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0293.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.","date_published":"2019-04-11T12:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca87df46-31a6-4c71-883e-e34d10e4fd2d.mp3","mime_type":"audio/mp3","size_in_bytes":46528143,"duration_in_seconds":4601}]},{"id":"6f743ea3-0e96-445c-a46e-944f1a62450b","title":"292: AsiaBSDcon 2019 Recap","url":"https://www.bsdnow.tv/292","content_text":"FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.\n\n##Headlines\n###AsiaBSDcon 2019 recap\n\n\nBoth Allan and I attended AsiaBSDcon 2019 in Tokyo in mid march. After a couple of days of Tokyo sightseeing and tasting the local food, the conference started with tutorials.\nBenedict gave his tutorial about “BSD-based Systems Monitoring with Icinga2 and OpenSSH”, while Allan ran the FreeBSD developer summit.\nOn the next day, Benedict attended the tutorial “writing (network) tests for FreeBSD” held by Kristof Provost. I learned a lot about Kyua, where tests live and how they are executed. I took some notes, which will likely become an article or chapter in the developers handbook about writing tests.\nOn the third day, Hiroki Sato officially opened the paper session and then people went into individual talks.\nBenedict attended\n\nAdventure in DRMland - Or how to write a FreeBSD ARM64 DRM driver by Emmanuel\nVadot\n\n\n\n\n\npowerpc64 architecture support in FreeBSD ports by Piotr Kubaj\nManaging System Images with ZFS by Allan Jude\nFreeBSD - Improving block I/O compatibility in bhyve by Sergiu Weisz\nSecurity Fantasies and Realities for the BSDs by George V.\nNeville-Neil\nZRouter: Remote update of firmware by Hiroki Mori\nImproving security of the FreeBSD boot process by Marcin Wojtas\n\n\n\nAllan attended\n\nAdventures in DRMland by Emmanuel Vadot\nIntel HAXM by Kamil Rytarowski\nBSD Solutions in Australian NGOs\nContainer Migration on FreeBSD by Yuhei Takagawa\nSecurity Fantasies and Realities for the BSDs by George Neville-Neil\n\n\n\n\n\nZRouter: Remote update of firmware by Hiroki Mori\nImproving security of the FreeBSD boot process by Marcin Wojtas\n\n\n\nWhen not in talks, time was spent in the hallway track and conversations would often continue over dinner.\nStay tuned for announcements about where AsiaBSDcon 2020 will be, as the Tokyo Olympics will likely force some changes for next year. Overall, it was nice to see people at the conference again, listen to talks, and enjoy the hospitality of Japan.\n\n\n###FreeBSD Quarterly Status Report - Fourth Quarter 2018\n\n\nSince we are still on this island among many in this vast ocean of the Internet, we write this message in a bottle to inform you of the work we have finished and what lies ahead of us. These deeds that we have wrought with our minds and hands, they are for all to partake of - in the hopes that anyone of their free will, will join us in making improvements. In todays message the following by no means complete or ordered set of improvements and additions will be covered:\ni386 PAE Pagetables for up to 24GB memory support, Continuous Integration efforts, driver updates to ENA and graphics, ARM enhancements such as RochChip, Marvell 8K, and Broadcom support as well as more DTS files, more Capsicum possibilities, as well as pfsync improvements, and many more things that you can read about for yourselves.\nAdditionally, we bring news from some islands further down stream, namely the nosh project, HardenedBSD, ClonOS, and the Polish BSD User-Group.\nWe would, selfishly, encourage those of you who give us the good word to please send in your submissions sooner than just before the deadline, and also encourage anyone willing to share the good word to please read the section on which submissions we’re also interested in having.\n\n\n\n\n###GhostBSD: A Solid Linux-Like Open Source Alternative\n\n\nThe subject of this week’s Linux Picks and Pans is a representative of a less well-known computing platform that coexists with Linux as an open source operating system. If you thought that the Linux kernel was the only open source engine for a free OS, think again. BSD (Berkeley Software Distribution) shares many of the same features that make Linux OSes viable alternatives to proprietary computing platforms.\nGhostBSD is a user-friendly Linux-like desktop operating system based on TrueOS. TrueOS is, in turn, based on FreeBSD’s development branch. TrueOS’ goal is to combine the stability and security of FreeBSD with a preinstalled GNOME, MATE, Xfce, LXDE or Openbox graphical user interface.\nI stumbled on TrueOS while checking out new desktop environments and features in recent new releases of a few obscure Linux distros. Along the way, I discovered that today’s BSD computing family is not the closed source Unix platform the “BSD” name might suggest.\nIn last week’s Redcore Linux review, I mentioned that the Lumina desktop environment was under development for an upcoming Redcore Linux release. Lumina is being developed primarily for BSD OSes. That led me to circle back to a review I wrote two years ago on Lumina being developed for Linux.\nGhostBSD is a pleasant discovery. It has nothing to do with being spooky, either. That goes for both the distro and the open source computing family it exposes.\nKeep reading to find out what piqued my excitement about Linux-like GhostBSD.\n\n\n\n\n##News Roundup\n###SPARCbook 3000ST - The coolest 90s laptop\n\n\nA few weeks back I managed to pick up an incredibly rare laptop in immaculate condition for $50 on Kijiji: a Tadpole Technologies SPARCbook 3000ST from 1997 (it also came with two other working Pentium laptops from the 1990s).\nSun computers were an expensive desire for many computer geeks in the 1990s, and running UNIX on a SPARC-based laptop was, well, just as cool as it gets. SPARC was an open hardware platform that anyone could make, and Tadpole licensed the Solaris UNIX operating system from Sun for their SPARCbooks. Tadpole essentially made high-end UNIX/VAX workstations on costly, unusual platforms (PowerPC, DEC Alpha, SPARC) but only their SPARCbooks were popular in the high-end UNIX market of the 1990s.\n\n\n\n\n###OpenSSH 8.0 Releasing With Quantum Computing Resistant Keys\n\n\nOpenSSH 7.9 came out with a host of bug fixes  last year with few new features, as is to be expected in minor releases. However, recently, Damien Miller has announced that OpenSSH 8.0 is nearly ready to be released. Currently, it’s undergoing testing to ensure compatibility across supported systems.\n\n\n\nhttps://twitter.com/damienmiller/status/1111416334737244160\n\n\n\nBetter Security\nCopying filenames with scp will be more secure in OpenSSH 8.0 due to the fact that copying filenames from a remote to local directory will prompt scp to check if the files sent from the server match your request. Otherwise, an attack server would theoretically be able to intercept the request by serving malicious files in place of the ones originally requested. Knowing this, you’re probably better off never using scp anyway.  OpenSSH advises against it:\n“The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.”\n\n\n\nInteresting new features\n\n\n\nssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for “yes”. This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.\n\n\n\n\n###Project Trident : 18.12-U8 Available\n\n\nThank you all for your patience! Project Trident has finally finished some significant infrastructure updates over the last 2 weeks, and we are pleased to announce that package update 8 for 18.12-RELEASE is now available.\nTo switch to the new update, you will need to open the “Configuration” tab in the update manager and switch to the new “Trident-release” package repository. You can also perform this transition via the command line by running: sudo sysup --change-train Trident-release\n\n\n\n\n##Beastie Bits\n\n\nBSD Router Project - Release 1.92\nEuroBSDcon - New Proposals\nFunny UNIX shirt (René Magritte art parody)\n51NB’s Thinkpad X210\nDragonFly: No more gcc50\n“FreeBSD Mastery: Jails” ebook escaping!\nFreeBSD talk at the Augsburger Linux Info Days (german)\n\n\n\n\n##Feedback/Questions\n\n\nDJ - FuguIta Feedback\nMike - Another Good Show\nAlex - GhostBSD and wifi\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://2019.asiabsdcon.org\">AsiaBSDcon 2019 recap</a></p>\n\n<ul>\n<li>Both Allan and I attended AsiaBSDcon 2019 in Tokyo in mid march. After a couple of days of Tokyo sightseeing and tasting the local food, the conference started with tutorials.</li>\n<li>Benedict gave his tutorial about “BSD-based Systems Monitoring with Icinga2 and OpenSSH”, while Allan ran the FreeBSD developer summit.</li>\n<li>On the next day, Benedict attended the tutorial “writing (network) tests for FreeBSD” held by Kristof Provost. I learned a lot about Kyua, where tests live and how they are executed. I took some notes, which will likely become an article or chapter in the developers handbook about writing tests.</li>\n<li>On the third day, Hiroki Sato officially opened the paper session and then people went into individual talks.</li>\n<li>Benedict attended\n<blockquote>\n<p>Adventure in DRMland - Or how to write a FreeBSD ARM64 DRM driver by Emmanuel<br>\nVadot</p>\n</blockquote>\n</li>\n</ul>\n\n<blockquote>\n<p>powerpc64 architecture support in FreeBSD ports by Piotr Kubaj<br>\nManaging System Images with ZFS by Allan Jude<br>\nFreeBSD - Improving block I/O compatibility in bhyve by Sergiu Weisz<br>\n<a href=\"https://www.youtube.com/watch?v=7kShjboN6ek\">Security Fantasies and Realities for the BSDs by George V.<br>\nNeville-Neil</a><br>\nZRouter: Remote update of firmware by Hiroki Mori<br>\nImproving security of the FreeBSD boot process by Marcin Wojtas</p>\n</blockquote>\n\n<ul>\n<li>Allan attended\n<blockquote>\n<p>Adventures in DRMland by Emmanuel Vadot<br>\nIntel HAXM by Kamil Rytarowski<br>\nBSD Solutions in Australian NGOs<br>\nContainer Migration on FreeBSD by Yuhei Takagawa<br>\nSecurity Fantasies and Realities for the BSDs by George Neville-Neil</p>\n</blockquote>\n</li>\n</ul>\n\n<blockquote>\n<p>ZRouter: Remote update of firmware by Hiroki Mori<br>\nImproving security of the FreeBSD boot process by Marcin Wojtas</p>\n</blockquote>\n\n<ul>\n<li>When not in talks, time was spent in the hallway track and conversations would often continue over dinner.</li>\n<li>Stay tuned for announcements about where AsiaBSDcon 2020 will be, as the Tokyo Olympics will likely force some changes for next year. Overall, it was nice to see people at the conference again, listen to talks, and enjoy the hospitality of Japan.</li>\n</ul>\n\n<p>###<a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2019-March/001871.html\">FreeBSD Quarterly Status Report - Fourth Quarter 2018</a></p>\n\n<blockquote>\n<p>Since we are still on this island among many in this vast ocean of the Internet, we write this message in a bottle to inform you of the work we have finished and what lies ahead of us. These deeds that we have wrought with our minds and hands, they are for all to partake of - in the hopes that anyone of their free will, will join us in making improvements. In todays message the following by no means complete or ordered set of improvements and additions will be covered:<br>\ni386 PAE Pagetables for up to 24GB memory support, Continuous Integration efforts, driver updates to ENA and graphics, ARM enhancements such as RochChip, Marvell 8K, and Broadcom support as well as more DTS files, more Capsicum possibilities, as well as pfsync improvements, and many more things that you can read about for yourselves.<br>\nAdditionally, we bring news from some islands further down stream, namely the nosh project, HardenedBSD, ClonOS, and the Polish BSD User-Group.<br>\nWe would, selfishly, encourage those of you who give us the good word to please send in your submissions sooner than just before the deadline, and also encourage anyone willing to share the good word to please read the section on which submissions we’re also interested in having.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.linuxinsider.com/story/GhostBSD-A-Solid-Linux-Like-Open-Source-Alternative-85859.html\">GhostBSD: A Solid Linux-Like Open Source Alternative</a></p>\n\n<blockquote>\n<p>The subject of this week’s Linux Picks and Pans is a representative of a less well-known computing platform that coexists with Linux as an open source operating system. If you thought that the Linux kernel was the only open source engine for a free OS, think again. BSD (Berkeley Software Distribution) shares many of the same features that make Linux OSes viable alternatives to proprietary computing platforms.<br>\nGhostBSD is a user-friendly Linux-like desktop operating system based on TrueOS. TrueOS is, in turn, based on FreeBSD’s development branch. TrueOS’ goal is to combine the stability and security of FreeBSD with a preinstalled GNOME, MATE, Xfce, LXDE or Openbox graphical user interface.<br>\nI stumbled on TrueOS while checking out new desktop environments and features in recent new releases of a few obscure Linux distros. Along the way, I discovered that today’s BSD computing family is not the closed source Unix platform the “BSD” name might suggest.<br>\nIn last week’s Redcore Linux review, I mentioned that the Lumina desktop environment was under development for an upcoming Redcore Linux release. Lumina is being developed primarily for BSD OSes. That led me to circle back to a review I wrote two years ago on Lumina being developed for Linux.<br>\nGhostBSD is a pleasant discovery. It has nothing to do with being spooky, either. That goes for both the distro and the open source computing family it exposes.<br>\nKeep reading to find out what piqued my excitement about Linux-like GhostBSD.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"http://triosdevelopers.com/jason.eckert/blog/Entries/2019/3/14_SPARCbook_3000ST_-_The_coolest_90s_laptop.html\">SPARCbook 3000ST - The coolest 90s laptop</a></p>\n\n<blockquote>\n<p>A few weeks back I managed to pick up an incredibly rare laptop in immaculate condition for $50 on Kijiji: a Tadpole Technologies SPARCbook 3000ST from 1997 (it also came with two other working Pentium laptops from the 1990s).<br>\nSun computers were an expensive desire for many computer geeks in the 1990s, and running UNIX on a SPARC-based laptop was, well, just as cool as it gets. SPARC was an open hardware platform that anyone could make, and Tadpole licensed the Solaris UNIX operating system from Sun for their SPARCbooks. Tadpole essentially made high-end UNIX/VAX workstations on costly, unusual platforms (PowerPC, DEC Alpha, SPARC) but only their SPARCbooks were popular in the high-end UNIX market of the 1990s.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://codesmithdev.com/openssh-8-0-releasing-with-quantum-computing-resistant-keys/\">OpenSSH 8.0 Releasing With Quantum Computing Resistant Keys</a></p>\n\n<blockquote>\n<p>OpenSSH 7.9 came out with a host of bug fixes  last year with few new features, as is to be expected in minor releases. However, recently, Damien Miller has announced that OpenSSH 8.0 is nearly ready to be released. Currently, it’s undergoing testing to ensure compatibility across supported systems.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://twitter.com/damienmiller/status/1111416334737244160\">https://twitter.com/damienmiller/status/1111416334737244160</a></li>\n</ul>\n\n<blockquote>\n<p>Better Security<br>\nCopying filenames with scp will be more secure in OpenSSH 8.0 due to the fact that copying filenames from a remote to local directory will prompt scp to check if the files sent from the server match your request. Otherwise, an attack server would theoretically be able to intercept the request by serving malicious files in place of the ones originally requested. Knowing this, you’re probably better off never using scp anyway.  OpenSSH advises against it:<br>\n“The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.”</p>\n</blockquote>\n\n<ul>\n<li>Interesting new features</li>\n</ul>\n\n<blockquote>\n<p>ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for “yes”. This allows the user to paste a fingerprint obtained out of band at the prompt and have the client do the comparison for you.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://project-trident.org/post/2019-03-29_18.12-u8_available/\">Project Trident : 18.12-U8 Available</a></p>\n\n<blockquote>\n<p>Thank you all for your patience! Project Trident has finally finished some significant infrastructure updates over the last 2 weeks, and we are pleased to announce that package update 8 for 18.12-RELEASE is now available.<br>\nTo switch to the new update, you will need to open the “Configuration” tab in the update manager and switch to the new “Trident-release” package repository. You can also perform this transition via the command line by running: sudo sysup --change-train Trident-release</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://sourceforge.net/projects/bsdrp/files/BSD_Router_Project/1.92/\">BSD Router Project - Release 1.92</a></li>\n<li><a href=\"https://registration.eurobsdcon.org/conferences/2019/program/proposals/new\">EuroBSDcon - New Proposals</a></li>\n<li><a href=\"https://www.reddit.com/r/unix/comments/b1wyde/funny_unix_shirt_ren%C3%A9_magritte_art_parody/\">Funny UNIX shirt (René Magritte art parody)</a></li>\n<li><a href=\"https://geoff.greer.fm/2019/03/04/thinkpad-x210/\">51NB’s Thinkpad X210</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/03/26/22703.html\">DragonFly: No more gcc50</a></li>\n<li><a href=\"https://mwl.io/archives/4139\">“FreeBSD Mastery: Jails” ebook escaping!</a></li>\n<li><a href=\"https://frab.luga.de/en/LIT2019/public/events/68\">FreeBSD talk at the Augsburger Linux Info Days (german)</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>DJ - <a href=\"http://dpaste.com/3ZRJ5DA#wrap\">FuguIta Feedback</a></li>\n<li>Mike - <a href=\"http://dpaste.com/32TSCH4#wrap\">Another Good Show</a></li>\n<li>Alex - <a href=\"http://dpaste.com/34ND6BC#wrap\">GhostBSD and wifi</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0292.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD Q4 2018 status report, the GhostBSD alternative, the coolest 90s laptop, OpenSSH 8.0 with quantum computing resistant keys exchange, project trident: 18.12-U8 is here, and more.","date_published":"2019-04-04T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6f743ea3-0e96-445c-a46e-944f1a62450b.mp3","mime_type":"audio/mp3","size_in_bytes":54434181,"duration_in_seconds":5425}]},{"id":"54559ca9-f84f-4e9e-8323-3a5a0919937f","title":"291: Storage Changes Software","url":"https://www.bsdnow.tv/291","content_text":"Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.\n\n##Headlines\n\n###Tracking a storage issue led to software change\n\n\nEarly last year we completed a massive migration that moved our customers’ hosting data off of a legacy datacenter (that we called FR-SD2) onto several new datacenters (that we call FR-SD3, FR-SD5, and FR-SD6) with much more modern, up-to-date infrastructure.\nThis migration required several changes in both the software and hardware we use, including switching the operating system on our storage units to FreeBSD.\nCurrently, we use the NFS protocol to provide storage and export the filesystems on Simple Hosting, our web hosting service, and the FreeBSD kernel includes an NFS server for just this purpose.\n\n\n\nProblem\n\n\n\nWhile migrating virtual disks of Simple Hosting instances from FR-SD2, we noticed high CPU load spikes on the new storage units.\n\n\n\n\n###What Makes Unix Special\n\n\nEver since Unix burst onto the scene within the early '70s, observers within the pc world have been fast to put in writing it off as a unusual working system designed by and for knowledgeable programmers. Regardless of their proclamations, Unix refuses to die. Means again in 1985, Stewart Cheifet puzzled if Unix would turn out to be the usual working system of the longer term on the PBS present “The Laptop Chronicles,” though MS-DOS was effectively in its heyday. In 2018, it is clear that Unix actually is the usual working system, not on desktop PCs, however on smartphones and tablets.\n\n\n\nWhat Makes Unix Special?\n\n\n\nIt is also the usual system for net servers. The actual fact is, hundreds of thousands of individuals all over the world have interacted with Linux and Unix programs daily, most of whom have by no means written a line of code of their lives.\nSo what makes Unix so beloved by programmers and different techie sorts? Let’s check out a few of issues this working system has going for it. (For some background on Unix, try The Historical past of Unix: From Bell Labs to the iPhone.)\n\n\n\n\n##News Roundup\n###What you need may be “pipeline +Unix commands” only\n\n\nI came across Taco Bell Programming recently, and think this article is worthy to read for every software engineer. The post mentions a scenario which you may consider to use Hadoop to solve but actually xargs may be a simpler and better choice. This reminds me a similar experience: last year a client wanted me to process a data file which has 5 million records. After some investigations, no novel technologies, a concise awk script (less than 10 lines) worked like a charm! What surprised me more is that awk is just a single-thread program, no nifty concurrency involved.\nThe IT field never lacks “new” technologies: cloud computing, big data, high concurrency, etc. However, the thinkings behind these “fancy” words may date back to the era when Unix arose. Unix command line tools are invaluable treasure. In many cases, picking the right components and using pipeline to glue them can satisfy your requirement perfectly. So spending some time in reviewing Unixcommand line manual instead of chasing state-of-the-art techniques exhaustedly, you may gain more.\nBTW, if your data set can be disposed by an awk script, it should not be called “big data”.\n\n\n\nTaco Bell Programming\n\n\n\n\n###Running a bakery on Emacs and PostgreSQL\n\n\nJust over a year ago now, I finally opened the bakery I’d been dreaming of for years. It’s been a big change in my life, from spending all my time sat in front of a computer, to spending most of it making actual stuff. And stuff that makes people happy, at that. It’s been a huge change, but I can’t think of a single job change that’s ever made me as happy as this one.\nOne of the big changes that came with going pro was that suddenly I was having to work out how much stuff I needed to mix to fill the orders I needed. On the face of it, this is really simple, just work out how much dough you need, then work out what quantities to mix to make that much dough. Easy. You can do it with a pencil and paper. Or, in traditional bakers’ fashion, by scrawling with your finger on a floured work bench.\nAnd that’s how I coped for a few weeks early on. But I kept making mistakes, which makes for an inconsistent product (bread is very forgiving, you have to work quite hard to make something that isn’t bread, but consistency matters). I needed to automate.\n\n\n\n\n###The Ultimate Guide To Memorable Tech Talks\n\n\nImagine this. You’re a woman in a male-dominated field. English is not your first language. Even though you’re confident in your engineering work, the thought of public speaking and being recorded for the world to see absolutely terrifies you.\nThat was me, five years ago. Since then, I’ve moved into a successful career in Developer Advocacy and spoken at dozens of technical events in the U.S. and worldwide.\nI think everyone has the ability to deliver stellar conference talks, which is why I took the time to write this post.\n\n\n\nThe Ultimate Guide\n1: Introduction\n2: Choosing a Topic\n3: Writing a Conference Proposal (or CFP)\n4: Tools of the Trade\n5: Planning and Time Estimation\n6: Writing a Talk\n7: Practice and Delivery\n\n\n\n\n###Light-weight Contexts: An OS Abstraction for Safety and Performance (2016)\n\n\nAbstract: “We introduce a new OS abstraction—light-weight con-texts (lwCs)—that provides independent units of protection, privilege, and execution state within a process. A process may include several lwCs, each with possibly different views of memory, file descriptors, and access capabilities. lwCs can be used to efficiently implement roll-back (process can return to a prior recorded state),isolated address spaces (lwCs within the process may have different views of memory, e.g., isolating sensitive data from network-facing components or isolating different user sessions), and privilege separation (in-process reference monitors can arbitrate and control access).\nlwCs can be implemented efficiently: the overhead of a lwC is proportional to the amount of memory exclusive to the lwC; switching lwCs is quicker than switching kernel threads within the same process. We describe the lwC abstraction and API, and an implementation of lwCs within the FreeBSD 11.0 kernel. Finally, we present an evaluation of common usage patterns, including fast roll-back, session isolation, sensitive data isolation, and in-process reference monitoring, using Apache, nginx, PHP,and OpenSSL.”\n\n\n\n\n##Beastie Bits\n\n\nMay 7th - BSD Users Stockholm Meetup #6 \nsysutils/docker-freebsd: Searching for people to help\nCat Tax - Ever wonder what Midnight the cat was like?\nFixing Unix/Linux/POSIX Filenames\nMetasploit on OpenBSD\nRun Your @wn Email Server! with NetBSD\nrdist(1)\nWriting a Book with Unix\n7 Unix Commands Every Data Scientist Should Know\nExplaining Code using ASCII Art\nFreeBSD Aberdeen Hackathon\nFreeBSD Vienna Hackathon\n\n\n\n\n##Feedback/Questions\n\n\n\nMike - FreeBSD Update and Erased EFI files\n\n\nCharles - Volunteer work\n\n\nJake - Bhyve Front Ends\n\n\nWe’ve hit that point where we are running low on your questions, so if you have any questions rolling around in your head that you’ve not thought of to ask yet… send them in!\n\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.</p>\n\n<p>##Headlines</p>\n\n<p>###<a href=\"https://news.gandi.net/en/2019/03/tracking-a-storage-issue-led-to-software-change/\">Tracking a storage issue led to software change</a></p>\n\n<blockquote>\n<p>Early last year we completed a massive migration that moved our customers’ hosting data off of a legacy datacenter (that we called FR-SD2) onto several new datacenters (that we call FR-SD3, FR-SD5, and FR-SD6) with much more modern, up-to-date infrastructure.<br>\nThis migration required several changes in both the software and hardware we use, including switching the operating system on our storage units to FreeBSD.<br>\nCurrently, we use the NFS protocol to provide storage and export the filesystems on Simple Hosting, our web hosting service, and the FreeBSD kernel includes an NFS server for just this purpose.</p>\n</blockquote>\n\n<ul>\n<li>Problem</li>\n</ul>\n\n<blockquote>\n<p>While migrating virtual disks of Simple Hosting instances from FR-SD2, we noticed high CPU load spikes on the new storage units.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.softwaredevelopment.site/2019/02/what-makes-unix-special.html\">What Makes Unix Special</a></p>\n\n<blockquote>\n<p>Ever since Unix burst onto the scene within the early '70s, observers within the pc world have been fast to put in writing it off as a unusual working system designed by and for knowledgeable programmers. Regardless of their proclamations, Unix refuses to die. Means again in 1985, Stewart Cheifet puzzled if Unix would turn out to be the usual working system of the longer term on the PBS present “The Laptop Chronicles,” though MS-DOS was effectively in its heyday. In 2018, it is clear that Unix actually is the usual working system, not on desktop PCs, however on smartphones and tablets.</p>\n</blockquote>\n\n<ul>\n<li>What Makes Unix Special?</li>\n</ul>\n\n<blockquote>\n<p>It is also the usual system for net servers. The actual fact is, hundreds of thousands of individuals all over the world have interacted with Linux and Unix programs daily, most of whom have by no means written a line of code of their lives.<br>\nSo what makes Unix so beloved by programmers and different techie sorts? Let’s check out a few of issues this working system has going for it. (For some background on Unix, try The Historical past of Unix: From Bell Labs to the iPhone.)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://nanxiao.me/en/what-you-need-may-be-pipeline-unix-commands-only/\">What you need may be “pipeline +Unix commands” only</a></p>\n\n<blockquote>\n<p>I came across Taco Bell Programming recently, and think this article is worthy to read for every software engineer. The post mentions a scenario which you may consider to use Hadoop to solve but actually xargs may be a simpler and better choice. This reminds me a similar experience: last year a client wanted me to process a data file which has 5 million records. After some investigations, no novel technologies, a concise awk script (less than 10 lines) worked like a charm! What surprised me more is that awk is just a single-thread program, no nifty concurrency involved.<br>\nThe IT field never lacks “new” technologies: cloud computing, big data, high concurrency, etc. However, the thinkings behind these “fancy” words may date back to the era when Unix arose. Unix command line tools are invaluable treasure. In many cases, picking the right components and using pipeline to glue them can satisfy your requirement perfectly. So spending some time in reviewing Unixcommand line manual instead of chasing state-of-the-art techniques exhaustedly, you may gain more.<br>\nBTW, if your data set can be disposed by an awk script, it should not be called “big data”.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"http://widgetsandshit.com/teddziuba/2010/10/taco-bell-programming.html\">Taco Bell Programming</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://bofh.org.uk/2019/02/25/baking-with-emacs/\">Running a bakery on Emacs and PostgreSQL</a></p>\n\n<blockquote>\n<p>Just over a year ago now, I finally opened the bakery I’d been dreaming of for years. It’s been a big change in my life, from spending all my time sat in front of a computer, to spending most of it making actual stuff. And stuff that makes people happy, at that. It’s been a huge change, but I can’t think of a single job change that’s ever made me as happy as this one.<br>\nOne of the big changes that came with going pro was that suddenly I was having to work out how much stuff I needed to mix to fill the orders I needed. On the face of it, this is really simple, just work out how much dough you need, then work out what quantities to mix to make that much dough. Easy. You can do it with a pencil and paper. Or, in traditional bakers’ fashion, by scrawling with your finger on a floured work bench.<br>\nAnd that’s how I coped for a few weeks early on. But I kept making mistakes, which makes for an inconsistent product (bread is very forgiving, you have to work quite hard to make something that isn’t bread, but consistency matters). I needed to automate.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://medium.com/@nnja/the-ultimate-guide-to-memorable-tech-talks-e7c350778d4b\">The Ultimate Guide To Memorable Tech Talks</a></p>\n\n<blockquote>\n<p>Imagine this. You’re a woman in a male-dominated field. English is not your first language. Even though you’re confident in your engineering work, the thought of public speaking and being recorded for the world to see absolutely terrifies you.<br>\nThat was me, five years ago. Since then, I’ve moved into a successful career in Developer Advocacy and spoken at dozens of technical events in the U.S. and worldwide.<br>\nI think everyone has the ability to deliver stellar conference talks, which is why I took the time to write this post.</p>\n</blockquote>\n\n<ul>\n<li>The Ultimate Guide</li>\n<li>1: Introduction</li>\n<li>2: Choosing a Topic</li>\n<li>3: Writing a Conference Proposal (or CFP)</li>\n<li>4: Tools of the Trade</li>\n<li>5: Planning and Time Estimation</li>\n<li>6: Writing a Talk</li>\n<li>7: Practice and Delivery</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://people.mpi-sws.org/~druschel/publications/osdi16.pdf\">Light-weight Contexts: An OS Abstraction for Safety and Performance (2016)</a></p>\n\n<blockquote>\n<p>Abstract: “We introduce a new OS abstraction—light-weight con-texts (lwCs)—that provides independent units of protection, privilege, and execution state within a process. A process may include several lwCs, each with possibly different views of memory, file descriptors, and access capabilities. lwCs can be used to efficiently implement roll-back (process can return to a prior recorded state),isolated address spaces (lwCs within the process may have different views of memory, e.g., isolating sensitive data from network-facing components or isolating different user sessions), and privilege separation (in-process reference monitors can arbitrate and control access).<br>\nlwCs can be implemented efficiently: the overhead of a lwC is proportional to the amount of memory exclusive to the lwC; switching lwCs is quicker than switching kernel threads within the same process. We describe the lwC abstraction and API, and an implementation of lwCs within the FreeBSD 11.0 kernel. Finally, we present an evaluation of common usage patterns, including fast roll-back, session isolation, sensitive data isolation, and in-process reference monitoring, using Apache, nginx, PHP,and OpenSSL.”</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/259528492/\">May 7th - BSD Users Stockholm Meetup #6 </a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-virtualization/2019-February/007218.html\">sysutils/docker-freebsd: Searching for people to help</a></li>\n<li><a href=\"https://twitter.com/midnightbsd/status/1104018684748677122\">Cat Tax - Ever wonder what Midnight the cat was like?</a></li>\n<li><a href=\"https://dwheeler.com/essays/fixing-unix-linux-filenames.html\">Fixing Unix/Linux/POSIX Filenames</a></li>\n<li><a href=\"https://chargen.one/h3artbl33d/metasploit-on-openbsd\">Metasploit on OpenBSD</a></li>\n<li><a href=\"https://schmonz.com/2019/01/25/devopsdays-nyc-run-your-own-email-server/slides/#1\">Run Your @wn Email Server! with NetBSD</a></li>\n<li><a href=\"http://johan.huldtgren.com/posts/2019/rdist\">rdist(1)</a></li>\n<li><a href=\"https://joecmarshall.com/posts/book-writing-environment/\">Writing a Book with Unix</a></li>\n<li><a href=\"https://neowaylabs.github.io/programming/unix-shell-for-data-scientists/\">7 Unix Commands Every Data Scientist Should Know</a></li>\n<li><a href=\"https://blog.regehr.org/archives/1653\">Explaining Code using ASCII Art</a></li>\n<li><a href=\"https://wiki.freebsd.org/Hackathon/201904\">FreeBSD Aberdeen Hackathon</a></li>\n<li><a href=\"https://wiki.freebsd.org/Hackathon/201906\">FreeBSD Vienna Hackathon</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>\n<p>Mike - <a href=\"http://dpaste.com/2405MF1#wrap\">FreeBSD Update and Erased EFI files</a></p>\n</li>\n<li>\n<p>Charles - <a href=\"http://dpaste.com/2WFTXR2#wrap\">Volunteer work</a></p>\n</li>\n<li>\n<p>Jake - <a href=\"http://dpaste.com/1AA6C55\">Bhyve Front Ends</a></p>\n</li>\n<li>\n<p>We’ve hit that point where we are running low on your questions, so if you have any questions rolling around in your head that you’ve not thought of to ask yet… send them in!</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0291.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Storage changing software, what makes Unix special, what you need may be “pipeline +Unix commands”, running a bakery on Emacs and PostgreSQL, the ultimate guide to memorable tech talks, light-weight contexts, and more.","date_published":"2019-03-28T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/54559ca9-f84f-4e9e-8323-3a5a0919937f.mp3","mime_type":"audio/mp3","size_in_bytes":43826319,"duration_in_seconds":4364}]},{"id":"75bc6dda-ec5d-45fe-adf3-2afde9a7f099","title":"290: Timestamped Notes","url":"https://www.bsdnow.tv/290","content_text":"FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.\n\n##Headlines\n###ARM’d and dangerous: FreeBSD on Cavium ThunderX (aarch64)\n\n\nWhile I don’t remember for how many years I’ve had an interest in CPU architectures that could be an alternative to AMD64, I know pretty well when I started proposing to test 64-bit ARM at work. It was shortly after the disaster named Spectre / Meltdown that I first dug out server-class ARM hardware and asked whether we should get one such server and run some tests with it.\nWhile the answer wasn’t a clear “no” it also wasn’t exactly “yes”. I tried again a few times over the course of 2018 and each time I presented some more points why I thought it might be a good thing to test this. But still I wasn’t able to get a positive answer. Finally in January 2019 year I got a definitive answer – and it was “yes, go ahead”! The fact that Amazon had just presented their Graviton ARM Processor may have helped the decision.\n\n\n\n\n###Looking at NetBSD from an OpenBSD user perspective\n\n\nI use to use NetBSD quite a lot. From 2.0 to 6.99. But for some reasons, I stopped using it about 2012, in favor of OpenBSD. Reading on the new 8 release, I wanted to see if all the things I didn’t like on NetBSD were gone. Here is a personal Pros / Cons list. No Troll, hopefully. Just trying to be objective.\n\n\n\nWhat I liked (pros)\nThings I didn’t like (cons)\nConclusion\n\n\n\nSo that was it. I didn’t spend more than 30 minutes of it. But I didn’t want to spend more time on it. I did stop using NetBSD because of the need to compile each and every packages ; it was in the early days of pkgin. I also didn’t like the way system maintenance was to be done. OpenBSD’s 6-months release seemed far more easy to manage. I still think NetBSD is a great OS. But I believe you have to spent more time on it than you would have to do with OpenBSD.\nThat said, I’ll keep using my Puffy OS.\n\n\n\n\n##News Roundup\n###Using Vim to take time-stamped notes\n\n\nI frequently find myself needing to take time-stamped notes. Specifically, I’ll be in a call, meeting, or interview and need to take notes that show how long it’s been since the meeting started.\nMy first thought was that there’s be a plugin to add time stamps, but a quick search didn’t turn anything up. However, I little digging did turn up the fact that vim has the built-in ability to tell time.\nThis means that writing a bit of vimscript to insert a time stamp is pretty easy. After a bit of fiddling, I came up with something that serves my needs, and I decided it might be useful enough to others to be worth sharing.\n\n\n\nJohn Baldwin’s notes on bhyve meetings\n\n\n\n\n###OpenBSD 6.5-beta has been tagged\n\n\nIt’s that time of year again; Theo (deraadt@) has just tagged 6.5-beta. A good reminder for us all run an extra test install and see if your favorite port still works as you expect.\n\n\nCVSROOT: /cvs\nModule name: src\nChanges by: deraadt@cvs.openbsd.org 2019/02/26 15:24:41\n\nModified files:\netc/root : root.mail\nshare/mk : sys.mk\nsys/conf : newvers.sh\nsys/sys : ktrace.h param.h\nusr.bin/signify: signify.1\nsys/arch/macppc/stand/tbxidata: bsd.tbxi\n\nLog message:\ncrank to 6.5-beta\n\n\n\n\n###The NetBSD Foundation participating in Google Summer of Code 2019\n\n\nFor the 4th year in a row and for the 13th time The NetBSD Foundation will participate in Google Summer of Code 2019!\nIf you are a student and would like to learn more about Google Summer of Code please go to the Google Summer of Code homepage.\nYou can find a list of projects in Google Summer of Code project proposals in the wiki.\nDo not hesitate to get in touch with us via #netbsd-code IRC channel on Freenode and via NetBSD mailing lists!\n\n\n\n\n###SecBSD: an UNIX-like OS for Hackers\n\n\nSecBSD is an UNIX-like operating system focused on computer security based on OpenBSD. Designed for security testing, hacking and vulnerability assessment, it uses full disk encryption and ProtonVPN + OpenVPN by default.\nA security BSD enviroment for security researchers, penetration testers, bug hunters and cybersecurity experts. Developed by Dark Intelligence Team for private use and will be public release coming soon.\n\n\n\n\n##Beastie Bits\n\n\nWhy OpenBSD Rocks\nRich’s sh (POSIX shell) tricks\nDrinking coffee with AWK\nCivilisational HTTP Error Codes\nMidnightBSD Roadmap\nNetBSD on Nintendo64\nFrom Vimperator to Tridactyl\n\n\n\n\n##Feedback/Questions\n\n\nRussell - BSD Now Question :: ZFS &amp; FreeNAS\nAlan - Tutorial, install ARM *BSD with no other BSD box pls\nJohnny - New section to add to the show\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://eerielinux.wordpress.com/2019/02/25/armd-and-dangerous-freebsd-on-cavium-thunderx-aarch64/\">ARM’d and dangerous: FreeBSD on Cavium ThunderX (aarch64)</a></p>\n\n<blockquote>\n<p>While I don’t remember for how many years I’ve had an interest in CPU architectures that could be an alternative to AMD64, I know pretty well when I started proposing to test 64-bit ARM at work. It was shortly after the disaster named Spectre / Meltdown that I first dug out server-class ARM hardware and asked whether we should get one such server and run some tests with it.<br>\nWhile the answer wasn’t a clear “no” it also wasn’t exactly “yes”. I tried again a few times over the course of 2018 and each time I presented some more points why I thought it might be a good thing to test this. But still I wasn’t able to get a positive answer. Finally in January 2019 year I got a definitive answer – and it was “yes, go ahead”! The fact that Amazon had just presented their Graviton ARM Processor may have helped the decision.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.tumfatig.net/20190301/looking-at-netbsd-from-an-openbsd-user-perspective/\">Looking at NetBSD from an OpenBSD user perspective</a></p>\n\n<blockquote>\n<p>I use to use NetBSD quite a lot. From 2.0 to 6.99. But for some reasons, I stopped using it about 2012, in favor of OpenBSD. Reading on the new 8 release, I wanted to see if all the things I didn’t like on NetBSD were gone. Here is a personal Pros / Cons list. No Troll, hopefully. Just trying to be objective.</p>\n</blockquote>\n\n<ul>\n<li>What I liked (pros)</li>\n<li>Things I didn’t like (cons)</li>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>So that was it. I didn’t spend more than 30 minutes of it. But I didn’t want to spend more time on it. I did stop using NetBSD because of the need to compile each and every packages ; it was in the early days of pkgin. I also didn’t like the way system maintenance was to be done. OpenBSD’s 6-months release seemed far more easy to manage. I still think NetBSD is a great OS. But I believe you have to spent more time on it than you would have to do with OpenBSD.<br>\nThat said, I’ll keep using my Puffy OS.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://www.codesections.com/blog/vim-timestamped/\">Using Vim to take time-stamped notes</a></p>\n\n<blockquote>\n<p>I frequently find myself needing to take time-stamped notes. Specifically, I’ll be in a call, meeting, or interview and need to take notes that show how long it’s been since the meeting started.<br>\nMy first thought was that there’s be a plugin to add time stamps, but a quick search didn’t turn anything up. However, I little digging did turn up the fact that vim has the built-in ability to tell time.<br>\nThis means that writing a bit of vimscript to insert a time stamp is pretty easy. After a bit of fiddling, I came up with something that serves my needs, and I decided it might be useful enough to others to be worth sharing.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://github.com/bsdjhb/meetings\">John Baldwin’s notes on bhyve meetings</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.undeadly.org/cgi?action=article;sid=20190228062751\">OpenBSD 6.5-beta has been tagged</a></p>\n\n<blockquote>\n<p>It’s that time of year again; Theo (deraadt@) has just tagged 6.5-beta. A good reminder for us all run an extra test install and see if your favorite port still works as you expect.</p>\n</blockquote>\n\n<p><code>CVSROOT: /cvs</code><br>\n<code>Module name: src</code><br>\n<code>Changes by: deraadt@cvs.openbsd.org 2019/02/26 15:24:41</code><br>\n<code></code><br>\n<code>Modified files:</code><br>\n<code>etc/root : root.mail</code><br>\n<code>share/mk : sys.mk</code><br>\n<code>sys/conf : newvers.sh</code><br>\n<code>sys/sys : ktrace.h param.h</code><br>\n<code>usr.bin/signify: signify.1</code><br>\n<code>sys/arch/macppc/stand/tbxidata: bsd.tbxi</code><br>\n<code></code><br>\n<code>Log message:</code><br>\n<code>crank to 6.5-beta</code><br>\n<code></code></p>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/the_netbsd_foundation_participating_in\">The NetBSD Foundation participating in Google Summer of Code 2019</a></p>\n\n<blockquote>\n<p>For the 4th year in a row and for the 13th time The NetBSD Foundation will participate in Google Summer of Code 2019!<br>\nIf you are a student and would like to learn more about Google Summer of Code please go to the Google Summer of Code homepage.<br>\nYou can find a list of projects in Google Summer of Code project proposals in the wiki.<br>\nDo not hesitate to get in touch with us via #netbsd-code IRC channel on Freenode and via NetBSD mailing lists!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://discoverbsd.com/p/d83c2c66dc\">SecBSD: an UNIX-like OS for Hackers</a></p>\n\n<blockquote>\n<p>SecBSD is an UNIX-like operating system focused on computer security based on OpenBSD. Designed for security testing, hacking and vulnerability assessment, it uses full disk encryption and ProtonVPN + OpenVPN by default.<br>\nA security BSD enviroment for security researchers, penetration testers, bug hunters and cybersecurity experts. Developed by Dark Intelligence Team for private use and will be public release coming soon.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://why-openbsd.rocks/fact/\">Why OpenBSD Rocks</a></li>\n<li><a href=\"http://www.etalabs.net/sh_tricks.html\">Rich’s sh (POSIX shell) tricks</a></li>\n<li><a href=\"https://opensource.com/article/19/2/drinking-coffee-awk\">Drinking coffee with AWK</a></li>\n<li><a href=\"https://github.com/AMEE/8XX-rfc\">Civilisational HTTP Error Codes</a></li>\n<li><a href=\"https://www.midnightbsd.org/news/\">MidnightBSD Roadmap</a></li>\n<li><a href=\"https://gist.github.com/murachue/531ed3ca201ab4155d22442272d92ed2#file-201902140007-txt\">NetBSD on Nintendo64</a></li>\n<li><a href=\"https://nullprogram.com/blog/2018/09/20/\">From Vimperator to Tridactyl</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Russell - <a href=\"http://dpaste.com/3QRYM70#wrap\">BSD Now Question :: ZFS &amp; FreeNAS</a></li>\n<li>Alan - <a href=\"http://dpaste.com/1KQZPN6\">Tutorial, install ARM *BSD with no other BSD box pls</a></li>\n<li>Johnny - <a href=\"http://dpaste.com/2ZKRC2A\">New section to add to the show</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0290.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"FreeBSD on Cavium ThunderX, looking at NetBSD as an OpenBSD user, taking time-stamped notes in vim, OpenBSD 6.5 has been tagged, FreeBSD and NetBSD in GSoC 2019, SecBSD: an UNIX-like OS for Hackers, and more.","date_published":"2019-03-21T10:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/75bc6dda-ec5d-45fe-adf3-2afde9a7f099.mp3","mime_type":"audio/mp3","size_in_bytes":30199731,"duration_in_seconds":3001}]},{"id":"eb6d59df-4b39-453b-93ca-18a6934e4e16","title":"289: Microkernel Failure","url":"https://www.bsdnow.tv/289","content_text":"A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. \n\n##Headlines\n\n###A Kernel Of Failure -\nHow IBM bet big on the microkernel being the next big thing in operating systems back in the ’90s—and spent billions with little to show for it.\n\n\nToday in Tedium: In the early 1990s, we had no idea where the computer industry was going, what the next generation would look like, or even what the driving factor would be. All the developers back then knew is that the operating systems available in server rooms or on desktop computers simply weren’t good enough, and that the next generation needed to be better—a lot better. This was easier said than done, but this problem for some reason seemed to rack the brains of one company more than any other: IBM. Throughout the decade, the company was associated with more overwrought thinking about operating systems than any other, with little to show for it in the end. The problem? It might have gotten caught up in kernel madness. Today’s Tedium explains IBM’s odd operating system fixation, and the belly flops it created.\n\n\n\n\n###CVE-2019-5597IPv6 fragmentation vulnerability in OpenBSD Packet Filter\n\n\nPacket Filter is OpenBSD’s  service for filtering network traffic and performing Network Address Translation. Packet Filter is also capable of normalizing and conditioning TCP/IP traffic, as well as providing bandwidth control and packet prioritization.\nPacket Filter has been a part of the GENERIC kernel since OpenBSD 5.0.Because other BSD variants import part of OpenBSD code, Packet Filter is also shipped with at least the following distributions that are affected in a lesser extent:  FreeBSD, pfSense, OPNSense, Solaris.\n\n\n\nNote that other distributions may also contain Packet Filter but due to the imported version they might not be vulnerable. This advisory covers the latest OpenBSD’s Packet Filter. For specific details about other distributions, please refer to the advisory of the affected product.\n\n\n\nKristof Provost, who maintains the port of pf in FreeBSD added a test for the vulnerability in FreeBSD head.\n\n\n\n\n##News Roundup\n###How I’m still not using GUIs in 2019: A guide to the terminal\n\n\nTL;DR: Here are my dotfiles. Use them and have fun.\n\n\n\nGUIs are bloatware. I’ve said it before. However, rather than just complaining about IDEs I’d like to provide an understandable guide to a much better alternative: the terminal.\nIDE stands for Integrated Development Environment. This might be an accurate term, but when it comes to a real integrated development environment, the terminal is a lot better.\nIn this post, I’ll walk you through everything you need to start making your terminal a complete development environment: how to edit text efficiently, configure its appearance, run and combine a myriad of programs, and dynamically create, resize and close tabs and windows.\n\n\n\nDon’t forget rule number one.\n\n\n\nWhenever in doubt, read the manual.\n\n\n\n\n###Using a Yubikey as smartcard for SSH public key authentication\n\n\nSSH is an awesome tool. Logging into other machines securely is so pervasive to us sysadmins nowadays that few of us think about what’s going on underneath. Even more so once you start using the more advanced features such as the ssh-agent, agent-forwarding and ProxyJump. When doing so, care must be taken in order to not compromise one’s logins or ssh keys.\nYou might have heard of Yubikeys.\nThese are USB authentication devices that support several different modes: they can be used for OTP (One Time Password) authentication, they can store OpenPGP keys, be a 2-factor authentication token and they can act as a SmartCard.\nIn OpenBSD, you can use them for Login (with login_yubikey(8)) with OTP since 2012, and there are many descriptions available(1) how to set this up.\n\n\n\n\n###The 18 Part FreeBSD Desktop Series by Vermaden\n\n\nFreeBSD Desktop – Part 1 – Simplified Boot\nFreeBSD Desktop – Part 2 – Install (FreeBSD 11)\nFreeBSD Desktop – Part 2.1 – Install FreeBSD 12\nFreeBSD Desktop – Part 3 – X11 Window System\nFreeBSD Desktop – Part 4 – Key Components – Window Manager\nFreeBSD Desktop – Part 5 – Key Components – Status Bar\nFreeBSD Desktop – Part 6 – Key Components – Task Bar\nFreeBSD Desktop – Part 7 – Key Components – Wallpaper Handling\nFreeBSD Desktop – Part 8 – Key Components – Application Launcher\nFreeBSD Desktop – Part 9 – Key Components – Keyboard/Mouse Shortcuts\nFreeBSD Desktop – Part 10 – Key Components – Locking Solution\nFreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress\nFreeBSD Desktop – Part 12 – Configuration – Openbox\nFreeBSD Desktop – Part 13 – Configuration – Dzen2\nFreeBSD Desktop – Part 14 – Configuration – Tint2\nFreeBSD Desktop – Part 15 – Configuration – Fonts &amp; Frameworks\nFreeBSD Desktop – Part 16 – Configuration – Pause Any Application\nFreeBSD Desktop – Part 17 – Automount Removable Media\n\n\n\n\n##Beastie Bits\n\n\nDrist with persistent SSH\nARPANET: Celebrating 50 Years Since “LO”\nTermtris - a tetris game for ANSI/VT220 terminals\nPoor Man’s CI - Hosted CI for BSD with shell scripting and duct tape\nWhy I use the IBM Model M keyboard that is older than me?\nA privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon\nGoogle-free Android Setup\nBSD Users Stockholm Meetup #6\n\n\n\n\n##Feedback/Questions\n\n\nSijmen - Hi, and a Sunday afternoon toy project\nClint - Tuning ZFS for NVME\nJames - Show question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. </p>\n\n<p>##Headlines</p>\n\n<p>###<a href=\"https://tedium.co/2019/02/28/ibm-workplace-os-taligent-history/\">A Kernel Of Failure -<br>\nHow IBM bet big on the microkernel being the next big thing in operating systems back in the ’90s—and spent billions with little to show for it.</a></p>\n\n<blockquote>\n<p>Today in Tedium: In the early 1990s, we had no idea where the computer industry was going, what the next generation would look like, or even what the driving factor would be. All the developers back then knew is that the operating systems available in server rooms or on desktop computers simply weren’t good enough, and that the next generation needed to be better—a lot better. This was easier said than done, but this problem for some reason seemed to rack the brains of one company more than any other: IBM. Throughout the decade, the company was associated with more overwrought thinking about operating systems than any other, with little to show for it in the end. The problem? It might have gotten caught up in kernel madness. Today’s Tedium explains IBM’s odd operating system fixation, and the belly flops it created.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.synacktiv.com/ressources/Synacktiv_OpenBSD_PacketFilter_CVE-2019-5597_ipv6_frag.pdf\">CVE-2019-5597IPv6 fragmentation vulnerability in OpenBSD Packet Filter</a></p>\n\n<blockquote>\n<p>Packet Filter is OpenBSD’s  service for filtering network traffic and performing Network Address Translation. Packet Filter is also capable of normalizing and conditioning TCP/IP traffic, as well as providing bandwidth control and packet prioritization.<br>\nPacket Filter has been a part of the GENERIC kernel since OpenBSD 5.0.Because other BSD variants import part of OpenBSD code, Packet Filter is also shipped with at least the following distributions that are affected in a lesser extent:  FreeBSD, pfSense, OPNSense, Solaris.</p>\n</blockquote>\n\n<blockquote>\n<p>Note that other distributions may also contain Packet Filter but due to the imported version they might not be vulnerable. This advisory covers the latest OpenBSD’s Packet Filter. For specific details about other distributions, please refer to the advisory of the affected product.</p>\n</blockquote>\n\n<ul>\n<li>Kristof Provost, who maintains the port of pf in FreeBSD added a <a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=344793\">test for the vulnerability in FreeBSD head</a>.</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://www.lucasfcosta.com/2019/02/10/terminal-guide-2019.html\">How I’m still not using GUIs in 2019: A guide to the terminal</a></p>\n\n<blockquote>\n<p>TL;DR: Here are my dotfiles. Use them and have fun.</p>\n</blockquote>\n\n<blockquote>\n<p>GUIs are bloatware. I’ve said it before. However, rather than just complaining about IDEs I’d like to provide an understandable guide to a much better alternative: the terminal.<br>\nIDE stands for Integrated Development Environment. This might be an accurate term, but when it comes to a real integrated development environment, the terminal is a lot better.<br>\nIn this post, I’ll walk you through everything you need to start making your terminal a complete development environment: how to edit text efficiently, configure its appearance, run and combine a myriad of programs, and dynamically create, resize and close tabs and windows.</p>\n</blockquote>\n\n<ul>\n<li>Don’t forget rule number one.</li>\n</ul>\n\n<blockquote>\n<p>Whenever in doubt, read the manual.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://undeadly.org/cgi?action=article;sid=20190302235509\">Using a Yubikey as smartcard for SSH public key authentication</a></p>\n\n<blockquote>\n<p>SSH is an awesome tool. Logging into other machines securely is so pervasive to us sysadmins nowadays that few of us think about what’s going on underneath. Even more so once you start using the more advanced features such as the ssh-agent, agent-forwarding and ProxyJump. When doing so, care must be taken in order to not compromise one’s logins or ssh keys.<br>\nYou might have heard of Yubikeys.<br>\nThese are USB authentication devices that support several different modes: they can be used for OTP (One Time Password) authentication, they can store OpenPGP keys, be a 2-factor authentication token and they can act as a SmartCard.<br>\nIn OpenBSD, you can use them for Login (with login_yubikey(8)) with OTP since 2012, and there are many descriptions available(1) how to set this up.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###The 18 Part FreeBSD Desktop Series by Vermaden</p>\n\n<ul>\n<li><a href=\"https://vermaden.wordpress.com/2018/03/29/freebsd-desktop-part-1-simplified-boot/\">FreeBSD Desktop – Part 1 – Simplified Boot</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/04/11/freebsd-desktop-part-2-install/\">FreeBSD Desktop – Part 2 – Install (FreeBSD 11)</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/11/20/freebsd-desktop-part-2-1-install-freebsd-12/\">FreeBSD Desktop – Part 2.1 – Install FreeBSD 12</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/05/22/freebsd-desktop-part-3-x11-window-system/\">FreeBSD Desktop – Part 3 – X11 Window System</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/15/freebsd-desktop-part-4-key-components-window-manager/\">FreeBSD Desktop – Part 4 – Key Components – Window Manager</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/16/freebsd-desktop-part-5-key-components-status-bar/\">FreeBSD Desktop – Part 5 – Key Components – Status Bar</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-6-key-components-task-bar/\">FreeBSD Desktop – Part 6 – Key Components – Task Bar</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-7-key-components-wallpaper-handling/\">FreeBSD Desktop – Part 7 – Key Components – Wallpaper Handling</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/21/freebsd-desktop-part-8-key-components-application-launcher/\">FreeBSD Desktop – Part 8 – Key Components – Application Launcher</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/22/freebsd-desktop-part-9-key-components-keyboard-mouse-shortcuts/\">FreeBSD Desktop – Part 9 – Key Components – Keyboard/Mouse Shortcuts</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/23/freebsd-desktop-part-10-key-components-locking-solution/\">FreeBSD Desktop – Part 10 – Key Components – Locking Solution</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/06/28/freebsd-desktop-part-11-key-components-blue-light-spectrum-suppress/\">FreeBSD Desktop – Part 11 – Key Components – Blue Light Spectrum Suppress</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/07/01/freebsd-desktop-part-12-configuration-openbox/\">FreeBSD Desktop – Part 12 – Configuration – Openbox</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/07/05/freebsd-desktop-part-13-configuration-dzen2/\">FreeBSD Desktop – Part 13 – Configuration – Dzen2</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/07/11/freebsd-desktop-part-14-configuration-tint2/\">FreeBSD Desktop – Part 14 – Configuration – Tint2</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/08/18/freebsd-desktop-part-15-configuration-fonts-frameworks/\">FreeBSD Desktop – Part 15 – Configuration – Fonts &amp; Frameworks</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/09/19/freebsd-desktop-part-16-configuration-pause-any-application/\">FreeBSD Desktop – Part 16 – Configuration – Pause Any Application</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/10/11/freebsd-desktop-part-17-automount-removable-media/\">FreeBSD Desktop – Part 17 – Automount Removable Media</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://dataswamp.org/~solene/2019-02-18-drist-1.04.html\">Drist with persistent SSH</a></li>\n<li><a href=\"https://meetings.aaas.org/arpanet-livestream/\">ARPANET: Celebrating 50 Years Since “LO”</a></li>\n<li><a href=\"http://nuclear.mutantstargoat.com/sw/termtris/\">Termtris - a tetris game for ANSI/VT220 terminals</a></li>\n<li><a href=\"https://github.com/billziss-gh/pmci\">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></li>\n<li><a href=\"http://yeokhengmeng.com/2018/07/why-i-use-the-ibm-model-m-keyboard-that-is-older-than-me/\">Why I use the IBM Model M keyboard that is older than me?</a></li>\n<li><a href=\"https://www.openbsd.org/papers/florian_slaacd_bsdcan2018.pdf\">A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon</a></li>\n<li><a href=\"https://niftylettuce.com/posts/google-free-android-setup/#google-free-android-setup\">Google-free Android Setup</a></li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/259528492/\">BSD Users Stockholm Meetup #6</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Sijmen - <a href=\"http://dpaste.com/1K3ZXB2#wrap\">Hi, and a Sunday afternoon toy project</a></li>\n<li>Clint - <a href=\"http://dpaste.com/24QF6J1\">Tuning ZFS for NVME</a></li>\n<li>James - <a href=\"http://dpaste.com/04SDXH9\">Show question</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0289.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"A kernel of failure, IPv6 fragmentation vulnerability in OpenBSD’s pf, a guide to the terminal, using a Yubikey for SSH public key authentication, FreeBSD desktop series, and more. ","date_published":"2019-03-14T19:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/eb6d59df-4b39-453b-93ca-18a6934e4e16.mp3","mime_type":"audio/mp3","size_in_bytes":36815600,"duration_in_seconds":3663}]},{"id":"be2ff33e-e797-4fb6-9448-c715d7068e66","title":"288: Turing Complete Sed","url":"https://www.bsdnow.tv/288","content_text":"Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.\n\n##Headlines\n###Google: Software is never going to be able to fix Spectre-type bugs\n\n\nSpectre is here to stay: An analysis of side-channels and speculative execution\n\n\n\nResearchers from Google investigating the scope and impact of the Spectre attack have published a paper asserting that Spectre-like vulnerabilities are likely to be a continued feature of processors and, further, that software-based techniques for protecting against them will impose a high performance cost. And whatever the cost, the researchers continue, the software will be inadequate—some Spectre flaws don’t appear to have any effective software-based defense. As such, Spectre is going to be a continued feature of the computing landscape, with no straightforward resolution.\nThe discovery and development of the Meltdown and Spectre attacks was undoubtedly the big security story of 2018. First revealed last January, new variants and related discoveries were made throughout the rest of the year. Both attacks rely on discrepancies between the theoretical architectural behavior of a processor—the documented behavior that programmers depend on and write their programs against—and the real behavior of implementations.\nSpecifically, modern processors all perform speculative execution; they make assumptions about, for example, a value being read from memory or whether an if condition is true or false, and they allow their execution to run ahead based on these assumptions. If the assumptions are correct, the speculated results are kept; if it isn’t, the speculated results are discarded and the processor redoes the calculation. Speculative execution is not an architectural feature of the processor; it’s a feature of implementations, and so it’s supposed to be entirely invisible to running programs. When the processor discards the bad speculation, it should be as if the speculation never even happened.\n\n\n\n\n###A proof that Unix utility sed is Turing complete\n\n\nMany people are surprised when they hear that sed is Turing complete. How come a text filtering program is Turing complete, they wonder. Turns out sed is a tiny assembly language that has a comparison operation, a branching operation and a temporary buffer. These operations make sed Turing complete.\nI first learned about this from Christophe Blaess. His proof is by construction – he wrote a Turing machine in sed (download turing.sed). As any programming language that can implement a Turing machine is Turing complete we must conclude that sed is also Turing complete.\nChristophe offers his own introduction to Turing machines and a description of how his sed implementation works in his article Implementation of a Turing Machine as a sed Script.\n\n\n\nChristophe isn’t the first person to realize that sed is almost a general purpose programming language. People have written tetris, sokoban and many other programs in sed. Take a look at these:\n\n\n\nTetris\nSokoban (game)\nCalculator\n\n\n\n\n##News Roundup\n###Bastille helps you quickly create and manage FreeBSD Jails.\n\n\nBastille helps you quickly create and manage FreeBSD Jails.\nJails are extremely lightweight containers that provide a full-featured UNIX-like operating system inside. These containers can be used for software development, rapid testing, and secure production Internet services.\nBastille provides an interface to create, manage and destroy these secure virtualized environments.\n\n\n\nCurrent version: 0.3.20190204-beta.\nShell Script Source here: https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille\n\n\n\n\n###netdata v1.12 released\n\n\nNetdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.\nNetdata provides unparalleled insights, in real-time, of everything happening on the systems it runs (including web servers, databases, applications), using highly interactive web dashboards. It can run autonomously, without any third party components, or it can be integrated to existing monitoring tool chains (Prometheus, Graphite, OpenTSDB, Kafka, Grafana, etc).\nNetdata is fast and efficient, designed to permanently run on all systems (physical &amp; virtual servers, containers, IoT devices), without disrupting their core function.\n\n\n\nPatch release 1.12.1 contains 22 bug fixes and 8 improvements.\n\n\n\n\n###Using grep with /dev/null, an old Unix trick\n\n\nEvery so often I will find myself writing a grep invocation like this:\n\n\nfind .... -exec grep &lt;something&gt; /dev/null '{}' '+'\n\n\nThe peculiar presence of /dev/null here is an old Unix trick that is designed to force grep to always print out file names, even if your find only matches one file, by always insuring that grep has at least two files as arguments. You can wind up wanting to do the same thing with a direct use of grep if you’re not certain how many files your wildcard may match.\n\n\n\n\n###USING GMAIL WITH MUTT\n\n\nI recently switched to using mutt for email and while setting up mutt to use imap is pretty straightforward, this tutorial will also document some advanced concepts such as encrypting your account password and sending emails from a different From address.\nThis tutorial assumes that you have some familiarity with using mutt and have installed it with sidebar support (sudo apt-get install mutt-patched for the ubuntu folks) and are comfortable with editing your muttrc.\nIf you would just like to skip to the end, my mutt configuration file can be found here.\n\n\n\n\n##Beastie Bits\n\n\nAn Extensive UNIX Timeline\nGarbage.fm - OEF\nbrk() to sbrk()\nFred models, found again\nKafe: Can OS Kernels Forward Packets Fast Enough for Software Routers?\nARPANET: Celebrating 50 Years Since “LO”\n\n\n\n\n##Feedback/Questions\n\n\nPablo - Topic suggestion: FreeBSD on a Laptop as daily driver\nRon - ZFS on the fly compression and seek\nDave - two zpool, or not two zpool, that is the question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://arstechnica.com/gadgets/2019/02/google-software-is-never-going-to-be-able-to-fix-spectre-type-bugs/\">Google: Software is never going to be able to fix Spectre-type bugs</a></p>\n\n<ul>\n<li><a href=\"https://arxiv.org/pdf/1902.05178.pdf\">Spectre is here to stay: An analysis of side-channels and speculative execution</a></li>\n</ul>\n\n<blockquote>\n<p>Researchers from Google investigating the scope and impact of the Spectre attack have published a paper asserting that Spectre-like vulnerabilities are likely to be a continued feature of processors and, further, that software-based techniques for protecting against them will impose a high performance cost. And whatever the cost, the researchers continue, the software will be inadequate—some Spectre flaws don’t appear to have any effective software-based defense. As such, Spectre is going to be a continued feature of the computing landscape, with no straightforward resolution.<br>\nThe discovery and development of the Meltdown and Spectre attacks was undoubtedly the big security story of 2018. First revealed last January, new variants and related discoveries were made throughout the rest of the year. Both attacks rely on discrepancies between the theoretical architectural behavior of a processor—the documented behavior that programmers depend on and write their programs against—and the real behavior of implementations.<br>\nSpecifically, modern processors all perform speculative execution; they make assumptions about, for example, a value being read from memory or whether an if condition is true or false, and they allow their execution to run ahead based on these assumptions. If the assumptions are correct, the speculated results are kept; if it isn’t, the speculated results are discarded and the processor redoes the calculation. Speculative execution is not an architectural feature of the processor; it’s a feature of implementations, and so it’s supposed to be entirely invisible to running programs. When the processor discards the bad speculation, it should be as if the speculation never even happened.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://catonmat.net/proof-that-sed-is-turing-complete\">A proof that Unix utility sed is Turing complete</a></p>\n\n<blockquote>\n<p>Many people are surprised when they hear that sed is Turing complete. How come a text filtering program is Turing complete, they wonder. Turns out sed is a tiny assembly language that has a comparison operation, a branching operation and a temporary buffer. These operations make sed Turing complete.<br>\nI first learned about this from Christophe Blaess. His proof is by construction – he wrote a Turing machine in sed (download turing.sed). As any programming language that can implement a Turing machine is Turing complete we must conclude that sed is also Turing complete.<br>\nChristophe offers his own introduction to Turing machines and a description of how his sed implementation works in his article Implementation of a Turing Machine as a sed Script.</p>\n</blockquote>\n\n<blockquote>\n<p>Christophe isn’t the first person to realize that sed is almost a general purpose programming language. People have written tetris, sokoban and many other programs in sed. Take a look at these:</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://catonmat.net/ftp/sed/sedtris.sed\">Tetris</a></li>\n<li><a href=\"https://catonmat.net/ftp/sed/sokoban.sed\">Sokoban (game)</a></li>\n<li><a href=\"https://catonmat.net/ftp/sed/dc.sed\">Calculator</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://bastillebsd.org/\">Bastille helps you quickly create and manage FreeBSD Jails.</a></p>\n\n<blockquote>\n<p>Bastille helps you quickly create and manage FreeBSD Jails.<br>\nJails are extremely lightweight containers that provide a full-featured UNIX-like operating system inside. These containers can be used for software development, rapid testing, and secure production Internet services.<br>\nBastille provides an interface to create, manage and destroy these secure virtualized environments.</p>\n</blockquote>\n\n<ul>\n<li>Current version: 0.3.20190204-beta.</li>\n<li>Shell Script Source here: <a href=\"https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille\">https://github.com/BastilleBSD/bastille/blob/master/usr/local/bin/bastille</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://github.com/netdata/netdata/releases\">netdata v1.12 released</a></p>\n\n<blockquote>\n<p>Netdata is distributed, real-time, performance and health monitoring for systems and applications. It is a highly optimized monitoring agent you install on all your systems and containers.<br>\nNetdata provides unparalleled insights, in real-time, of everything happening on the systems it runs (including web servers, databases, applications), using highly interactive web dashboards. It can run autonomously, without any third party components, or it can be integrated to existing monitoring tool chains (Prometheus, Graphite, OpenTSDB, Kafka, Grafana, etc).<br>\nNetdata is fast and efficient, designed to permanently run on all systems (physical &amp; virtual servers, containers, IoT devices), without disrupting their core function.</p>\n</blockquote>\n\n<ul>\n<li>Patch release 1.12.1 contains 22 bug fixes and 8 improvements.</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/GrepDevNull\">Using grep with /dev/null, an old Unix trick</a></p>\n\n<blockquote>\n<p>Every so often I will find myself writing a grep invocation like this:</p>\n</blockquote>\n\n<p><code>find .... -exec grep &lt;something&gt; /dev/null '{}' '+'</code></p>\n\n<blockquote>\n<p>The peculiar presence of /dev/null here is an old Unix trick that is designed to force grep to always print out file names, even if your find only matches one file, by always insuring that grep has at least two files as arguments. You can wind up wanting to do the same thing with a direct use of grep if you’re not certain how many files your wildcard may match.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://smalldata.tech/blog/2016/09/10/gmail-with-mutt\">USING GMAIL WITH MUTT</a></p>\n\n<blockquote>\n<p>I recently switched to using mutt for email and while setting up mutt to use imap is pretty straightforward, this tutorial will also document some advanced concepts such as encrypting your account password and sending emails from a different From address.<br>\nThis tutorial assumes that you have some familiarity with using mutt and have installed it with sidebar support (sudo apt-get install mutt-patched for the ubuntu folks) and are comfortable with editing your muttrc.<br>\nIf you would just like to skip to the end, my mutt configuration file can be found <a href=\"https://github.com/wheresvic/vic-config/blob/master/mutt/muttrc\">here</a>.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.levenez.com/unix/\">An Extensive UNIX Timeline</a></li>\n<li><a href=\"https://garbage.fm/episodes/47\">Garbage.fm - OEF</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/02/22/22586.html\">brk() to sbrk()</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2019/02/20/22566.html\">Fred models, found again</a></li>\n<li><a href=\"https://ieeexplore.ieee.org/document/8541105\">Kafe: Can OS Kernels Forward Packets Fast Enough for Software Routers?</a></li>\n<li><a href=\"https://meetings.aaas.org/arpanet-livestream/\">ARPANET: Celebrating 50 Years Since “LO”</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Pablo - <a href=\"http://dpaste.com/2BXMP7M\">Topic suggestion: FreeBSD on a Laptop as daily driver</a></li>\n<li>Ron - <a href=\"http://dpaste.com/16Y2HSR#wrap\">ZFS on the fly compression and seek</a></li>\n<li>Dave - <a href=\"http://dpaste.com/123AANV#wrap\">two zpool, or not two zpool, that is the question</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0288.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Software will never fix Spectre-type bugs, a proof that sed is Turing complete, managed jails using Bastille, new version of netdata, using grep with /dev/null, using GMail with mutt, and more.","date_published":"2019-03-07T10:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/be2ff33e-e797-4fb6-9448-c715d7068e66.mp3","mime_type":"audio/mp3","size_in_bytes":35693457,"duration_in_seconds":3550}]},{"id":"e66ab35a-1745-4485-a2c3-142c6c471df0","title":"287: rc.d in NetBSD","url":"https://www.bsdnow.tv/287","content_text":"Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.\n\n##Headlines\n###The Design and Implementation of the NetBSD rc.d system\n\n\nAbstract\n\n\n\nIn this paper I cover the design and implementation of the rc.d system start-up mechanism in NetBSD 1.5, which replaced the monolithic /etc/rc start-up file inherited from 4.4BSD. Topics covered include a history of various UNIX start-up mechanisms (including NetBSD prior to 1.5), design considerations that evolved over six years of discussions, implementation details, an examination of the human issues that occurred during the design and implementation, as well as future directions for the system.\n\n\n\nIntroduction\n\n\n\nNetBSD recently converted from the traditional 4.4BSD monolithic /etc/rc start-up script to an /etc/rc.d mechanism, where there is a separate script to manage each service or daemon, and these scripts are executed in a specific order at system boot.\nThis paper covers the motivation, design and implementation of the rc.d system; from the history of what NetBSD had before to the system that NetBSD 1.5 shipped with in December 2000, as well as future directions.\nThe changes were contentious and generated some of the liveliest discussions about any feature change ever made in NetBSD. Parts of those discussions will be covered to provide insight into some of the design and implementation decisions.\n\n\n\nHistory\n\n\n\nThere is great diversity in the system start-up mechanisms used by various UNIX variants. A few of the more pertinent schemes are detailed below. As NetBSD is derived from 4.4BSD, it follows that a description of the latter’s method is relevant. Solaris’ start-up method is also detailed, as it is the most common System V UNIX variant.\n\n\n\n\n###First impressions of Project Trident 18.12\n\n\nProject Trident (hereafter referred to as Trident) is a desktop operating system based on TrueOS. Trident takes the rolling base platform of TrueOS, which is in turn based on FreeBSD’s development branch, and combines it with the Lumina desktop environment.\n\n\n+Installing\n\n\nThe debut release of Trident is available as a 4.1GB download that can be burned to a disc or transferred to a USB thumb drive. Booting from the Trident media brings up a graphical interface and automatically launches the project’s system installer. Down the left side of the display there are buttons we can click to show hardware information and configuration options. These buttons let us know if our wireless card and video card are compatible with Trident and give us a chance to change our preferred language and keyboard layout. At the bottom of the screen we find buttons that will open a terminal or shutdown the computer.\n\n\n\nEarly impressions\n\n\n\nTrident boots to a graphical login screen where we can sign into the Lumina desktop or a minimal Fluxbox session. Lumina, by default, uses Fluxbox as its window manager. The Lumina desktop places its panel along the bottom of the screen and an application menu sits in the bottom-left corner. On the desktop we find icons for opening the software manager, launching the Falkon web browser, running the VLC media player, opening the Control Panel and adjusting the Lumina theme.\nThe application menu has an unusual and compact layout. The menu shows just a search box and buttons for browsing applications, opening a file manager, accessing desktop settings and signing out. To see what applications are available we can click the Browse Applications entry, which opens a window in the menu where we can scroll through installed programs. This is a bit awkward since the display window is small and only shows a few items at a time.\nEarly on I found it is possible to swap out the default “Start menu” with an alternative “Application menu” through the Panels configuration tool. This alternative menu offers a classic tree-style application menu. I found the latter menu easier to navigate as it expands to show all the applications in a selected category.\n\n\n\nConclusions\n\n\n\nI have a lot of mixed feelings and impressions when it comes to Trident. On the one hand, the operating system has some great technology under the hook. It has cutting edge packages from the FreeBSD ecosystem, we have easy access to ZFS, boot environments, and lots of open source packages. Hardware support, at least on my physical workstation, was solid and the Lumina desktop is flexible.\n\n\n\n\n##News Roundup\n###PXE booting of a FreeBSD disk image\n\n\nI had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.\nFor information, all these steps were done using 2 PC Engines APU2 (upgraded with latest BIOS for iPXE support), so it’s a headless (serial port only, this can be IPMI SoL with different hardware) .\n\n\n\nTHE BIG PICTURE\n\n\n\nBefore explaining all steps and command line, here is the full big picture of the final process.\n\n\n\n\n###Why I like middle mouse button paste in xterm so much\n\n\nIn my entry about how touchpads are not mice, I mused that one of the things I should do on my laptop was insure that I had a keyboard binding for paste, since middle mouse button is one of the harder multi-finger gestures to land on a touchpad. Kurt Mosiejczuk recently left a comment there where they said:\nShift-Insert is a keyboard equivalent for paste that is in default xterm (at least OpenBSD xterm, and putty on Windows too). I use that most of the time now as it seems less… trigger-happy than right click paste.\nThis sparked some thoughts, because I can’t imagine giving up middle mouse paste if I have a real choice. I had earlier seen shift-insert mentioned in other commentary on my entry and so have tried a bit to use it on my laptop, and it hasn’t really felt great even there; on my desktops, it’s even less appealing (I tried shift-insert out there to confirm that it did work in my set of wacky X resources).\nIn thinking about why this is, I came to the obvious realization about why all of this is so. I like middle mouse button paste in normal usage because it’s so convenient, because almost all of the time my hand is already on the mouse. And the reason my hand is already on the mouse is because I’ve just used the mouse to shift focus to the window I want to paste into. Even on my laptop, my right hand is usually away from the keyboard as I move the mouse pointer on the touchpad, making shift-Insert at least somewhat awkward.\n\n\n\n\n###NetBSD Gains Hardware Accelerated Virtualization\n\n\nNetBSD Virtual Machine Monitor\n\n\n\nNVMM provides hardware-accelerated virtualization support for NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is shipped via libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.\n\n\n\n\n##Beastie Bits\n\n\nSoloBSD 19.02-STABLE\nProject Trident 18.12-U5 available\n“Sudo Mastery, Second Edition” and Cover Art\nMKSANITIZER - bug detector software integration with the NetBSD userland\nDarn kids nowadays… back in my day we drew rude symbols like normal people.  {{top two comments}}\nShellCheck\nfinds bugs in your shell scripts.\nOld School Sean - A history of UNIX\n\n\n\n\n##Feedback/Questions\n\n\nAles - OpenBSD, FreeNAS, OpenZFS questions\nMalcolm - Thoughts on Pgsql + ZFS thread?\nBrad - Boot Environments in FreeBSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.usenix.org/legacy/events/usenix01/freenix01/full_papers/mewburn/mewburn_html/index.html\">The Design and Implementation of the NetBSD rc.d system</a></p>\n\n<ul>\n<li>Abstract</li>\n</ul>\n\n<blockquote>\n<p>In this paper I cover the design and implementation of the rc.d system start-up mechanism in NetBSD 1.5, which replaced the monolithic /etc/rc start-up file inherited from 4.4BSD. Topics covered include a history of various UNIX start-up mechanisms (including NetBSD prior to 1.5), design considerations that evolved over six years of discussions, implementation details, an examination of the human issues that occurred during the design and implementation, as well as future directions for the system.</p>\n</blockquote>\n\n<ul>\n<li>Introduction</li>\n</ul>\n\n<blockquote>\n<p>NetBSD recently converted from the traditional 4.4BSD monolithic /etc/rc start-up script to an /etc/rc.d mechanism, where there is a separate script to manage each service or daemon, and these scripts are executed in a specific order at system boot.<br>\nThis paper covers the motivation, design and implementation of the rc.d system; from the history of what NetBSD had before to the system that NetBSD 1.5 shipped with in December 2000, as well as future directions.<br>\nThe changes were contentious and generated some of the liveliest discussions about any feature change ever made in NetBSD. Parts of those discussions will be covered to provide insight into some of the design and implementation decisions.</p>\n</blockquote>\n\n<ul>\n<li>History</li>\n</ul>\n\n<blockquote>\n<p>There is great diversity in the system start-up mechanisms used by various UNIX variants. A few of the more pertinent schemes are detailed below. As NetBSD is derived from 4.4BSD, it follows that a description of the latter’s method is relevant. Solaris’ start-up method is also detailed, as it is the most common System V UNIX variant.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://distrowatch.com/weekly.php?issue=20190211#trident\">First impressions of Project Trident 18.12</a></p>\n\n<blockquote>\n<p>Project Trident (hereafter referred to as Trident) is a desktop operating system based on TrueOS. Trident takes the rolling base platform of TrueOS, which is in turn based on FreeBSD’s development branch, and combines it with the Lumina desktop environment.</p>\n</blockquote>\n\n<p>+Installing</p>\n\n<blockquote>\n<p>The debut release of Trident is available as a 4.1GB download that can be burned to a disc or transferred to a USB thumb drive. Booting from the Trident media brings up a graphical interface and automatically launches the project’s system installer. Down the left side of the display there are buttons we can click to show hardware information and configuration options. These buttons let us know if our wireless card and video card are compatible with Trident and give us a chance to change our preferred language and keyboard layout. At the bottom of the screen we find buttons that will open a terminal or shutdown the computer.</p>\n</blockquote>\n\n<ul>\n<li>Early impressions</li>\n</ul>\n\n<blockquote>\n<p>Trident boots to a graphical login screen where we can sign into the Lumina desktop or a minimal Fluxbox session. Lumina, by default, uses Fluxbox as its window manager. The Lumina desktop places its panel along the bottom of the screen and an application menu sits in the bottom-left corner. On the desktop we find icons for opening the software manager, launching the Falkon web browser, running the VLC media player, opening the Control Panel and adjusting the Lumina theme.<br>\nThe application menu has an unusual and compact layout. The menu shows just a search box and buttons for browsing applications, opening a file manager, accessing desktop settings and signing out. To see what applications are available we can click the Browse Applications entry, which opens a window in the menu where we can scroll through installed programs. This is a bit awkward since the display window is small and only shows a few items at a time.<br>\nEarly on I found it is possible to swap out the default “Start menu” with an alternative “Application menu” through the Panels configuration tool. This alternative menu offers a classic tree-style application menu. I found the latter menu easier to navigate as it expands to show all the applications in a selected category.</p>\n</blockquote>\n\n<ul>\n<li>Conclusions</li>\n</ul>\n\n<blockquote>\n<p>I have a lot of mixed feelings and impressions when it comes to Trident. On the one hand, the operating system has some great technology under the hook. It has cutting edge packages from the FreeBSD ecosystem, we have easy access to ZFS, boot environments, and lots of open source packages. Hardware support, at least on my physical workstation, was solid and the Lumina desktop is flexible.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://blog.cochard.me/2019/02/pxe-booting-of-freebsd-disk-image.html\">PXE booting of a FreeBSD disk image</a></p>\n\n<blockquote>\n<p>I had to set up a regression and network performance lab. This lab will be managed by a Jenkins, but the first step is to understand how to boot a FreeBSD disk by PXE. This article explains a simple way of doing it.<br>\nFor information, all these steps were done using 2 PC Engines APU2 (upgraded with latest BIOS for iPXE support), so it’s a headless (serial port only, this can be IPMI SoL with different hardware) .</p>\n</blockquote>\n\n<ul>\n<li>THE BIG PICTURE</li>\n</ul>\n\n<blockquote>\n<p>Before explaining all steps and command line, here is the <a href=\"https://1.bp.blogspot.com/-SCUJAjowhYw/XG-b-qWGuXI/AAAAAAAAmXw/SVXHDC9hsMwZNB2P5glsZx0iFoCE9SAXQCLcBGAs/s1600/PXE%2Band%2BFreeBSD%2Bmfs%2Bimage.png\">full big picture</a> of the final process.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/MouseMovementAndPaste\">Why I like middle mouse button paste in xterm so much</a></p>\n\n<blockquote>\n<p>In my entry about how touchpads are not mice, I mused that one of the things I should do on my laptop was insure that I had a keyboard binding for paste, since middle mouse button is one of the harder multi-finger gestures to land on a touchpad. Kurt Mosiejczuk recently left a comment there where they said:<br>\nShift-Insert is a keyboard equivalent for paste that is in default xterm (at least OpenBSD xterm, and putty on Windows too). I use that most of the time now as it seems less… trigger-happy than right click paste.<br>\nThis sparked some thoughts, because I can’t imagine giving up middle mouse paste if I have a real choice. I had earlier seen shift-insert mentioned in other commentary on my entry and so have tried a bit to use it on my laptop, and it hasn’t really felt great even there; on my desktops, it’s even less appealing (I tried shift-insert out there to confirm that it did work in my set of wacky X resources).<br>\nIn thinking about why this is, I came to the obvious realization about why all of this is so. I like middle mouse button paste in normal usage because it’s so convenient, because almost all of the time my hand is already on the mouse. And the reason my hand is already on the mouse is because I’ve just used the mouse to shift focus to the window I want to paste into. Even on my laptop, my right hand is usually away from the keyboard as I move the mouse pointer on the touchpad, making shift-Insert at least somewhat awkward.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html\">NetBSD Gains Hardware Accelerated Virtualization</a></p>\n\n<ul>\n<li>NetBSD Virtual Machine Monitor</li>\n</ul>\n\n<blockquote>\n<p>NVMM provides hardware-accelerated virtualization support for NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is shipped via libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.solobsd.org/index.php/2019/02/11/solobsd-19-02-stable/\">SoloBSD 19.02-STABLE</a></li>\n<li><a href=\"https://project-trident.org/post/2019-02-20_18.12-u5_available/\">Project Trident 18.12-U5 available</a></li>\n<li><a href=\"https://mwl.io/archives/4076\">“Sudo Mastery, Second Edition” and Cover Art</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/mksanitizer_bug_detector_software_integration\">MKSANITIZER - bug detector software integration with the NetBSD userland</a></li>\n<li><a href=\"https://old.reddit.com/r/unix/comments/aplxjf/darn_kids_nowadays_back_in_my_day_we_drew_rude/\">Darn kids nowadays… back in my day we drew rude symbols like normal people.</a>  {{top two comments}}</li>\n<li><a href=\"https://www.shellcheck.net/\">ShellCheck<br>\nfinds bugs in your shell scripts.</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=JuHpABL46a8\">Old School Sean - A history of UNIX</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Ales - <a href=\"http://dpaste.com/3T8VTDJ\">OpenBSD, FreeNAS, OpenZFS questions</a></li>\n<li>Malcolm - <a href=\"http://dpaste.com/2X63H8Q\">Thoughts on Pgsql + ZFS thread?</a></li>\n<li>Brad - <a href=\"http://dpaste.com/02DCADV#wrap\">Boot Environments in FreeBSD</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0287.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Design and Implementation of NetBSD’s rc.d system, first impressions of Project Trident 18.12, PXE booting a FreeBSD disk image, middle mouse button pasting, NetBSD gains hardware accelerated virtualization, and more.","date_published":"2019-02-28T12:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e66ab35a-1745-4485-a2c3-142c6c471df0.mp3","mime_type":"audio/mp3","size_in_bytes":36387926,"duration_in_seconds":3620}]},{"id":"d6eb1003-7d6d-447e-bd77-68ae1e60c19d","title":"286: Old Machine Revival","url":"https://www.bsdnow.tv/286","content_text":"Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. \n\n##Headlines\n###Adding Glue To a Desktop Environment\n\n\nIn this article we will put some light on a lot of tools used in the world of Unix desktop environment customization, particularly regarding wmctrl, wmutils, xev, xtruss, xwininfo, xprop, xdotools, xdo, sxhkd, xbindkeys, speckeysd, xchainkeys, alttab, triggerhappy, gTile, gidmgr, keynav, and more. If those don’t make sense then this article will help. Let’s hope this can open your mind to new possibilities.\nWith that in mind we can wonder if what’s actually needed from a window manager, presentation and operation, can be split up and complemented with other tools. We can also start thinking laterally, the communication and interaction between the different components of the environment. We have the freedom to do so because the X protocol is transparent and components usually implement many standards for interfacing between windows. It’s like gluing parts together to create a desktop environment.\n\n\n\nThe tools we’ll talk about fall into one of those categories:\nDebugging\nWindow manipulation\nSimulation of interaction\nExtended manipulation\nHotkey daemon\nLayout manager\n\n\n\n\n###Flashing the BIOS on the PC Engines APU4c4\n\n\nI absolutely love the PC Engines APU devices. I use them for testing HardenedBSD experimental features in more constrained 64-bit environments and firewalls.  Their USB and mSATA ports have a few quirks, and I bumped up against a major quirk that required flashing a different BIOS as a workaround. This article details the hacky way in which I went about doing that.\nWhat prompted this article is that something in either the CAM or GEOM layer in FreeBSD 11.2 caused the mSATA to hang, preventing file writes. OPNsense 18.7 uses FreeBSD 11.1 whereas the recently-released OPNsense 19.1 uses HardenedBSD 11.2 (based on FreeBSD 11.2). I reached out to PC Engines directly, and they let me know that the issue is a known BIOS issue. Flashing the “legacy” BIOS series would provide me with a working system.\nIt also just so happens that a new “legacy” BIOS version was just released which turns on ECC mode for the RAM. So, I get a working OPNsense install AND ECC RAM! I’ll have one bird for dinner, the other for dessert.\nThough I’m using an APU4, these instructions should work for the other APU devices. The BIOS ROM download URLs should be changed to reflect the device you’re targeting along with the BIOS version you wish to deploy.\nSPECIAL NOTE: There be dragons! I’m primarily writing this article to document the procedure for my own purposes. My memory tends to be pretty faulty these days. So, if something goes wrong, please do not hold me responsible. You’re the one at the keyboard. ;)\nVERY SPECIAL NOTE: We’ll use the mSATA drive for swap space, just in case. Should the swap space be used, it will destroy whatever is on the disk.\n\n\n\n\n##News Roundup\n###Revive a Cisco IDS into a capable OpenBSD computer!\n\n\nEven though Cisco equipment is very capable, it tends to become End-of-Life before you can say “planned obsolescence”. Websites become bigger, bandwidths increase, and as a side effect of those “improvements”, routers, firewalls, and in this case, intrusion prevention systems get old quicker and quicker.\nApparently, this was also the case for the Cisco IDS-4215 Intrusion Detection Sensor that I was given a few months ago.\nI’m not too proud to admit that at first, I didn’t care about the machine itself, but rather about the add-on PCI network card with 4 Fast Ethernet interfaces. The sensor has obviously seen better days, as it had a broken front panel and needed some cleaning, but upon a closer inspection under the hood  (which is held closed by the 4 screws on top), this IDS consists of an embedded Celeron PC with two onboard Ethernet cards, a 2.5″ IDE hard disk, a CF card, and 2 PCI expansion slots (more on them later). Oh, and don’t forget the nasty server-grade fan, which pushed very little air for the noise it was making.\n\n\n\n\n###An OpenBSD desktop using WindowMaker\n\n\nSince I started using *N?X, I’ve regularly used WindowMaker. I’ve always liked the look and feel, the dock system and the dockapps. It may look a bit oldish nowadays. And that’s enough to try to change this. So here it is, a 2019 flavored WindowMaker Desktop, running on OpenBSD 6.4/amd64.\nThis configuration uses the Nord color-scheme, the Adapta-Nokto-Eta GTK theme and the Moblin Unofficial Icons icon set. I did remove applications icons. I just don’t need them on the bottom of the screen as I heavily use “F11” to pop-up the windows list. To be able to do that and keep the dockapps, I tweaked my ~/GNUstep/Defaults/WMWindowAttributes and created a ~/GNUstep/Library/WindowMaker/Themes/Nord.themed/style.\nAnd here it is, the NeXT OpenBSD Desktop!\n\n\n\n\n###RealTime Data Compression\n\n\nIn a previous episode, we’ve seen that it is possible to create opaque types. However, creation and destruction of such type must be delegated to some dedicated functions, which themselves rely on dynamic allocation mechanisms.\nSometimes, it can be convenient to bypass the heap, and all its malloc() / free() shenanigans. Pushing a structure onto the stack, or within thread-local storage, are natural capabilities offered by a normal struct. It can be desirable at times.\nThe previously described opaque type is so secret that it has no size, hence is not suitable for such scenario.\nFortunately, static opaque types are possible.\nThe main idea is to create a “shell type”, with a known size and an alignment, able to host the target (private) structure.\nFor safer maintenance, the shell type and the target structure must be kept in sync, by using typically a static assert. It will ensure that the shell type is always large enough to host the target structure. This check is important to automatically detect future evolution of the target structure.\n\n\n\n\n###For the Love of Pipes\n\n\nMy top used shell command is |. This is called a pipe.\nIn brief, the | allows for the output of one program (on the left) to become the input of another program (on the right). It is a way of connecting two commands together.\nAccording to doc.cat-v.org/unix/pipes/, the origin of pipes came long before Unix. Pipes can be traced back to this note from Doug McIlroy in 1964\n\n\n\n\n##Beastie Bits\n\n\nInstallation Notes for NetBSD/i386 0.9\nPorting Zig to NetBSD - a fun, speedy port\nNNN - Tiny, lightning fast, feature-packed file manager Release v2.3\neta - A tool for monitoring progress and ETA of an arbitrary process\n\nA FreeBSD User Tries Out…NetBSD 8.0\nFaster vlan(4) forwarding?\nFuguIta - OpenBSD 6.4 Live System\nAdding Name-based hosting To Nginx on OpenBSD with Acme-Client\nHOWTO set up QEMU with HAXM acceleration on NetBSD\nREADME: gcc 7 switch coming to a port near you!\n\n\n\n\n##BUG Calendar\n\n\nChiBUG, Chicago, USA: Tuesday, February 26th 18:00 at the Oak Park Library\nCharmBUG, Baltimore, USA: Wednesday, February 27, 2019\n19:30 at Columbia Ale House\nNYC*BUG, New York, USA: Wednesday, March 6, 2019 18:45 at Suspenders\nKnoxBUG, Knoxville, USA: Monday, February 25, 2019 - 18:00 at iX Systems offices \nBSDPL, Warsaw,  Poland: February 28, 2019 18:15 - 21:00 at Wheel Systems Office\n\n\n\n\n##Feedback/Questions\n\n\nSam - Customizing OpenBSD ports source code\nFrank - Rivalry Linux &amp; BSD\nZach - mysql/mariadb tuning\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\n\n    \n    Your browser does not support the HTML5 video tag.\n","content_html":"<p>Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. </p>\n\n<p>##Headlines<br>\n###<a href=\"https://venam.nixers.net/blog/unix/2019/01/07/win-automation.html\">Adding Glue To a Desktop Environment</a></p>\n\n<blockquote>\n<p>In this article we will put some light on a lot of tools used in the world of Unix desktop environment customization, particularly regarding wmctrl, wmutils, xev, xtruss, xwininfo, xprop, xdotools, xdo, sxhkd, xbindkeys, speckeysd, xchainkeys, alttab, triggerhappy, gTile, gidmgr, keynav, and more. If those don’t make sense then this article will help. Let’s hope this can open your mind to new possibilities.<br>\nWith that in mind we can wonder if what’s actually needed from a window manager, presentation and operation, can be split up and complemented with other tools. We can also start thinking laterally, the communication and interaction between the different components of the environment. We have the freedom to do so because the X protocol is transparent and components usually implement many standards for interfacing between windows. It’s like gluing parts together to create a desktop environment.</p>\n</blockquote>\n\n<ul>\n<li>The tools we’ll talk about fall into one of those categories:</li>\n<li>Debugging</li>\n<li>Window manipulation</li>\n<li>Simulation of interaction</li>\n<li>Extended manipulation</li>\n<li>Hotkey daemon</li>\n<li>Layout manager</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://github.com/lattera/articles/blob/master/hardware/apu/2019-02-05_flashing_bios/article.md\">Flashing the BIOS on the PC Engines APU4c4</a></p>\n\n<blockquote>\n<p>I absolutely love the PC Engines APU devices. I use them for testing HardenedBSD experimental features in more constrained 64-bit environments and firewalls.  Their USB and mSATA ports have a few quirks, and I bumped up against a major quirk that required flashing a different BIOS as a workaround. This article details the hacky way in which I went about doing that.<br>\nWhat prompted this article is that something in either the CAM or GEOM layer in FreeBSD 11.2 caused the mSATA to hang, preventing file writes. OPNsense 18.7 uses FreeBSD 11.1 whereas the recently-released OPNsense 19.1 uses HardenedBSD 11.2 (based on FreeBSD 11.2). I reached out to PC Engines directly, and they let me know that the issue is a known BIOS issue. Flashing the “legacy” BIOS series would provide me with a working system.<br>\nIt also just so happens that a new “legacy” BIOS version was just released which turns on ECC mode for the RAM. So, I get a working OPNsense install AND ECC RAM! I’ll have one bird for dinner, the other for dessert.<br>\nThough I’m using an APU4, these instructions should work for the other APU devices. The BIOS ROM download URLs should be changed to reflect the device you’re targeting along with the BIOS version you wish to deploy.<br>\nSPECIAL NOTE: There be dragons! I’m primarily writing this article to document the procedure for my own purposes. My memory tends to be pretty faulty these days. So, if something goes wrong, please do not hold me responsible. You’re the one at the keyboard. ;)<br>\nVERY SPECIAL NOTE: We’ll use the mSATA drive for swap space, just in case. Should the swap space be used, it will destroy whatever is on the disk.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://komlositech.wordpress.com/2018/12/30/revive-a-cisco-ids-into-a-capable-openbsd-firewall/\">Revive a Cisco IDS into a capable OpenBSD computer!</a></p>\n\n<blockquote>\n<p>Even though Cisco equipment is very capable, it tends to become End-of-Life before you can say “planned obsolescence”. Websites become bigger, bandwidths increase, and as a side effect of those “improvements”, routers, firewalls, and in this case, intrusion prevention systems get old quicker and quicker.<br>\nApparently, this was also the case for the Cisco IDS-4215 Intrusion Detection Sensor that I was given a few months ago.<br>\nI’m not too proud to admit that at first, I didn’t care about the machine itself, but rather about the add-on PCI network card with 4 Fast Ethernet interfaces. The sensor has obviously seen better days, as it had a broken front panel and needed some cleaning, but upon a closer inspection under the hood  (which is held closed by the 4 screws on top), this IDS consists of an embedded Celeron PC with two onboard Ethernet cards, a 2.5″ IDE hard disk, a CF card, and 2 PCI expansion slots (more on them later). Oh, and don’t forget the nasty server-grade fan, which pushed very little air for the noise it was making.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.tumfatig.net/20190215/an-openbsd-desktop-using-windowmaker/?utm_source=discoverbsd\">An OpenBSD desktop using WindowMaker</a></p>\n\n<blockquote>\n<p>Since I started using *N?X, I’ve regularly used WindowMaker. I’ve always liked the look and feel, the dock system and the dockapps. It may look a bit oldish nowadays. And that’s enough to try to change this. So here it is, a 2019 flavored WindowMaker Desktop, running on OpenBSD 6.4/amd64.<br>\nThis configuration uses the Nord color-scheme, the Adapta-Nokto-Eta GTK theme and the Moblin Unofficial Icons icon set. I did remove applications icons. I just don’t need them on the bottom of the screen as I heavily use “F11” to pop-up the windows list. To be able to do that and keep the dockapps, I tweaked my ~/GNUstep/Defaults/WMWindowAttributes and created a ~/GNUstep/Library/WindowMaker/Themes/Nord.themed/style.<br>\nAnd here it is, the NeXT OpenBSD Desktop!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://fastcompression.blogspot.com/2019/01/opaque-types-and-static-allocation.html\">RealTime Data Compression</a></p>\n\n<blockquote>\n<p>In a previous episode, we’ve seen that it is possible to create opaque types. However, creation and destruction of such type must be delegated to some dedicated functions, which themselves rely on dynamic allocation mechanisms.<br>\nSometimes, it can be convenient to bypass the heap, and all its malloc() / free() shenanigans. Pushing a structure onto the stack, or within thread-local storage, are natural capabilities offered by a normal struct. It can be desirable at times.<br>\nThe previously described opaque type is so secret that it has no size, hence is not suitable for such scenario.<br>\nFortunately, static opaque types are possible.<br>\nThe main idea is to create a “shell type”, with a known size and an alignment, able to host the target (private) structure.<br>\nFor safer maintenance, the shell type and the target structure must be kept in sync, by using typically a static assert. It will ensure that the shell type is always large enough to host the target structure. This check is important to automatically detect future evolution of the target structure.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.jessfraz.com/post/for-the-love-of-pipes/\">For the Love of Pipes</a></p>\n\n<blockquote>\n<p>My top used shell command is |. This is called a pipe.<br>\nIn brief, the | allows for the output of one program (on the left) to become the input of another program (on the right). It is a way of connecting two commands together.<br>\nAccording to <a href=\"http://doc.cat-v.org/unix/pipes/\">doc.cat-v.org/unix/pipes/</a>, the origin of pipes came long before Unix. Pipes can be traced back to this note from Doug McIlroy in 1964</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://scontent-iad3-1.xx.fbcdn.net/v/t1.0-9/52532824_10216880223150142_5567720793346932736_n.jpg?_nc_cat=100&amp;_nc_ht=scontent-iad3-1.xx&amp;oh=f4de0999bd268725b39969435c1e2d82&amp;oe=5D23255E\">Installation Notes for NetBSD/i386 0.9</a></li>\n<li><a href=\"http://coypu.sdf.org/porting-zig.html\">Porting Zig to NetBSD - a fun, speedy port</a></li>\n<li><a href=\"https://github.com/jarun/nnn/blob/master/README.md\">NNN - Tiny, lightning fast, feature-packed file manager Release v2.3</a></li>\n<li><a href=\"https://github.com/aioobe/eta\">eta - A tool for monitoring progress and ETA of an arbitrary process<br>\n</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=OxB70pg5Tsg&amp;feature=share\">A FreeBSD User Tries Out…NetBSD 8.0</a></li>\n<li><a href=\"http://www.grenadille.net/post/2019/02/18/Faster-vlan%284%29-forwarding\">Faster vlan(4) forwarding?</a></li>\n<li><a href=\"http://fuguita.org/\">FuguIta - OpenBSD 6.4 Live System</a></li>\n<li><a href=\"https://chargen.one/steve/adding-name-based-hosting-to-nginx-on-openbsd-with-acme-client\">Adding Name-based hosting To Nginx on OpenBSD with Acme-Client</a></li>\n<li><a href=\"http://polprog.net/blog/netbsd-hax/\">HOWTO set up QEMU with HAXM acceleration on NetBSD</a></li>\n<li><a href=\"https://mail-index.netbsd.org/current-users/2019/02/07/msg035054.html\">README: gcc 7 switch coming to a port near you!</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##BUG Calendar</p>\n\n<ul>\n<li>ChiBUG, Chicago, USA: <a href=\"https://chibug.org/\">Tuesday, February 26th 18:00 at the Oak Park Library</a></li>\n<li>CharmBUG, Baltimore, USA: <a href=\"https://www.meetup.com/CharmBUG/\">Wednesday, February 27, 2019<br>\n19:30 at Columbia Ale House</a></li>\n<li>NYC*BUG, New York, USA: <a href=\"https://www.nycbug.org/index\">Wednesday, March 6, 2019 18:45 at Suspenders</a></li>\n<li>KnoxBUG, Knoxville, USA: <a href=\"http://knoxbug.org\">Monday, February 25, 2019 - 18:00 at iX Systems offices </a></li>\n<li>BSDPL, Warsaw,  Poland: <a href=\"https://bsd-pl.org/en\">February 28, 2019 18:15 - 21:00 at Wheel Systems Office</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Sam - <a href=\"http://dpaste.com/2NP4VGE#wrap\">Customizing OpenBSD ports source code</a></li>\n<li>Frank - <a href=\"http://dpaste.com/1EHYHQ1#wrap\">Rivalry Linux &amp; BSD</a></li>\n<li>Zach - <a href=\"http://dpaste.com/13GGAED\">mysql/mariadb tuning</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>\n\n<video controls preload=\"metadata\" style=\" width:426px;  height:240px;\">\n    <source src=\"http://201406.jb-dl.cdn.scaleengine.net/bsdnow/2019/bsd-0286.mp4\" type=\"video/mp4\">\n    Your browser does not support the HTML5 video tag.\n</video>","summary":"Adding glue to a desktop environment, flashing the BIOS on a PC Engine, revive a Cisco IDS into a capable OpenBSD computer, An OpenBSD WindowMaker desktop, RealTime data compression, the love for pipes, and more. ","date_published":"2019-02-21T16:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d6eb1003-7d6d-447e-bd77-68ae1e60c19d.mp3","mime_type":"audio/mp3","size_in_bytes":47545588,"duration_in_seconds":4736}]},{"id":"b54701c7-6556-42b3-804d-79a1bf9c6bbe","title":"285: BSD Strategy","url":"https://www.bsdnow.tv/285","content_text":"Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.\n\n##Headlines\n###Strategic thinking, or what I think what we need to do to keep FreeBSD relevant\n\n\nSince I participate in the FreeBSD project there are from time to time some voices which say FreeBSD is dead, Linux is the way to go. Most of the time those voices are trolls, or people which do not really know what FreeBSD has to offer. Sometimes those voices wear blinders, they only see their own little world (were Linux just works fine) and do not see the big picture (like e.g. competition stimulates business, …) or even dare to look what FreeBSD has to offer.\nSometimes those voices raise a valid concern, and it is up to the FreeBSD project to filter out what would be beneficial. Recently there were some mails on the FreeBSD lists in the sense of “What about going into direction X?”. Some people just had the opinion that we should stay where we are. In my opinion this is similarly bad to blindly saying FreeBSD is dead and following the masses. It would mean stagnation. We should not hold people back in exploring new / different directions. Someone wants to write a kernel module in (a subset of) C++ or in Rust… well, go ahead, give it a try, we can put it into the Ports Collection and let people get experience with it.\nThis discussion on the mailinglists also triggered some kind of “where do we see us in the next years” / strategic thinking reflection. What I present here, is my very own opinion about things we in the FreeBSD project should look at, to stay relevant in the long term. To be able to put that into scope, I need to clarify what “relevant” means in this case.\nFreeBSD is currently used by companies like Netflix, NetApp, Cisco, Juniper, and many others as a base for products or services. It is also used by end‐users as a work‐horse (e.g. mailservers, webservers, …). Staying relevant means in this context, to provide something which the user base is interested in to use and which makes it more easy / fast for the user base to deliver whatever they want or need to deliver than with another kind of system. And this in terms of time to market of a solution (time to deliver a service like a web‐/mail‐/whatever‐server or product), and in terms of performance (which not only means speed, but also security and reliability and …) of the solution.\nI have categorized the list of items I think are important into (new) code/features, docs, polishing and project infrastructure. Links in the following usually point to documentation/HOWTOs/experiences for/with FreeBSD, and not to the canonical entry points of the projects or technologies. In a few cases the links point to an explanation in the wikipedia or to the website of the topic in question.\n\n\n\n\n###Reflecting on The Soul of a New Machine\n\n\nLong ago as an undergraduate, I found myself back home on a break from school, bored and with eyes wandering idly across a family bookshelf. At school, I had started to find a calling in computing systems, and now in the den, an old book suddenly caught my eye: Tracy Kidder’s The Soul of a New Machine. Taking it off the shelf, the book grabbed me from its first descriptions of Tom West, captivating me with the epic tale of the development of the Eagle at Data General. I — like so many before and after me — found the book to be life changing: by telling the stories of the people behind the machine, the book showed the creative passion among engineers that might otherwise appear anodyne, inspiring me to chart a course that might one day allow me to make a similar mark.\nSince reading it over two decades ago, I have recommended The Soul of a Machine at essentially every opportunity, believing that it is a part of computing’s literary foundation — that it should be considered our Odyssey. Recently, I suggested it as beach reading to Jess Frazelle, and apparently with perfect timing: when I saw the book at the top of her vacation pile, I knew a fuse had been lit. I was delighted (though not at all surprised) to see Jess livetweet her admiration of the book, starting with the compelling prose, the lucid technical explanations and the visceral anecdotes — but then moving on to the deeper technical inspiration she found in the book. And as she reached the book’s crescendo, Jess felt its full power, causing her to reflect on the nature of engineering motivation.\nExcited to see the effect of the book on Jess, I experienced a kind of reflected recommendation: I was inspired to (re-)read my own recommendation! Shortly after I started reading, I began to realize that (contrary to what I had been telling myself over the years!) I had not re-read the book in full since that first reading so many years ago. Rather, over the years I had merely revisited those sections that I remembered fondly. On the one hand, these sections are singular: the saga of engineers debugging a nasty I-cache data corruption issue; the young engineer who implements the simulator in an impossibly short amount of time because no one wanted to tell him that he was being impossibly ambitious; the engineer who, frustrated with a nanosecond-scale timing problem in the ALU that he designed, moved to a commune in Vermont, claiming a desire to deal with “no unit of time shorter than a season”. But by limiting myself to these passages, I was succumbing to the selection bias of my much younger self; re-reading the book now from start to finish has given new parts depth and meaning. Aspects that were more abstract to me as an undergraduate — from the organizational rivalries and absurdities of the industry to the complexities of West’s character and the tribulations of the team down the stretch — are now deeply evocative of concrete episodes of my own career.\n\n\n\nSee Article for rest…\n\n\n\n\n##News Roundup\n\n###Out-Of-The-Box 10GbE Network Benchmarks On Nine Linux Distributions Plus FreeBSD 12\n\n\nLast week I started running some fresh 10GbE Linux networking performance benchmarks across a few different Linux distributions. That testing has now been extended to cover nine Linux distributions plus FreeBSD 12.0 to compare the out-of-the-box networking performance.\nTested this round alongside FreeBSD 12.0 was Antergos 19.1, CentOS 7, Clear Linux, Debian 9.6, Fedora Server 29, openSUSE Leap 15.0, openSUSE Tumbleweed, Ubuntu 18.04.1 LTS, and Ubuntu 18.10.\nAll of the tests were done with a Tyan S7106 1U server featuring two Intel Xeon Gold 6138 CPUs, 96GB of DDR4 system memory, and Samsung 970 EVO SSD. For the 10GbE connectivity on this server was an add-in HP NC523SFP PCIe adapter providing two 10Gb SPF+ ports using a QLogic 8214 controller.\nOriginally the plan as well was to include Windows Server 2016/2019. Unfortunately the QLogic driver download site was malfunctioning since Cavium’s acquisition of the company and the other Windows Server 2016 driver options not panning out and there not being a Windows Server 2019 option. So sadly that Windows testing was thwarted so I since started testing over with a Mellanox Connectx-2 10GbE NIC, which is well supported on Windows Server and so that testing is ongoing for the next article of Windows vs. Linux 10 Gigabit network performance plus some “tuned” Linux networking results too.\n\n\n\n\n###Integration of the LLVM sanitizers with the NetBSD base system\n\n\nOver the past month I’ve merged the LLVM compiler-rt sanitizers (LLVM svn r350590) with the base system. I’ve also managed to get a functional set of Makefile rules to build all of them, namely:\nASan, UBSan, TSan, MSan, libFuzzer, SafeStack, XRay.\nIn all supported variations and modes that are supported by the original LLVM compiler-rt package.\n\n\n\n\n###Distrowatch FreeNAS 11.2 review\n\n\nThe project’s latest release is FreeNAS 11.2 and, at first, I nearly overlooked the new version because it appeared to be a minor point release. However, a lot of work went into the new version and 11.2 offers a lot of changes when compared next to 11.1, “including a major revamp of the web interface, support for self-encrypting drives, and new, backwards-compatible REST and WebSocket APIs. This update also introduces iocage for improved plugins and jails management and simplified plugin development.”\n\n\n\n\n##Beastie Bits\n\n\nInstructions for installing rEFInd to dual boot a computer with FreeBSD and windows (and possibly other OSes as well).\nNetBSD desktop pt.6: “vi(1) editor, tmux and unicode $TERM”\nUnix flowers\nFreeBSD upgrade procedure using GPT\nPull-based Backups using OpenBSD base*\nDeveloping WireGuard for NetBSD\nOpenZFS User Conference, April 18-19, Norwalk CT\nKnoxBug Feb 25th\n\n\n\n\n##Feedback/Questions\n\n\nJake - C Programming\nFarhan - Explanation of rtadvd\nNelson - Bug Bounties on Open-Source Software\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"http://www.leidinger.net/blog/2019/01/27/strategic-thinking-or-what-i-think-what-we-need-to-do-to-keep-freebsd-relevant/\">Strategic thinking, or what I think what we need to do to keep FreeBSD relevant</a></p>\n\n<blockquote>\n<p>Since I participate in the FreeBSD project there are from time to time some voices which say FreeBSD is dead, Linux is the way to go. Most of the time those voices are trolls, or people which do not really know what FreeBSD has to offer. Sometimes those voices wear blinders, they only see their own little world (were Linux just works fine) and do not see the big picture (like e.g. competition stimulates business, …) or even dare to look what FreeBSD has to offer.<br>\nSometimes those voices raise a valid concern, and it is up to the FreeBSD project to filter out what would be beneficial. Recently there were some mails on the FreeBSD lists in the sense of “What about going into direction X?”. Some people just had the opinion that we should stay where we are. In my opinion this is similarly bad to blindly saying FreeBSD is dead and following the masses. It would mean stagnation. We should not hold people back in exploring new / different directions. Someone wants to write a kernel module in (a subset of) C++ or in Rust… well, go ahead, give it a try, we can put it into the Ports Collection and let people get experience with it.<br>\nThis discussion on the mailinglists also triggered some kind of “where do we see us in the next years” / strategic thinking reflection. What I present here, is my very own opinion about things we in the FreeBSD project should look at, to stay relevant in the long term. To be able to put that into scope, I need to clarify what “relevant” means in this case.<br>\nFreeBSD is currently used by companies like Netflix, NetApp, Cisco, Juniper, and many others as a base for products or services. It is also used by end‐users as a work‐horse (e.g. mailservers, webservers, …). Staying relevant means in this context, to provide something which the user base is interested in to use and which makes it more easy / fast for the user base to deliver whatever they want or need to deliver than with another kind of system. And this in terms of time to market of a solution (time to deliver a service like a web‐/mail‐/whatever‐server or product), and in terms of performance (which not only means speed, but also security and reliability and …) of the solution.<br>\nI have categorized the list of items I think are important into (new) code/features, docs, polishing and project infrastructure. Links in the following usually point to documentation/HOWTOs/experiences for/with FreeBSD, and not to the canonical entry points of the projects or technologies. In a few cases the links point to an explanation in the wikipedia or to the website of the topic in question.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"http://dtrace.org/blogs/bmc/2019/02/10/reflecting-on-the-soul-of-a-new-machine/\">Reflecting on The Soul of a New Machine</a></p>\n\n<blockquote>\n<p>Long ago as an undergraduate, I found myself back home on a break from school, bored and with eyes wandering idly across a family bookshelf. At school, I had started to find a calling in computing systems, and now in the den, an old book suddenly caught my eye: Tracy Kidder’s The Soul of a New Machine. Taking it off the shelf, the book grabbed me from its first descriptions of Tom West, captivating me with the epic tale of the development of the Eagle at Data General. I — like so many before and after me — found the book to be life changing: by telling the stories of the people behind the machine, the book showed the creative passion among engineers that might otherwise appear anodyne, inspiring me to chart a course that might one day allow me to make a similar mark.<br>\nSince reading it over two decades ago, I have recommended The Soul of a Machine at essentially every opportunity, believing that it is a part of computing’s literary foundation — that it should be considered our Odyssey. Recently, I suggested it as beach reading to Jess Frazelle, and apparently with perfect timing: when I saw the book at the top of her vacation pile, I knew a fuse had been lit. I was delighted (though not at all surprised) to see Jess livetweet her admiration of the book, starting with the compelling prose, the lucid technical explanations and the visceral anecdotes — but then moving on to the deeper technical inspiration she found in the book. And as she reached the book’s crescendo, Jess felt its full power, causing her to reflect on the nature of engineering motivation.<br>\nExcited to see the effect of the book on Jess, I experienced a kind of reflected recommendation: I was inspired to (re-)read my own recommendation! Shortly after I started reading, I began to realize that (contrary to what I had been telling myself over the years!) I had not re-read the book in full since that first reading so many years ago. Rather, over the years I had merely revisited those sections that I remembered fondly. On the one hand, these sections are singular: the saga of engineers debugging a nasty I-cache data corruption issue; the young engineer who implements the simulator in an impossibly short amount of time because no one wanted to tell him that he was being impossibly ambitious; the engineer who, frustrated with a nanosecond-scale timing problem in the ALU that he designed, moved to a commune in Vermont, claiming a desire to deal with “no unit of time shorter than a season”. But by limiting myself to these passages, I was succumbing to the selection bias of my much younger self; re-reading the book now from start to finish has given new parts depth and meaning. Aspects that were more abstract to me as an undergraduate — from the organizational rivalries and absurdities of the industry to the complexities of West’s character and the tribulations of the team down the stretch — are now deeply evocative of concrete episodes of my own career.</p>\n</blockquote>\n\n<ul>\n<li>See Article for rest…</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup</p>\n\n<p>###<a href=\"https://www.phoronix.com/scan.php?page=article&amp;item=10gbe-linux-freebsd12&amp;num=1\">Out-Of-The-Box 10GbE Network Benchmarks On Nine Linux Distributions Plus FreeBSD 12</a></p>\n\n<blockquote>\n<p>Last week I started running some fresh 10GbE Linux networking performance benchmarks across a few different Linux distributions. That testing has now been extended to cover nine Linux distributions plus FreeBSD 12.0 to compare the out-of-the-box networking performance.<br>\nTested this round alongside FreeBSD 12.0 was Antergos 19.1, CentOS 7, Clear Linux, Debian 9.6, Fedora Server 29, openSUSE Leap 15.0, openSUSE Tumbleweed, Ubuntu 18.04.1 LTS, and Ubuntu 18.10.<br>\nAll of the tests were done with a Tyan S7106 1U server featuring two Intel Xeon Gold 6138 CPUs, 96GB of DDR4 system memory, and Samsung 970 EVO SSD. For the 10GbE connectivity on this server was an add-in HP NC523SFP PCIe adapter providing two 10Gb SPF+ ports using a QLogic 8214 controller.<br>\nOriginally the plan as well was to include Windows Server 2016/2019. Unfortunately the QLogic driver download site was malfunctioning since Cavium’s acquisition of the company and the other Windows Server 2016 driver options not panning out and there not being a Windows Server 2019 option. So sadly that Windows testing was thwarted so I since started testing over with a Mellanox Connectx-2 10GbE NIC, which is well supported on Windows Server and so that testing is ongoing for the next article of Windows vs. Linux 10 Gigabit network performance plus some “tuned” Linux networking results too.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/integration_of_the_llvm_sanitziers\">Integration of the LLVM sanitizers with the NetBSD base system</a></p>\n\n<blockquote>\n<p>Over the past month I’ve merged the LLVM compiler-rt sanitizers (LLVM svn r350590) with the base system. I’ve also managed to get a functional set of Makefile rules to build all of them, namely:<br>\nASan, UBSan, TSan, MSan, libFuzzer, SafeStack, XRay.<br>\nIn all supported variations and modes that are supported by the original LLVM compiler-rt package.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://distrowatch.com/weekly.php?issue=20190204#freenas\">Distrowatch FreeNAS 11.2 review</a></p>\n\n<blockquote>\n<p>The project’s latest release is FreeNAS 11.2 and, at first, I nearly overlooked the new version because it appeared to be a minor point release. However, a lot of work went into the new version and 11.2 offers a lot of changes when compared next to 11.1, “including a major revamp of the web interface, support for self-encrypting drives, and new, backwards-compatible REST and WebSocket APIs. This update also introduces iocage for improved plugins and jails management and simplified plugin development.”</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://gist.github.com/zeising/5d2402d92b4cf421c7402d663b2d9e41\">Instructions for installing rEFInd to dual boot a computer with FreeBSD and windows (and possibly other OSes as well).</a></li>\n<li><a href=\"https://www.unitedbsd.com/d/12-netbsd-desktop-pt-6-vi1-editor-tmux-and-unicode-term\">NetBSD desktop pt.6: “vi(1) editor, tmux and unicode $TERM”</a></li>\n<li><a href=\"https://www.geekrant.org/2005/04/01/unix-flowers/\">Unix flowers</a></li>\n<li><a href=\"https://oshogbo.vexillium.org/blog/62/\">FreeBSD upgrade procedure using GPT</a></li>\n<li><a href=\"https://chargen.one/steve/backups-on-chargen-one\">Pull-based Backups using OpenBSD base*</a></li>\n<li><a href=\"https://github.com/ozaki-r/netbsd-src/tree/wireguard\">Developing WireGuard for NetBSD</a></li>\n<li><a href=\"https://zfs.datto.com/\">OpenZFS User Conference, April 18-19, Norwalk CT</a></li>\n<li><a href=\"http://knoxbug.org/2019-02-25\">KnoxBug Feb 25th</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Jake - <a href=\"http://dpaste.com/3X7KVVX#wrap\">C Programming</a></li>\n<li>Farhan - <a href=\"http://dpaste.com/067WW0P\">Explanation of rtadvd</a></li>\n<li>Nelson - <a href=\"http://dpaste.com/2BYGFSV\">Bug Bounties on Open-Source Software</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Strategic thinking to keep FreeBSD relevant, reflecting on the soul of a new machine, 10GbE Benchmarks On Nine Linux Distros and FreeBSD, NetBSD integrating LLVM sanitizers in base, FreeNAS 11.2 distrowatch review, and more.","date_published":"2019-02-14T10:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b54701c7-6556-42b3-804d-79a1bf9c6bbe.mp3","mime_type":"audio/mp3","size_in_bytes":41912862,"duration_in_seconds":4172}]},{"id":"9e51096d-3e53-490c-8603-827a76d73758","title":"284: FOSDEM 2019","url":"https://www.bsdnow.tv/284","content_text":"We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.\n\nHeadlines\n\nFOSDEM 2019 Recap\n\n\nAllan and I were at FOSDEM 2019 in Brussels, Belgium over the weekend.\nOn the Friday before, we held a FreeBSD Devsummit in a hotel conference room, with 25 people attending. We talked about various topics of interest to the project. You can find the notes on the wiki page.\nSaturday was the first day of FOSDEM. The FreeBSD Project had a table next to the Illumos Project again. A lot of people visited our table, asked questions, or just said “Hi, I watch BSDNow.tv every week”. We handed out a lot of stickers, pens, swag, and flyers. There was also a full day BSD devroom, with a variety of talks that were well attended.\nIn the main conference track, Allan held a talk explaining how the ZFS ARC works. A lot of people attended the talk and had more questions afterwards. Another well attended talk was by Jonathan Looney about Netflix and FreeBSD.\nSunday was another day in the same format, but no bsd devroom. A lot of people visited our table, developers and users alike. A lot of meeting and greeting went on.\nOverall, FOSDEM was a great success with FreeBSD showing a lot of presence. Thanks to all the people who attended and talked to us. Special thanks to the people who helped out at the FreeBSD table and Rodrigo Osorio for running the BSD devroom again.\n\n\nFreeBSD Foundation Update, January 2019\n\n\nDear FreeBSD Community Member,\nHappy New Year! It’s always exciting starting the new year with ambitious plans to support FreeBSD in new and existing areas. We achieved our fundraising goal for 2018, so we plan on funding a lot of work this year! Though it’s the new year, this newsletter highlights some of the work we accomplished in December. We also put together a list of technologies and features we are considering supporting, and are looking for feedback on what users want to help inform our 2019 development plans.  Our advocacy and education efforts are in full swing as we prepare for upcoming conferences including FOSDEM, SANOG33, and SCaLE.\nFinally, we created a year-end video to talk about the work we did in 2018. That in itself was an endeavor, so please take a few minutes to watch it! We’re working on improving the methods we use to inform the community on the work we are doing to support the Project, and are always open to feedback. Now, sit back, grab a refreshing beverage, and enjoy our newsletter!\nHappy reading!!\nDeb\n\n\n\n\nOPNsense 19.1 released\n\n\nFor more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.\nThe 19.1 release, nicknamed “Inspiring Iguana”, consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over 12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP combination. And the OpenVPN client export was rewritten for full API support as well.\n\n\n\n\nThese are the most prominent changes since version 18.7:\n\n\nfully functional firewall alias API\n\n\nPIE firewall shaper support\n\n\nfirewall NAT rule logging support\n\n\n2FA via LDAP-TOTP combination\n\n\nWPAD / PAC and parent proxy support in the web proxy\n\n\nP12 certificate export with custom passwords\n\n\nDpinger is now the default gateway monitor\n\n\nET Pro Telemetry edition plugin[2]\n\n\nextended IPv6 DUID support\n\n\nDnsmasq DNSSEC support\n\n\nOpenVPN client export API\n\n\nRealtek NIC driver version 1.95\n\n\nHardenedBSD 11.2, LibreSSL 2.7\n\n\nUnbound 1.8, Suricata 4.1\n\n\nPhalcon 3.4, Perl 5.28\n\n\nfirmware health check extended to cover all OS files, HTTPS mirror default\n\n\nupdates are browser cache-safe regarding CSS and JavaScript assets\n\n\ncollapsible side bar menu in the default theme\n\n\nlanguage updates for Chinese, Czech, French, German, Japanese, Portuguese and Russian\n\n\nAPI backup export, Bind, Hardware widget, Nginx, Ntopng, VnStat and Dnscrypt-proxy plugins\n\n\nHere are the full changes against version 19.1-RC2:\n\n\nipsec: add firewall interface as soon as phase 1 is enabled\n\n\nipsec: phase 1 selection GUI JavaScript compatibility fix\n\n\nmonit: widget improvements and bug fix (contributed by Frank Brendel)\n\n\nui: fix regression in single host or network subnet select in static pages\n\n\nplugins: os-frr 1.7 updates OSFP outbound rules (contributed by Fabian Franz)\n\n\nplugins: os-telegraf 1.7.4 fixes packet filter input\n\n\nplugins: os-theme-rebellion 1.8.2 adds image colour invert\n\n\nplugins: os-vnstat 1.1[3]\n\n\nplugins: os-zabbix-agent now uses Zabbix version 4.0\n\n\nsrc: revert mmc_calculate_clock() as HS200/HS400 support breaks legacy support\n\n\nsrc: update sqlite3-3.20.0 to sqlite3-3.26.0[4]\n\n\nsrc: import tzdata 2018h, 2018i[5]\n\n\nsrc: avoid unsynchronized updates to kn_status[6]\n\n\nports: ca_root_nss 3.42\n\n\nports: dhcp6c 20190128 prevent rawops double-free (contributed by Team Rebellion)\n\n\nports: sudo patch to fix listpw=never[7]\n\n\n\n\n\nNews Roundup\n\nThe hardware-assisted virtualization challenge\n\n\nOver two years ago, I made a pledge to use NetBSD as my sole OS and only operating system, and to resist booting into any other OS until I had implemented hardware-accelerated virtualization in the NetBSD kernel (the equivalent of Linux’ KVM, or Hyper-V).\nToday, I am here to report: Mission Accomplished!\nIt’s been a long road, but we now have hardware-accelerated virtualization in the kernel! And while I had only initially planned to get Oracle VirtualBox working, I have with the help of the Intel HAXM engine (the same backend used for virtualization in Android Studio) and a qemu frontend, successfully managed to boot a range of mainstream operating systems.\n\n\n\n\nZFS and GPL terror: How much freedom is there in Linux?\n\n\nZFS – the undesirable guest\n\n\n\nZFS is todays most advanced filesystem. It originated on the Solaris operating system and thanks to Sun’s decision to open it up, we have it available on quite a number of Unix-like operating systems. That’s just great! Great for everyone.\nFor everyone? Nope. There are people out there who don’t like ZFS. Which is totally fine, they don’t need to use it after all. But worse: There are people who actively hate ZFS and think that others should not use it. Ok, it’s nothing new that some random guys on the net are acting like assholes, trying to tell you what you must not do, right? Whoever has been online for more than a couple of days probably already got used to it. Unfortunately its still worse: One such spoilsport is Greg Kroah-Hartman, Linux guru and informal second-in-command after Linus Torvalds.\nThere have been some attempts to defend the stance of this kernel developer. One was to point at the fact that the “ZFS on Linux” (ZoL) port uses two kernel functions, __kernel_fpu_begin() and __kernel_fpu_end(), which have been deprecated for a very long time and that it makes sense to finally get rid of them since nothing in-kernel uses it anymore. Nobody is going to argue against that. The problem becomes clear by looking at the bigger picture, though:\nThe need for functions doing just what the old ones did has of course not vanished. The functions have been replaced with other ones. And those ones are deliberately made GPL-only. Yes, that’s right: There’s no technical reason whatsoever! It’s purely ideology – and it’s a terrible one.\n\n\n\n\nClonOS 19.01-RELEASE\n\n\nClonOS is a turnkey Open Source platform based on FreeBSD and the CBSD framework. ClonOS offers a complete web UI for easily controlling, deploying and managing FreeBSD jails containers and Bhyve/Xen hyperviser virtual environments.\nClonOS is currently the only platform available which allow both Xen and Bhyve hypervisor to coexist on the same host. Being a FreeBSD base platform, ClonOS ability to create and manage jails allows you to run FreeBSD applications without losing performance.\n\n\n\n\nFeatures:\n\n\neasy management via web UI interface\n\n\nlive Bhyve migration [coming soon, roadmap]\n\n\nBhyve management (create, delete VM)\n\n\nXen management (create, delete VM) [coming soon, roadmap]\n\n\nconnection to the “physical” guest console via VNC from the browser or directly\n\n\nReal time system monitoring\n\n\naccess to load statistics through SQLite3 and beanstalkd\n\n\nsupport for ZFS features (cloning, snapshots)\n\n\nimport/export of virtual environments\n\n\npublic repository with virtual machine templates\n\n\npuppet-based helpers for configuring popular services\n\n\nClonOS is a free open-source FreeBSD-based platform for virtual environments creation and management. In the core:\n\n\nFreeBSD OS as hoster platform\n\n\nbhyve(8) as hypervisor engine\n\n\nXen as hypervisor engine\n\n\nvale(4) as Virtual Ethernet Switch\n\n\njail(8) as container engine\n\n\nCBSD Project as management tools\n\n\nPuppet as configuration management\n\n\n\n\n\nBeastie Bits\n\n\nFlorian Obser on unwind(8)\nA low tech SMS gateway for fun and no profit\nNetflix and FreeBSD : Using Open Source to Deliver Streaming Video\npowerd++ 0.4.0 release\nIs it time to rewrite the operating system in Rust?\nSmall change, big effect\nSwedish BSD Meetup, Feb 19, 2019\nPolish BSD User Group Meetup, Feb 21, 2019\n\n\n\n\nFeedback/Questions\n\n\nCasey - Cool new Digital Ocean Feature\nMorgan - Jail w/differnet version of FreeBSD\nBrad - FreeBSD Installer\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.</p>\n\n<h1>Headlines</h1>\n\n<h3><a href=\"https://fosdem.org/2019/schedule/\">FOSDEM 2019 Recap</a></h3>\n\n<ul>\n<li>Allan and I were at FOSDEM 2019 in Brussels, Belgium over the weekend.</li>\n<li>On the Friday before, we held a FreeBSD Devsummit in a hotel conference room, with 25 people attending. We talked about various topics of interest to the project. You can find the <a href=\"https://wiki.freebsd.org/Devsummit/201902\">notes on the wiki page</a>.</li>\n<li>Saturday was the first day of FOSDEM. The FreeBSD Project had a table next to the Illumos Project again. A lot of people visited our table, asked questions, or just said “Hi, I watch <a href=\"http://BSDNow.tv\">BSDNow.tv</a> every week”. We handed out a lot of stickers, pens, swag, and flyers. There was also a full day <a href=\"https://twitter.com/fosdembsd\">BSD devroom</a>, with a <a href=\"https://fosdem.org/2019/schedule/track/bsd/\">variety of talks</a> that were well attended.</li>\n<li>In the main conference track, Allan held a <a href=\"https://fosdem.org/2019/schedule/event/zfs_caching/\">talk explaining how the ZFS ARC works</a>. A lot of people attended the talk and had more questions afterwards. Another well attended talk was by Jonathan Looney about <a href=\"https://fosdem.org/2019/schedule/event/netflix_freebsd/\">Netflix and FreeBSD</a>.</li>\n<li>Sunday was another day in the same format, but no bsd devroom. A lot of people visited our table, developers and users alike. A lot of meeting and greeting went on.</li>\n<li>Overall, FOSDEM was a great success with FreeBSD showing a lot of presence. Thanks to all the people who attended and talked to us. Special thanks to the people who helped out at the FreeBSD table and Rodrigo Osorio for running the BSD devroom again.</li>\n</ul>\n\n<h3><a href=\"https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-january-2019/\">FreeBSD Foundation Update, January 2019</a></h3>\n\n<blockquote>\n<p>Dear FreeBSD Community Member,<br>\nHappy New Year! It’s always exciting starting the new year with ambitious plans to support FreeBSD in new and existing areas. We achieved our fundraising goal for 2018, so we plan on funding a lot of work this year! Though it’s the new year, this newsletter highlights some of the work we accomplished in December. We also put together a list of technologies and features we are considering supporting, and are looking for feedback on what users want to help inform our 2019 development plans.  Our advocacy and education efforts are in full swing as we prepare for upcoming conferences including FOSDEM, SANOG33, and SCaLE.<br>\nFinally, we created a year-end video to talk about the work we did in 2018. That in itself was an endeavor, so please take a few minutes to watch it! We’re working on improving the methods we use to inform the community on the work we are doing to support the Project, and are always open to feedback. Now, sit back, grab a refreshing beverage, and enjoy our newsletter!<br>\nHappy reading!!<br>\nDeb</p>\n</blockquote>\n\n<p><hr></p>\n\n<h3><a href=\"https://forum.opnsense.org/index.php?topic=11398.0\">OPNsense 19.1 released</a></h3>\n\n<blockquote>\n<p>For more than four years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.<br>\nThe 19.1 release, nicknamed “Inspiring Iguana”, consists of a total of 620 individual changes since 18.7 came out 6 months ago, spread out over 12 intermediate releases including the recent release candidates. That is the average of 2 stable releases per month, security updates and important bug fixes included! If we had to pick a few highlights it would be: The firewall alias API is finally in place. The migration to HardenedBSD 11.2 has been completed. 2FA now works with a remote LDAP / local TOTP combination. And the OpenVPN client export was rewritten for full API support as well.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>These are the most prominent changes since version 18.7:</p>\n</li>\n<li>\n<p>fully functional firewall alias API</p>\n</li>\n<li>\n<p>PIE firewall shaper support</p>\n</li>\n<li>\n<p>firewall NAT rule logging support</p>\n</li>\n<li>\n<p>2FA via LDAP-TOTP combination</p>\n</li>\n<li>\n<p>WPAD / PAC and parent proxy support in the web proxy</p>\n</li>\n<li>\n<p>P12 certificate export with custom passwords</p>\n</li>\n<li>\n<p>Dpinger is now the default gateway monitor</p>\n</li>\n<li>\n<p>ET Pro Telemetry edition plugin[2]</p>\n</li>\n<li>\n<p>extended IPv6 DUID support</p>\n</li>\n<li>\n<p>Dnsmasq DNSSEC support</p>\n</li>\n<li>\n<p>OpenVPN client export API</p>\n</li>\n<li>\n<p>Realtek NIC driver version 1.95</p>\n</li>\n<li>\n<p>HardenedBSD 11.2, LibreSSL 2.7</p>\n</li>\n<li>\n<p>Unbound 1.8, Suricata 4.1</p>\n</li>\n<li>\n<p>Phalcon 3.4, Perl 5.28</p>\n</li>\n<li>\n<p>firmware health check extended to cover all OS files, HTTPS mirror default</p>\n</li>\n<li>\n<p>updates are browser cache-safe regarding CSS and JavaScript assets</p>\n</li>\n<li>\n<p>collapsible side bar menu in the default theme</p>\n</li>\n<li>\n<p>language updates for Chinese, Czech, French, German, Japanese, Portuguese and Russian</p>\n</li>\n<li>\n<p>API backup export, Bind, Hardware widget, Nginx, Ntopng, VnStat and Dnscrypt-proxy plugins</p>\n</li>\n<li>\n<p>Here are the full changes against version 19.1-RC2:</p>\n</li>\n<li>\n<p>ipsec: add firewall interface as soon as phase 1 is enabled</p>\n</li>\n<li>\n<p>ipsec: phase 1 selection GUI JavaScript compatibility fix</p>\n</li>\n<li>\n<p>monit: widget improvements and bug fix (contributed by Frank Brendel)</p>\n</li>\n<li>\n<p>ui: fix regression in single host or network subnet select in static pages</p>\n</li>\n<li>\n<p>plugins: os-frr 1.7 updates OSFP outbound rules (contributed by Fabian Franz)</p>\n</li>\n<li>\n<p>plugins: os-telegraf 1.7.4 fixes packet filter input</p>\n</li>\n<li>\n<p>plugins: os-theme-rebellion 1.8.2 adds image colour invert</p>\n</li>\n<li>\n<p>plugins: os-vnstat 1.1[3]</p>\n</li>\n<li>\n<p>plugins: os-zabbix-agent now uses Zabbix version 4.0</p>\n</li>\n<li>\n<p>src: revert mmc_calculate_clock() as HS200/HS400 support breaks legacy support</p>\n</li>\n<li>\n<p>src: update sqlite3-3.20.0 to sqlite3-3.26.0[4]</p>\n</li>\n<li>\n<p>src: import tzdata 2018h, 2018i[5]</p>\n</li>\n<li>\n<p>src: avoid unsynchronized updates to kn_status[6]</p>\n</li>\n<li>\n<p>ports: ca_root_nss 3.42</p>\n</li>\n<li>\n<p>ports: dhcp6c 20190128 prevent rawops double-free (contributed by Team Rebellion)</p>\n</li>\n<li>\n<p>ports: sudo patch to fix listpw=never[7]</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/the_hardware_assisted_virtualization_challenge\">The hardware-assisted virtualization challenge</a></h3>\n\n<blockquote>\n<p>Over two years ago, I made a pledge to use NetBSD as my sole OS and only operating system, and to resist booting into any other OS until I had implemented hardware-accelerated virtualization in the NetBSD kernel (the equivalent of Linux’ KVM, or Hyper-V).<br>\nToday, I am here to report: Mission Accomplished!<br>\nIt’s been a long road, but we now have hardware-accelerated virtualization in the kernel! And while I had only initially planned to get Oracle VirtualBox working, I have with the help of the Intel HAXM engine (the same backend used for virtualization in Android Studio) and a qemu frontend, successfully managed to boot a range of mainstream operating systems.</p>\n</blockquote>\n\n<p><hr></p>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2019/01/28/zfs-and-gpl-terror-how-much-freedom-is-there-in-linux/\">ZFS and GPL terror: How much freedom is there in Linux?</a></h3>\n\n<ul>\n<li>ZFS – the undesirable guest</li>\n</ul>\n\n<blockquote>\n<p>ZFS is todays most advanced filesystem. It originated on the Solaris operating system and thanks to Sun’s decision to open it up, we have it available on quite a number of Unix-like operating systems. That’s just great! Great for everyone.<br>\nFor everyone? Nope. There are people out there who don’t like ZFS. Which is totally fine, they don’t need to use it after all. But worse: There are people who actively hate ZFS and think that others should not use it. Ok, it’s nothing new that some random guys on the net are acting like assholes, trying to tell you what you must not do, right? Whoever has been online for more than a couple of days probably already got used to it. Unfortunately its still worse: One such spoilsport is Greg Kroah-Hartman, Linux guru and informal second-in-command after Linus Torvalds.<br>\nThere have been some attempts to defend the stance of this kernel developer. One was to point at the fact that the “ZFS on Linux” (ZoL) port uses two kernel functions, __kernel_fpu_begin() and __kernel_fpu_end(), which have been deprecated for a very long time and that it makes sense to finally get rid of them since nothing in-kernel uses it anymore. Nobody is going to argue against that. The problem becomes clear by looking at the bigger picture, though:<br>\nThe need for functions doing just what the old ones did has of course not vanished. The functions have been replaced with other ones. And those ones are deliberately made GPL-only. Yes, that’s right: There’s no technical reason whatsoever! It’s purely ideology – and it’s a terrible one.</p>\n</blockquote>\n\n<p><hr></p>\n\n<h3><a href=\"https://clonos.tekroutine.com/\">ClonOS 19.01-RELEASE</a></h3>\n\n<blockquote>\n<p>ClonOS is a turnkey Open Source platform based on FreeBSD and the CBSD framework. ClonOS offers a complete web UI for easily controlling, deploying and managing FreeBSD jails containers and Bhyve/Xen hyperviser virtual environments.<br>\nClonOS is currently the only platform available which allow both Xen and Bhyve hypervisor to coexist on the same host. Being a FreeBSD base platform, ClonOS ability to create and manage jails allows you to run FreeBSD applications without losing performance.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Features:</p>\n</li>\n<li>\n<p>easy management via web UI interface</p>\n</li>\n<li>\n<p>live Bhyve migration [coming soon, roadmap]</p>\n</li>\n<li>\n<p>Bhyve management (create, delete VM)</p>\n</li>\n<li>\n<p>Xen management (create, delete VM) [coming soon, roadmap]</p>\n</li>\n<li>\n<p>connection to the “physical” guest console via VNC from the browser or directly</p>\n</li>\n<li>\n<p>Real time system monitoring</p>\n</li>\n<li>\n<p>access to load statistics through SQLite3 and beanstalkd</p>\n</li>\n<li>\n<p>support for ZFS features (cloning, snapshots)</p>\n</li>\n<li>\n<p>import/export of virtual environments</p>\n</li>\n<li>\n<p>public repository with virtual machine templates</p>\n</li>\n<li>\n<p>puppet-based helpers for configuring popular services</p>\n</li>\n<li>\n<p>ClonOS is a free open-source FreeBSD-based platform for virtual environments creation and management. In the core:</p>\n</li>\n<li>\n<p>FreeBSD OS as hoster platform</p>\n</li>\n<li>\n<p>bhyve(8) as hypervisor engine</p>\n</li>\n<li>\n<p>Xen as hypervisor engine</p>\n</li>\n<li>\n<p>vale(4) as Virtual Ethernet Switch</p>\n</li>\n<li>\n<p>jail(8) as container engine</p>\n</li>\n<li>\n<p>CBSD Project as management tools</p>\n</li>\n<li>\n<p>Puppet as configuration management</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.undeadly.org/cgi?action=article;sid=20190128061321\">Florian Obser on unwind(8)</a></li>\n<li><a href=\"https://www.reddit.com/r/commandline/comments/amq947/a_low_tech_sms_gateway_for_fun_and_no_profit/\">A low tech SMS gateway for fun and no profit</a></li>\n<li><a href=\"https://fosdem.org/2019/schedule/event/netflix_freebsd/attachments/slides/3103/export/events/attachments/netflix_freebsd/slides/3103/FOSDEM_2019_Netflix_and_FreeBSD.pdf\">Netflix and FreeBSD : Using Open Source to Deliver Streaming Video</a></li>\n<li><a href=\"https://github.com/lonkamikaze/powerdxx/releases/tag/0.4.0\">powerd++ 0.4.0 release</a></li>\n<li><a href=\"https://www.infoq.com/presentations/os-rust\">Is it time to rewrite the operating system in Rust?</a></li>\n<li><a href=\"https://svnweb.freebsd.org/changeset/base/343673\">Small change, big effect</a></li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/257281738/\">Swedish BSD Meetup, Feb 19, 2019</a></li>\n<li><a href=\"https://www.meetup.com/en-US/Polish-BSD-User-Group/events/zkhlnqyzdbsb/\">Polish BSD User Group Meetup, Feb 21, 2019</a></li>\n</ul>\n\n<p><hr></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Casey - <a href=\"http://dpaste.com/2MA7HRV#wrap\">Cool new Digital Ocean Feature</a></li>\n<li>Morgan - <a href=\"http://dpaste.com/1QDAMYJ#wrap\">Jail w/differnet version of FreeBSD</a></li>\n<li>Brad - <a href=\"http://dpaste.com/2XG5KXN#wrap\">FreeBSD Installer</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"We recap FOSDEM 2019, FreeBSD Foundation January update, OPNsense 19.1 released, the hardware-assisted virtualization challenge, ZFS and GPL terror, ClonOS 19.01-RELEASE, and more.","date_published":"2019-02-07T11:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e51096d-3e53-490c-8603-827a76d73758.mp3","mime_type":"audio/mp3","size_in_bytes":35850359,"duration_in_seconds":3566}]},{"id":"e11d6e25-000c-4424-b4fa-cda93c336f73","title":"283: Graphical Interface-View","url":"https://www.bsdnow.tv/283","content_text":"We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. \n\n##Interview - Niclas Zeising - zeising@FreeBSD.org / @niclaszeising\nInterview topic: FreeBSD Graphics Stack\n\n\nBR: Welcome Niclas. Since this is your first time on BSDNow, can you tell us a bit about yourself and how you started with Unix/BSD?\nAJ: What made you start working in the FreeBSD graphics stack?\nBR: What is the current status with the FreeBSD graphics stack?\nAJ: What challenges do you face in the FreeBSD graphics stack?\nBR: How many people are working in the graphics team and what kind of help do you need there?\nAJ: You’re also involved in FreeBSD ports and held a poudriere tutorial at last years EuroBSDcon. What kind of feedback did you get and will you give that tutorial again?\nBR: You’ve been organizing the Stockholm BSD user group meeting. Can you tell us a bit about that, what’s involved, how is it structured?\nAJ: What conferences do you go to where people could talk to you?\nBR: Is there anything else you’d like to mention before we let you go?\n\n\n\n\n##Feedback/Questions\n\n\nCasey - TrueOS\nTroels - zfs send vs zfs send -R\nmatclarke - Orphaned packages\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. </p>\n\n<p>##Interview - Niclas Zeising - <a href=\"mailto:zeising@FreeBSD.org\">zeising@FreeBSD.org</a> / <a href=\"https://twitter.com/niclaszeising\">@niclaszeising</a><br>\nInterview topic: FreeBSD Graphics Stack</p>\n\n<ul>\n<li>BR: Welcome Niclas. Since this is your first time on BSDNow, can you tell us a bit about yourself and how you started with Unix/BSD?</li>\n<li>AJ: What made you start working in the FreeBSD graphics stack?</li>\n<li>BR: What is the current status with the FreeBSD graphics stack?</li>\n<li>AJ: What challenges do you face in the FreeBSD graphics stack?</li>\n<li>BR: How many people are working in the graphics team and what kind of help do you need there?</li>\n<li>AJ: You’re also involved in FreeBSD ports and held a poudriere tutorial at last years EuroBSDcon. What kind of feedback did you get and will you give that tutorial again?</li>\n<li>BR: You’ve been organizing the Stockholm BSD user group meeting. Can you tell us a bit about that, what’s involved, how is it structured?</li>\n<li>AJ: What conferences do you go to where people could talk to you?</li>\n<li>BR: Is there anything else you’d like to mention before we let you go?</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Casey - <a href=\"http://dpaste.com/33XCN5X#wrap\">TrueOS</a></li>\n<li>Troels - <a href=\"http://dpaste.com/31M2SN6\">zfs send vs zfs send -R</a></li>\n<li>matclarke - <a href=\"http://dpaste.com/16WDCW0\">Orphaned packages</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"We’re at FOSDEM 2019 this week having fun. We’d never leave you in a lurch, so we have recorded an interview with Niclas Zeising of the FreeBSD graphics team for you. Enjoy. ","date_published":"2019-01-31T11:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/e11d6e25-000c-4424-b4fa-cda93c336f73.mp3","mime_type":"audio/mp3","size_in_bytes":28233037,"duration_in_seconds":2804}]},{"id":"081a14d7-ba00-43d2-9be7-ea1a189ed2e2","title":"282: Open the Rsync","url":"https://www.bsdnow.tv/282","content_text":"Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.\n\n##Headlines\n\n###AsiaBSDCon 2019 Call for Papers\n\n\nYou have until Jan 30th to submit\nFull paper requirement is relaxed a bit this year (this year ONLY!) due to the short submission window. You don’t need all 10-12 pages, but it is still preferred.\nSend a message to secretary@asiabsdcon.org with your proposal. Could be either for a talk or a tutorial.\nTwo days of tutorials/devsummit and two days of conference during Sakura season in Tokyo, Japan\nThe conference is also looking for sponsors\nIf accepted, flight and hotel is paid for by the conference\n\n\n\n\n###Project Trident 18.12 Released\n\n\nTwitter account if you want to keep up on project news\nScreenshots\nProject Trident Community Telegram Channel\nDistroWatch Page\nLinuxActionNews Review\nRoboNuggie’s in depth review\n\n\n\n\n###Building Spotifyd on NetBSD\n\n\nThese are the steps I went through to build and run Spotifyd (this commit at the time of writing) on NetBSD AMD64. It’s a Spotify Connect client so it means I still need to control Spotify from another device (typically my phone), but the audio is played through my desktop… which is where my speakers and headphones are plugged in - it means I don’t have to unplug stuff and re-plug into my phone, work laptop, etc. This is 100% a “good enough for now solution” for me; I have had a quick play with the Go based microcontroller from spotcontrol and that allows a completely NetBSD only experience (although it is just an example application so doesn’t provide many features - great as a basis to build on though).\n\n\n\n\n##News Roundup\n\n###OPNsense 18.7.10 released\n\n\n2019 means 19.1 is almost here. In the meantime accept this small\nincremental update with goodies such as Suricata 4.1, custom passwords\nfor P12 certificate export as well as fresh fixes in the FreeBSD base.\nA lot of cleanups went into this update to make sure there will be a\nsmooth transition to 19.1-RC for you early birds. We expect RC1 in 1-2\nweeks and the final 19.1 on January 29.\n\n\n\n\n###Introducing the Ultra EPYC AMD Powered Sun Ultra 24 Workstation\n\n\nA few weeks ago, I got an itch to build a workstation with AMD EPYC. There are a few constraints. First, I needed a higher-clock part. Second, I knew the whole build would be focused more on being an ultra high-end workstation rather than simply utilizing gaming components. With that, I decided it was time to hit on a bit of nostalgia for our readers. Mainly, I wanted to do an homage to Sun Microsystems. Sun made the server gear that the industry ran on for years, and as a fun fact, if you go behind the 1 Hacker Way sign at Facebook’s campus, they left the Sun Microsystems logo. Seeing that made me wonder if we could do an ultimate AMD EPYC build in a Sun Microsystems workstation.\n\n\n\n\n###OpenRsync\n\n\nThis is a clean-room implementation of rsync with a BSD (ISC) license. It is designed to be compatible with a modern rsync (3.1.3 is used for testing). It currently compiles and runs only on OpenBSD.\nThis project is still very new and very fast-moving.\nIt’s not ready for wide-spread testing. Or even narrow-spread beyond getting all of the bits to work. It’s not ready for strong attention. Or really any attention but by careful programming.\nMany have asked about portability. We’re just not there yet, folks. But don’t worry, the system is easily portable. The hard part for porters is matching OpenBSD’s pledge and unveil.\n\n\n\n\n###The first report on LLD porting\n\n\nLLD is the link editor (linker) component of Clang toolchain. Its main advantage over GNU ld is much lower memory footprint, and linking speed. It is of specific interest to me since currently 8 GiB of memory are insufficient to link LLVM statically (which is the upstream default).\nThe first goal of LLD porting is to ensure that LLD can produce working NetBSD executables, and be used to build LLVM itself. Then, it is desirable to look into trying to build additional NetBSD components, and eventually into replacing /usr/bin/ld entirely with lld.\nIn this report, I would like to shortly summarize the issues I have found so far trying to use LLD on NetBSD.\n\n\n\n\n###Ring in the new\n\n\nIt’s the second week of 2019 already, which means I’m curious what Nate is going to do with his series This week in usability … reset the numbering from week 1? That series is a great read, to keep up with all the little things that change in KDE source each week — aside from the release notes.\nFor the big ticket items of KDE on FreeBSD, you should read this blog instead.\n\n\n\nIn ports this week (mostly KDE, some unrelated):\nKDE Plasma has been updated to the latest release, 5.14.5.\nKDE Applications 18.12.1 were released today, so we’re right on top of them.\nMarble was fixed for FreeBSD-running-on-Power9.\nMusescore caught up on 18 months of releases.\nPhonon updated to 4.10.1, along with its backends.\nAnd in development, Qt WebEngine 5.12 has been prepared in the incongruously-named plasma-5.13 branch in Area51; that does contain all the latest bits described above, as well.\n\n\n\n\n##Beastie Bits\n\n\nNomadBSD 1.2-RC1 Released\nZFS - The First Enterprise Blockchain\nPowersaving with DragonFly laptop\nNetBSD reaches 100% reproducable builds\nPotential Bhyve Web Interface?\nLibGDX proof of concept on OpenBSD - Video\nLiteCLI is a user-friendly CommandLine client for SQLite database\nIn honor of Donald Knuth’s 81 birthday Stanford uploaded 111 lectures on Youtube\nPortland BSD Pizza Night - 2018-01-31 19:00 - Sweet Heart Pizza\nStockholm BSD February meetup\nPolish BSD User Group: Jan 25 18:15 - 21:00\nAsiaBSDcon 2019 CfP\n\n\n\n\n##Feedback/Questions\n\n\nGreg - VLANs and jails\nTara - ZFS on removable disks\nCasey - Interview with Kirk McKusick\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.</p>\n\n<p>##Headlines</p>\n\n<p>###<a href=\"https://2019.asiabsdcon.org/cfp.html.en\">AsiaBSDCon 2019 Call for Papers</a></p>\n\n<ul>\n<li>You have until Jan 30th to submit</li>\n<li>Full paper requirement is relaxed a bit this year (this year ONLY!) due to the short submission window. You don’t need all 10-12 pages, but it is still preferred.</li>\n<li>Send a message to <a href=\"mailto:secretary@asiabsdcon.org\">secretary@asiabsdcon.org</a> with your proposal. Could be either for a talk or a tutorial.</li>\n<li>Two days of tutorials/devsummit and two days of conference during Sakura season in Tokyo, Japan</li>\n<li>The conference is also looking for sponsors</li>\n<li>If accepted, flight and hotel is paid for by the conference</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"http://project-trident.org/post/2019-01-15_18.12-release_available/\">Project Trident 18.12 Released</a></p>\n\n<ul>\n<li><a href=\"https://twitter.com/tridentproject\">Twitter account if you want to keep up on project news</a></li>\n<li><a href=\"https://twitter.com/TridentProject/status/1086010032662237185\">Screenshots</a></li>\n<li><a href=\"https://t.me/ProjectTrident\">Project Trident Community Telegram Channel</a></li>\n<li><a href=\"https://distrowatch.com/?newsid=10442\">DistroWatch Page</a></li>\n<li><a href=\"https://linuxactionnews.com/89?t=395\">LinuxActionNews Review</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=QjiR1KiacrQ\">RoboNuggie’s in depth review</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://atomicules.co.uk/2019/01/17/Building-Spotifyd-on-NetBSD.html\">Building Spotifyd on NetBSD</a></p>\n\n<blockquote>\n<p>These are the steps I went through to build and run Spotifyd (this commit at the time of writing) on NetBSD AMD64. It’s a Spotify Connect client so it means I still need to control Spotify from another device (typically my phone), but the audio is played through my desktop… which is where my speakers and headphones are plugged in - it means I don’t have to unplug stuff and re-plug into my phone, work laptop, etc. This is 100% a “good enough for now solution” for me; I have had a quick play with the Go based microcontroller from spotcontrol and that allows a completely NetBSD only experience (although it is just an example application so doesn’t provide many features - great as a basis to build on though).</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup</p>\n\n<p>###<a href=\"https://opnsense.org/opnsense-18-7-10-released/\">OPNsense 18.7.10 released</a></p>\n\n<blockquote>\n<p>2019 means 19.1 is almost here. In the meantime accept this small<br>\nincremental update with goodies such as Suricata 4.1, custom passwords<br>\nfor P12 certificate export as well as fresh fixes in the FreeBSD base.<br>\nA lot of cleanups went into this update to make sure there will be a<br>\nsmooth transition to 19.1-RC for you early birds. We expect RC1 in 1-2<br>\nweeks and the final 19.1 on January 29.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.servethehome.com/introducing-the-ultra-epyc-amd-powered-sun-ultra-24-workstation/\">Introducing the Ultra EPYC AMD Powered Sun Ultra 24 Workstation</a></p>\n\n<blockquote>\n<p>A few weeks ago, I got an itch to build a workstation with AMD EPYC. There are a few constraints. First, I needed a higher-clock part. Second, I knew the whole build would be focused more on being an ultra high-end workstation rather than simply utilizing gaming components. With that, I decided it was time to hit on a bit of nostalgia for our readers. Mainly, I wanted to do an homage to Sun Microsystems. Sun made the server gear that the industry ran on for years, and as a fun fact, if you go behind the 1 Hacker Way sign at Facebook’s campus, they left the Sun Microsystems logo. Seeing that made me wonder if we could do an ultimate AMD EPYC build in a Sun Microsystems workstation.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://github.com/kristapsdz/openrsync\">OpenRsync</a></p>\n\n<blockquote>\n<p>This is a clean-room implementation of rsync with a BSD (ISC) license. It is designed to be compatible with a modern rsync (3.1.3 is used for testing). It currently compiles and runs only on OpenBSD.<br>\nThis project is still very new and very fast-moving.<br>\nIt’s not ready for wide-spread testing. Or even narrow-spread beyond getting all of the bits to work. It’s not ready for strong attention. Or really any attention but by careful programming.<br>\nMany have asked about portability. We’re just not there yet, folks. But don’t worry, the system is easily portable. The hard part for porters is matching OpenBSD’s pledge and unveil.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/the_first_report_on_lld\">The first report on LLD porting</a></p>\n\n<blockquote>\n<p>LLD is the link editor (linker) component of Clang toolchain. Its main advantage over GNU ld is much lower memory footprint, and linking speed. It is of specific interest to me since currently 8 GiB of memory are insufficient to link LLVM statically (which is the upstream default).<br>\nThe first goal of LLD porting is to ensure that LLD can produce working NetBSD executables, and be used to build LLVM itself. Then, it is desirable to look into trying to build additional NetBSD components, and eventually into replacing /usr/bin/ld entirely with lld.<br>\nIn this report, I would like to shortly summarize the issues I have found so far trying to use LLD on NetBSD.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://euroquis.nl/bobulate/?p=2044\">Ring in the new</a></p>\n\n<blockquote>\n<p>It’s the second week of 2019 already, which means I’m curious what Nate is going to do with his series This week in usability … reset the numbering from week 1? That series is a great read, to keep up with all the little things that change in KDE source each week — aside from the release notes.<br>\nFor the big ticket items of KDE on FreeBSD, you should read this blog instead.</p>\n</blockquote>\n\n<ul>\n<li>In ports this week (mostly KDE, some unrelated):</li>\n<li>KDE Plasma has been updated to the latest release, 5.14.5.</li>\n<li>KDE Applications 18.12.1 were released today, so we’re right on top of them.</li>\n<li>Marble was fixed for FreeBSD-running-on-Power9.</li>\n<li>Musescore caught up on 18 months of releases.</li>\n<li>Phonon updated to 4.10.1, along with its backends.</li>\n<li>And in development, Qt WebEngine 5.12 has been prepared in the incongruously-named plasma-5.13 branch in Area51; that does contain all the latest bits described above, as well.</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"http://nomadbsd.org/index.html\">NomadBSD 1.2-RC1 Released</a></li>\n<li><a href=\"https://twitter.com/q5sys/status/1086443533681209350\">ZFS - The First Enterprise Blockchain</a></li>\n<li><a href=\"https://www.dragonflybsd.org/docs/user/Powersave/?updated\">Powersaving with DragonFly laptop</a></li>\n<li><a href=\"https://tests.reproducible-builds.org/netbsd/netbsd.html\">NetBSD reaches 100% reproducable builds</a></li>\n<li><a href=\"https://old.reddit.com/r/freebsd/comments/ahs53y/bhyve_web_interface/\">Potential Bhyve Web Interface?</a></li>\n<li><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/adi9sm/libgdx_proof_of_concept_on_openbsd_slay_the_spire/\">LibGDX proof of concept on OpenBSD</a> - <a href=\"https://youtu.be/F1loBeHKJt4\">Video</a></li>\n<li><a href=\"https://www.pgcli.com/launching-litecli.html\">LiteCLI is a user-friendly CommandLine client for SQLite database</a></li>\n<li><a href=\"https://www.youtube.com/playlist?list=PL94E35692EB9D36F3\">In honor of Donald Knuth’s 81 birthday Stanford uploaded 111 lectures on Youtube</a></li>\n<li><a href=\"http://dpaste.com/3Q4F6C2\">Portland BSD Pizza Night - 2018-01-31 19:00 - Sweet Heart Pizza</a></li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/257281738/\">Stockholm BSD February meetup</a></li>\n<li><a href=\"https://bsd-pl.org/en\">Polish BSD User Group: Jan 25 18:15 - 21:00</a></li>\n<li><a href=\"https://2019.asiabsdcon.org/cfp.html.en\">AsiaBSDcon 2019 CfP</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Greg - <a href=\"http://dpaste.com/3A6T4HN\">VLANs and jails</a></li>\n<li>Tara - <a href=\"http://dpaste.com/1X1E3XS#wrap\">ZFS on removable disks</a></li>\n<li>Casey - <a href=\"http://dpaste.com/08HZ6FP#wrap\">Interview with Kirk McKusick</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Project Trident 18.12 released, Spotifyd on NetBSD, OPNsense 18.7.10 is available, Ultra EPYC AMD Powered Sun Ultra 24 Workstation, OpenRsync, LLD porting to NetBSD, and more.","date_published":"2019-01-24T11:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/081a14d7-ba00-43d2-9be7-ea1a189ed2e2.mp3","mime_type":"audio/mp3","size_in_bytes":36986923,"duration_in_seconds":3680}]},{"id":"62f301ee-57b8-4f10-8736-3660f78074a8","title":"281: EPYC Server Battle","url":"https://www.bsdnow.tv/281","content_text":"SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.\n\n##Headlines\n###scp client multiple vulnerabilities\n\n\nOverview\nSCP clients from multiple vendors are susceptible to a malicious scp server performing\nunauthorized changes to target directory and/or client output manipulation.\nDescription\nMany scp clients fail to verify if the objects returned by the scp server match those\nit asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate\nflaw in the client allows the target directory attributes to be changed arbitrarily.\nFinally, two vulnerabilities in clients may allow server to spoof the client output.\nImpact\nMalicious scp server can write arbitrary files to scp target directory, change the\ntarget directory permissions and to spoof the client output.\nDetails\n\n\n\nThe discovered vulnerabilities, described in more detail below, enables the attack\ndescribed here in brief.\n\n\n\n\n\nThe attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim’s home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:\n\n\n\n\nuser@local:~$ scp user@remote:readme.txt .\nreadme.txt 100% 494 1.6KB/s 00:00\nuser@local:~$\n\n\n\n\nOnce the victim launches a new shell, the malicious commands in .bash_aliases get executed.\n\n\n*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.\n\n\n\n\n###FreeBSD 12.0 vs. DragonFlyBSD 5.4 vs. TrueOS 18.12 vs. Linux On A Tyan EPYC Server\n\n\nLast month when running FreeBSD 12.0 benchmarks on a 2P EPYC server I wasn’t able to run any side-by-side benchmarks with the new DragonFlyBSD 5.4 as this BSD was crashing during the boot process on that board. But fortunately on another AMD EPYC server available, the EPYC 1P TYAN Transport SX TN70A-B8026, DragonFlyBSD 5.4.1 runs fine. So for this first round of BSD benchmarking in 2019 are tests of FreeBSD 11.2, FreeBSD 12.0, DragonFlyBSD 5.4.1, the new TrueOS 18.12, and a few Linux distributions (CentOS 7, Ubuntu 18.04.1 LTS, and Clear Linux) on this EPYC 7601 server in a variety of workloads.\n\n\n\nDragonFlyBSD 5.4.1 ran fine on this Tyan server and could boot fine unlike the issue encountered on the Dell PowerEdge R7425 for this particular BSD. But on the Tyan server, DragonFlyBSD 5.2.2 wouldn’t boot so only this latest DragonFlyBSD release series was used as part of the comparison.\n\n\n\n\nA summary of the operating systems tested for this EPYC 7601 OS benchmark comparison included:\n\n\nDragonFlyBSD 5.4.1 - The latest release of Matthew Dillon’s operating system while using the HAMMER2 file-system and GCC 8.1 compiler that is now the default system compiler for this BSD.\n\n\nFreeBSD 11.2 - The previous stable release of FreeBSD. Installed with a ZFS file-system.\n\n\nFreeBSD 12.0 - The latest stable release of FreeBSD and installed with its ZFS option.\n\n\nTrueOS 18.12 - The latest release of the iX systems’ FreeBSD derivative. TrueOS 18.12 is based on FreeBSD 13.0-CURRENT and uses ZFS by default and was using the Clang 7.0.1 compiler compared to Clang 6.0.1 on FreeBSD 12.0.\n\n\nCentOS Linux 7 - The latest EL7 operating system performance.\n\n\nUbuntu 18.04.1 LTS - The latest Ubuntu Long Term Support release.\n\n\nClear Linux 27120 - The latest rolling release as of testing out of Intel’s Open-Source Technology Center. Clear Linux often reflects as close to the gold standard for performance as possible with its insanely tuned software stack for offering optimal performance on x86_64 performance for generally showing best what the hardware is capable of.\n\n\n\n\nThroughout all of this testing, the Tyan 2U server was kept to its same configuration of an AMD EPYC 7601 (32 cores / 64 threads) at stock speeds, 8 x 16GB DDR4-2666 ECC memory, and 280GB Intel Optane 900p SSD benchmarks.\n\n\n\n\n##News Roundup\n###National Inventors Hall of Fame honors creators of Unix\n\n\nDennis Ritchie (Posthumous) and Ken Thompson: UNIX Operating System\nThompson and Ritchie’s creation of the UNIX operating system and the C programming language were pivotal developments in the progress of computer science. Today, 50 years after its beginnings, UNIX and UNIX-like systems continue to run machinery from supercomputers to smartphones. The UNIX operating system remains the basis of much of the world’s computing infrastructure, and C language – written to simplify the development of UNIX – is one of the most widely used languages today.\n\n\n\n\n###Die IPV4, Die\n\n\nImagine, it is 2019. Easy, ha? Imagine, it is 2019 and you want to turn off IPv4. Like, off off. Really off. Not disabling IPv6, but disabling IPv4.\n\n\n\nTwo steps back\n\n\n\nYou might be coming here wondering, why would anybody want to do what we are asking to be done. Well, it is dead simple: We are running data centers (like Data Center Light) with a lot of IPv6 only equipment. There simply is no need for IPv4. So why would we want to have it enabled?\nAlso, here at ungleich, we defined 2019 as the year to move away from IPv4.\n\n\n\nThe challenge\n\n\n\nDo you like puzzles? Competitions? Challenges? Hacking? Well. If ANY of this is of your interest, here is a real challenge for you:\nWe offer a 100 CHF (roughly 100 USD) for anyone who can give us a detailed description of how to turn IPv4 completely off in an operating system and allowing it to communicate with IPv6 only. This should obviously include a tiny proof that your operating system is really unable to use IPv4 at all. Just flushing IPv4 addresses and keeping the IPv4 stack loaded, does not count.\n\n\n\n\n###GhostBSD 18.12 released\n\n\nGhostBSD 18.12 is an updated iso of GhostBSD 18.10 with some little changes to the live DVD/USB and with updated packages.\n\n\n\nWhat has changed since 18.10\nremoved default call of kernel modules for AMD and Intel\nreplaced octopkg by software-station\nadded back gop hacks to the live system\nadded ghostbsd-drivers and ghostbsd-utils\nwe updated the packages to the latest build\n\n\n\n\n###And Now for a laugh : #unixinpictures\n\n\n\n##Beastie Bits\n\n\nWe are now closer to the Y2038 bug than the Y2K bug\nOpenBSD Enterprise use\nAT&amp;T Unix Books\nProcess title and missing memory space\nThe History of a Security Hole\nunbound-adblock: The ultimate network adblocker!\nFreeBSD’s name/value pairs library\nPid Rollover\nBooting OpenBSD kernels in EFI mode with QEMU\nOpenBSD CVS commit: Make mincore lie\nBSDCan 2019 CfP ending January 19 - Submit!\nOpenZFS User Conference - April 18-19\nFreeBSD Journal is a free publication now\n\n\n\n\n##Feedback/Questions\n\n\nChris - Boot environments and SSDs\nJonathan - Bytes issued during a zpool scrub\nBostjan - ZFS Record Size and my mistakes\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt\">scp client multiple vulnerabilities</a></p>\n\n<ul>\n<li>Overview</li>\n<li>SCP clients from multiple vendors are susceptible to a malicious scp server performing<br>\nunauthorized changes to target directory and/or client output manipulation.</li>\n<li>Description</li>\n<li>Many scp clients fail to verify if the objects returned by the scp server match those<br>\nit asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate<br>\nflaw in the client allows the target directory attributes to be changed arbitrarily.<br>\nFinally, two vulnerabilities in clients may allow server to spoof the client output.</li>\n<li>Impact</li>\n<li>Malicious scp server can write arbitrary files to scp target directory, change the<br>\ntarget directory permissions and to spoof the client output.</li>\n<li>Details</li>\n</ul>\n\n<blockquote>\n<p>The discovered vulnerabilities, described in more detail below, enables the attack<br>\ndescribed here in brief.</p>\n</blockquote>\n\n<ul>\n<li>\n<ol>\n<li>The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim’s home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example:</li>\n</ol>\n</li>\n</ul>\n\n<p><code>user@local:~$ scp user@remote:readme.txt .</code><br>\n<code>readme.txt 100% 494 1.6KB/s 00:00</code><br>\n<code>user@local:~$</code></p>\n\n<ul>\n<li>\n<ol start=\"2\">\n<li>Once the victim launches a new shell, the malicious commands in .bash_aliases get executed.</li>\n</ol>\n</li>\n<li>*) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint.</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.phoronix.com/scan.php?page=article&amp;item=dfly-freebsd-tyanamd&amp;num=1\">FreeBSD 12.0 vs. DragonFlyBSD 5.4 vs. TrueOS 18.12 vs. Linux On A Tyan EPYC Server</a></p>\n\n<blockquote>\n<p>Last month when running FreeBSD 12.0 benchmarks on a 2P EPYC server I wasn’t able to run any side-by-side benchmarks with the new DragonFlyBSD 5.4 as this BSD was crashing during the boot process on that board. But fortunately on another AMD EPYC server available, the EPYC 1P TYAN Transport SX TN70A-B8026, DragonFlyBSD 5.4.1 runs fine. So for this first round of BSD benchmarking in 2019 are tests of FreeBSD 11.2, FreeBSD 12.0, DragonFlyBSD 5.4.1, the new TrueOS 18.12, and a few Linux distributions (CentOS 7, Ubuntu 18.04.1 LTS, and Clear Linux) on this EPYC 7601 server in a variety of workloads.</p>\n</blockquote>\n\n<blockquote>\n<p>DragonFlyBSD 5.4.1 ran fine on this Tyan server and could boot fine unlike the issue encountered on the Dell PowerEdge R7425 for this particular BSD. But on the Tyan server, DragonFlyBSD 5.2.2 wouldn’t boot so only this latest DragonFlyBSD release series was used as part of the comparison.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>A summary of the operating systems tested for this EPYC 7601 OS benchmark comparison included:</p>\n</li>\n<li>\n<p>DragonFlyBSD 5.4.1 - The latest release of Matthew Dillon’s operating system while using the HAMMER2 file-system and GCC 8.1 compiler that is now the default system compiler for this BSD.</p>\n</li>\n<li>\n<p>FreeBSD 11.2 - The previous stable release of FreeBSD. Installed with a ZFS file-system.</p>\n</li>\n<li>\n<p>FreeBSD 12.0 - The latest stable release of FreeBSD and installed with its ZFS option.</p>\n</li>\n<li>\n<p>TrueOS 18.12 - The latest release of the iX systems’ FreeBSD derivative. TrueOS 18.12 is based on FreeBSD 13.0-CURRENT and uses ZFS by default and was using the Clang 7.0.1 compiler compared to Clang 6.0.1 on FreeBSD 12.0.</p>\n</li>\n<li>\n<p>CentOS Linux 7 - The latest EL7 operating system performance.</p>\n</li>\n<li>\n<p>Ubuntu 18.04.1 LTS - The latest Ubuntu Long Term Support release.</p>\n</li>\n<li>\n<p>Clear Linux 27120 - The latest rolling release as of testing out of Intel’s Open-Source Technology Center. Clear Linux often reflects as close to the gold standard for performance as possible with its insanely tuned software stack for offering optimal performance on x86_64 performance for generally showing best what the hardware is capable of.</p>\n</li>\n</ul>\n\n<blockquote>\n<p>Throughout all of this testing, the Tyan 2U server was kept to its same configuration of an AMD EPYC 7601 (32 cores / 64 threads) at stock speeds, 8 x 16GB DDR4-2666 ECC memory, and 280GB Intel Optane 900p SSD benchmarks.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://www.engadget.com/2019/01/08/national-inventors-hall-of-fame-class-of-2019/\">National Inventors Hall of Fame honors creators of Unix</a></p>\n\n<blockquote>\n<p>Dennis Ritchie (Posthumous) and Ken Thompson: UNIX Operating System<br>\nThompson and Ritchie’s creation of the UNIX operating system and the C programming language were pivotal developments in the progress of computer science. Today, 50 years after its beginnings, UNIX and UNIX-like systems continue to run machinery from supercomputers to smartphones. The UNIX operating system remains the basis of much of the world’s computing infrastructure, and C language – written to simplify the development of UNIX – is one of the most widely used languages today.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://ungleich.ch/en-us/cms/blog/2019/01/09/die-ipv4-die/\">Die IPV4, Die</a></p>\n\n<blockquote>\n<p>Imagine, it is 2019. Easy, ha? Imagine, it is 2019 and you want to turn off IPv4. Like, off off. Really off. Not disabling IPv6, but disabling IPv4.</p>\n</blockquote>\n\n<ul>\n<li>Two steps back</li>\n</ul>\n\n<blockquote>\n<p>You might be coming here wondering, why would anybody want to do what we are asking to be done. Well, it is dead simple: We are running data centers (like Data Center Light) with a lot of IPv6 only equipment. There simply is no need for IPv4. So why would we want to have it enabled?<br>\nAlso, here at ungleich, we defined 2019 as the year to move away from IPv4.</p>\n</blockquote>\n\n<ul>\n<li>The challenge</li>\n</ul>\n\n<blockquote>\n<p>Do you like puzzles? Competitions? Challenges? Hacking? Well. If ANY of this is of your interest, here is a real challenge for you:<br>\nWe offer a 100 CHF (roughly 100 USD) for anyone who can give us a detailed description of how to turn IPv4 completely off in an operating system and allowing it to communicate with IPv6 only. This should obviously include a tiny proof that your operating system is really unable to use IPv4 at all. Just flushing IPv4 addresses and keeping the IPv4 stack loaded, does not count.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"http://www.ghostbsd.org/18.12_release_announcement\">GhostBSD 18.12 released</a></p>\n\n<blockquote>\n<p>GhostBSD 18.12 is an updated iso of GhostBSD 18.10 with some little changes to the live DVD/USB and with updated packages.</p>\n</blockquote>\n\n<ul>\n<li>What has changed since 18.10</li>\n<li>removed default call of kernel modules for AMD and Intel</li>\n<li>replaced octopkg by software-station</li>\n<li>added back gop hacks to the live system</li>\n<li>added ghostbsd-drivers and ghostbsd-utils</li>\n<li>we updated the packages to the latest build</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://threader.app/thread/1083054050315243521\">And Now for a laugh : #unixinpictures</a></p>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.jwz.org/blog/2019/01/we-are-now-closer-to-the-y2038-bug-than-the-y2k-bug/\">We are now closer to the Y2038 bug than the Y2K bug</a></li>\n<li><a href=\"https://old.reddit.com/r/openbsd/comments/ae6b77/openbsd_enterprise_use/\">OpenBSD Enterprise use</a></li>\n<li><a href=\"https://old.reddit.com/r/unix/comments/af0kij/note_the_whole_book_series_in_the_background/\">AT&amp;T Unix Books</a></li>\n<li><a href=\"https://oshogbo.vexillium.org/blog/54/\">Process title and missing memory space</a></li>\n<li><a href=\"http://www.os2museum.com/wp/the-history-of-a-security-hole/\">The History of a Security Hole</a></li>\n<li><a href=\"https://www.geoghegan.ca/unbound-adblock.html\">unbound-adblock: The ultimate network adblocker!</a></li>\n<li><a href=\"https://github.com/wheelsystems/nvlist\">FreeBSD’s name/value pairs library</a></li>\n<li><a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/PidRollover\">Pid Rollover</a></li>\n<li><a href=\"https://www.cambus.net/booting-openbsd-kernels-in-efi-mode-with-qemu/\">Booting OpenBSD kernels in EFI mode with QEMU</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-cvs&amp;m=154715734504845&amp;w=2\">OpenBSD CVS commit: Make mincore lie</a></li>\n<li><a href=\"http://www.bsdcan.org/2019/papers.php\">BSDCan 2019 CfP ending January 19 - Submit!</a></li>\n<li><a href=\"https://www.eventbrite.com/e/zfs-user-conference-2019-tickets-54530403906\">OpenZFS User Conference - April 18-19</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/journal/\">FreeBSD Journal is a free publication now</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Chris - <a href=\"http://dpaste.com/101P5HA\">Boot environments and SSDs</a></li>\n<li>Jonathan - <a href=\"http://dpaste.com/0YTPYV4\">Bytes issued during a zpool scrub</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/0Q97J7H#wrap\">ZFS Record Size and my mistakes</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"SCP client vulnerabilities, BSDs vs Linux benchmarks on a Tyan EPYC Server, fame for the Unix inventors, Die IPv4, GhostBSD 18.12 released, Unix in pictures, and more.","date_published":"2019-01-17T10:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/62f301ee-57b8-4f10-8736-3660f78074a8.mp3","mime_type":"audio/mp3","size_in_bytes":50507863,"duration_in_seconds":5032}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-3132","title":"Episode 280: FOSS Clothing | BSD Now 280","url":"https://www.bsdnow.tv/280","content_text":"A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.\n\nHeadlines\n\nA EULA in FOSS clothing?\n\nThere was a tremendous amount of reaction to and discussion about my blog entry on the midlife crisis in open source. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a detailed response — which he shortly thereafter elevated into a blog entry.\n\nLet me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.\n\nTo GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like choosealicense.com, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.\n\nTo foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!\n\n\n\nNetBSD and LLVM\n\nNetBSD entering 2019 with more complete LLVM support\n\nI’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.\nPreviously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.\n\nThe process of upstreaming support to LLVM sanitizers has been finalized\n\nI’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.\nThe NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).\n\n\n\nNews Roundup\n\nThoughts on FreeBSD 12.0\n\nPlaying with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.\nI like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.\nSomething which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.\nI probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.\n\n\n\nFreeBSD 12.0 Performance Against Windows &amp; Linux On An Intel Xeon Server\n\nLast week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.\nWhile FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.\nI did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this OpenBenchmarking.org result file.\n\n\n\nHow NetBSD came to be shipped by Microsoft\n\nGoogle cache in case the site is down\n\nIn 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.\nDanger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.\nIn 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.\nNetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)\nWe began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.\nMicrosoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.\n\n\n\nBeastie Bits\n\n\n    Unleashed 1.2 Released\n    35th CCC - Taming the Chaos: Can we build systems that actually work? \n    Potholes to avoid when migrating to IPv6\n    XScreenSaver 5.42\n    SSH Examples and Tunnels\n    Help request - mbuf(9) - request for comment\n    NSA to release free Reverse Engineering Tool\n    Running FreeBSD on a Raspberry Pi3 using a custom image created with crochet and poudriere\n\n\n\n\nFeedback/Questions\n\n\n    Dries - Lets talk a bit about VIMAGE jails\n    ohb - Question About ZFS Root Dataset\n    Micah - Active-Active NAS Sync recommendations\n\n\n\n\n\n    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"http://dtrace.org/blogs/bmc/2018/12/16/a-eula-in-foss-clothing/\">A EULA in FOSS clothing?</a></h3>\n\n<blockquote>There was a tremendous amount of reaction to and discussion about <a href=\"http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/\">my blog entry on the midlife crisis in open source</a>. As part of this discussion on HN, Jay Kreps of Confluent took the time to write a <a href=\"https://news.ycombinator.com/item?id=18687498#18689179\">detailed response</a> — which he shortly thereafter elevated into a <a href=\"https://medium.com/@jaykreps/a-quick-comment-on-bryan-cantrills-blog-on-licensing-8dccee41d9e6\">blog entry</a>.</blockquote>\n\n<blockquote>Let me be clear that I hold Jay in high regard, as both a software engineer and an entrepreneur — and I appreciate the time he took to write a thoughtful response. That said, there are aspects of his response that I found troubling enough to closely re-read the Confluent Community License — and that in turn has led me to a deeply disturbing realization about what is potentially going on here.</blockquote>\n\n<blockquote>To GitHub: Assuming that this is in fact a EULA, I think it is perilous to allow EULAs to sit in public repositories. It’s one thing to have one click through to accept a license (though again, that itself is dubious), but to say that a git clone is an implicit acceptance of a contract that happens to be sitting somewhere in the repository beggars belief. With efforts like <a href=\"http://choosealicense.com\">choosealicense.com</a>, GitHub has been a model in guiding projects with respect to licensing; it would be helpful for GitHub’s counsel to weigh in on their view of this new strain of source-available proprietary software and the degree to which it comes into conflict with GitHub’s own terms of service.</blockquote>\n\n<blockquote>To foundations concerned with software liberties, including the Apache Foundation, the Linux Foundation, the Free Software Foundation, the Electronic Frontier Foundation, the Open Source Initiative, and the Software Freedom Conservancy: the open source community needs your legal review on this! I don’t think I’m being too alarmist when I say that this is potentially a dangerous new precedent being set; it would be very helpful to have your lawyers offer their perspectives on this, even if they disagree with one another. We seem to be in some terrible new era of frankenlicenses, where the worst of proprietary licenses are bolted on to the goodwill created by open source licenses; we need your legal voices before these creatures destroy the village!</blockquote>\n\n<p><hr /></p>\n\n<h3>NetBSD and LLVM</h3>\n\n<p><a href=\"https://blog.netbsd.org/tnf/entry/netbsd_entering_2019_with_more\">NetBSD entering 2019 with more complete LLVM support</a></p>\n\n<blockquote>I’m recently helping the NetBSD developers to improve the support for this operating system in various LLVM components. As you can read in my previous report, I’ve been focusing on fixing build and test failures for the purpose of improving the buildbot coverage.\nPreviously, I’ve resolved test failures in LLVM, Clang, LLD, libunwind, openmp and partially libc++. During the remainder of the month, I’ve been working on the remaining libc++ test failures, improving the NetBSD clang driver and helping Kamil Rytarowski with compiler-rt.</blockquote>\n\n<p><a href=\"https://blog.netbsd.org/tnf/entry/the_process_of_upstreaming_support\">The process of upstreaming support to LLVM sanitizers has been finalized</a></p>\n\n<blockquote>I’ve finished the process of upstreaming patches to LLVM sanitizers (almost 2000LOC of local code) and submitted to upstream new improvements for the NetBSD support. Today out of the box (in unpatched version) we have support for a variety of compiler-rt LLVM features: ASan (finds unauthorized memory access), UBSan (finds unspecified code semantics), TSan (finds threading bugs), MSan (finds uninitialized memory use), SafeStack (double stack hardening), Profile (code coverage), XRay (dynamic code tracing); while other ones such as Scudo (hardened allocator) or DFSan (generic data flow sanitizer) are not far away from completeness.\nThe NetBSD support is no longer visibly lacking behind Linux in sanitizers, although there are still failing tests on NetBSD that are not observed on Linux. On the other hand there are features working on NetBSD that are not functional on Linux, like sanitizing programs during early initialization process of OS (this is caused by /proc dependency on Linux that is mounted by startup programs, while NetBSD relies on sysctl(3) interfaces that is always available).</blockquote>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://distrowatch.com/weekly.php?issue=20190107#freebsd\">Thoughts on FreeBSD 12.0</a></h3>\n\n<blockquote>Playing with FreeBSD with past week I don’t feel as though there were any big surprises or changes in this release compared to FreeBSD 11. In typical FreeBSD fashion, progress tends to be evolutionary rather than revolutionary, and this release feels like a polished and improved incremental step forward. I like that the installer handles both UFS and ZFS guided partitioning now and in a friendly manner. In the past I had trouble getting FreeBSD’s boot menu to work with boot environments, but that has been fixed for this release.\nI like the security options in the installer too. These are not new, but I think worth mentioning. FreeBSD, unlike most Linux distributions, offers several low-level security options (like hiding other users’ processes and randomizing PIDs) and I like having these presented at install time. It’s harder for people to attack what they cannot see, or predict, and FreeBSD optionally makes these little adjustment for us.\nSomething which stands out about FreeBSD, compared to most Linux distributions I run, is that FreeBSD rarely holds the user’s hand, but also rarely surprises the user. This means there is more reading to do up front and new users may struggle to get used to editing configuration files in a text editor. But FreeBSD rarely does anything unless told to do it. Updates rarely change the system’s behaviour, working technology rarely gets swapped out for something new, the system and its applications never crashed during my trial. Everything was rock solid. The operating system may seem like a minimal, blank slate to new users, but it’s wonderfully dependable and predictable in my experience.\nI probably wouldn’t recommend FreeBSD for desktop use. It’s close relative, GhostBSD, ships with a friendly desktop and does special work to make end user applications run smoothly. But for people who want to run servers, possible for years without change or issues, FreeBSD is a great option. It’s also an attractive choice, in my opinion, for people who like to build their system from the ground up, like you would with Debian’s server install or Arch Linux. Apart from the base tools and documentation, there is nothing on a FreeBSD system apart from what we put on it.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-12-windows&amp;num=1\">FreeBSD 12.0 Performance Against Windows &amp; Linux On An Intel Xeon Server</a></h3>\n\n<blockquote>Last week I posted benchmarks of Windows Server 2019 against various Linux distributions using a Tyan dual socket Intel Xeon server. In this article are some complementary results when adding in the performance of FreeBSD 11.2 against the new FreeBSD 12.0 stable release for this leading BSD operating system. As some fun benchmarks to end out 2018, here are the results of FreeBSD 11.2/12.0 (including an additional run when using GCC rather than Clang) up against Windows Server and several enterprise-ready Linux distributions.\nWhile FreeBSD 12.0 had picked up just one win of the Windows/Linux comparisons run, the FreeBSD performance is moving in the right direction. FreeBSD 12.0 was certainly faster than FreeBSD 11.2 on this dual Intel Xeon Scalable server based on a Tyan 1U platform. Meanwhile, to no surprise given the data last week, Clear Linux was by far the fastest out-of-the-box operating system tested.\nI did run some extra benchmarks on FreeBSD 11.2/12.0 with this hardware: in total I ran 120 benchmarks for these BSD tests. Of the 120 tests, there were just 15 cases where FreeBSD 11.2 was faster than 12.0. Seeing FreeBSD 12.0 faster than 11.2 nearly 90% of the time is an accomplishment and usually with other operating systems we see more of a mixed bag on new releases with not such solidly better performance. It was also great seeing the competitive performance out of FreeBSD when using the Clang compiler for the source-based tests compared to the GCC8 performance. Additional data available via this <a href=\"http://OpenBenchmarking.org\">OpenBenchmarking.org</a> result file.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"http://fogey.com/contemplating/?p=1023\">How NetBSD came to be shipped by Microsoft</a></h3>\n\n<p><a href=\"https://webcache.googleusercontent.com/search?q=cache:5XwAm5tvJ4AJ:fogey.com/contemplating/%3Fp%3D1023+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us\">Google cache in case the site is down</a></p>\n\n<blockquote>In 2000, Joe Britt, Matt Hershenson and Andy Rubin formed Danger Incorporated. Danger developed the world’s first recognizable smartphone, the Danger HipTop. T-Mobile sold the first HipTop under the brand name Sidekick in October of 2002.\nDanger had a well developed kernel that had been designed and built in house. The kernel came to be viewed as not a core intellectual property and Danger started a search for a replacement. For business reasons, mostly to do with legal concerns over the Gnu Public License, Danger rejected Linux and began to consider BSD Unix as a replacement for the kernel.\nIn 2006 I was hired by Mike Chen, the manager of the kernel development group to investigate the feasibility of replacing the Danger kernel with a BSD kernel, to select the version of BSD to use, to develop a prototype and to develop the plan for adapting BSD to Danger’s requirements.\nNetBSD was easily the best choice among the BSD variations at the time because it had well developed cross development tools. It was easy to use a NetBSD desktop running an Intel release to cross compile a NetBSD kernel and runtime for a device running an ARM processor. (Those interested in mailing list archaeology might be amused to investigate NetBSD technical mailing list for mail from picovex, particularly from Bucky Katz at picovex.)\nWe began product development on the specific prototype of the phone that would become the Sidekick LX2009 in 2007 and contracts for the phone were written with T-Mobile. We were about half way through the two year development cycle when Microsoft purchased Danger in 2008.\nMicrosoft would have preferred to ship the Sidekick running Windows/CE rather than NetBSD, but a schedule analysis performed by me, and another by an independent outside contractor, indicated that doing so would result in unacceptable delay.</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n    <li><a href=\"http://lists.31bits.net/archives/devel/2018-December/000033.html\">Unleashed 1.2 Released</a></li>\n    <li><a href=\"https://media.ccc.de/v/35c3-9647-taming_the_chaos_can_we_build_systems_that_actually_work\">35th CCC - Taming the Chaos: Can we build systems that actually work? </a></li>\n    <li><a href=\"https://rachelbythebay.com/w/2018/12/30/v6/\">Potholes to avoid when migrating to IPv6</a></li>\n    <li><a href=\"https://www.jwz.org/blog/2018/12/xscreensaver-5-41/\">XScreenSaver 5.42</a></li>\n    <li><a href=\"https://hackertarget.com/ssh-examples-tunnels/\">SSH Examples and Tunnels</a></li>\n    <li><a href=\"https://old.reddit.com/r/freebsd/comments/abevqa/mbuf9_request_for_comment/\">Help request - mbuf(9) - request for comment</a></li>\n    <li><a href=\"https://www.zdnet.com/article/nsa-to-release-a-free-reverse-engineering-tool/\">NSA to release free Reverse Engineering Tool</a></li>\n    <li><a href=\"https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html\">Running FreeBSD on a Raspberry Pi3 using a custom image created with crochet and poudriere</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n    <li>Dries - <a href=\"http://dpaste.com/2DCEJD6#wrap\">Lets talk a bit about VIMAGE jails</a></li>\n    <li>ohb - <a href=\"http://dpaste.com/1EGDSKQ#wrap\">Question About ZFS Root Dataset</a></li>\n    <li>Micah - <a href=\"http://dpaste.com/3TK2JWF#wrap\">Active-Active NAS Sync recommendations</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"A EULA in FOSS clothing, NetBSD with more LLVM support, Thoughts on FreeBSD 12.0, FreeBSD Performance against Windows and Linux on Xeon, Microsoft shipping NetBSD, and more.","date_published":"2019-01-10T03:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bad2a854-7f51-4ff6-84a9-7c324c5cf277.mp3","mime_type":"audio/mp3","size_in_bytes":31619268,"duration_in_seconds":3143}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-3093","title":"Episode 279: Future of ZFS | BSD Now 279","url":"https://www.bsdnow.tv/279","content_text":"The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.\n\nHeadlines\n\nThe future of ZFS in FreeBSD\n\nThe sources for FreeBSD’s ZFS support are currently taken directly from Illumos with local ifdefs to support the peculiarities of FreeBSD where the Solaris Portability Layer (SPL) shims fall short. FreeBSD has regularly pulled changes from Illumos and tried to push back any bug fixes and new features done in the context of FreeBSD. In the past few years the vast majority of new development in ZFS has taken place in DelphixOS and zfsonlinux (ZoL). Earlier this year Delphix announced that they will be moving to ZoL: https://www.delphix.com/blog/kickoff-future-eko-2018 This shift means that there will be little to no net new development of Illumos. While working through the git history of ZoL I have also discovered that many races and locking bugs have been fixed in ZoL and never made it back to Illumos and thus FreeBSD. This state of affairs has led to a general agreement among the stakeholders that I have spoken to that it makes sense to rebase FreeBSD’s ZFS on ZoL. Brian Behlendorf has graciously encouraged me to add FreeBSD support directly to ZoL https://github.com/zfsonfreebsd/ZoF so that we might all have a single shared code base.\nA port for ZoF can be found at https://github.com/miwi-fbsd/zof-port Before it can be committed some additional functionality needs to be added to the FreeBSD opencrypto framework. These can be found at https://reviews.freebsd.org/D18520\nThis port will provide FreeBSD users with multi modifier protection, project quotas, encrypted datasets, allocation classes, vectorized raidz, vectorized checksums, and various command line improvements.\n\n\n\nFreeBSD Quarterly Status Update\n\nWith FreeBSD having gone all the way to 12, it is perhaps useful to take a look back at all the things that have been accomplished, in terms of many visible changes, as well as all the things that happen behind the scenes to ensure that FreeBSD continues to offer an alternative in both design, implementation, and execution.\nThe things you can look forward to reading about are too numerous to summarize, but cover just about everything from finalizing releases, administrative work, optimizations and depessimizations, features added and fixed, and many areas of improvement that might just surprise you a little.\nPlease have a cup of coffee, tea, hot cocoa, or other beverage of choice, and enjoy this culmulative set of reports covering everything that’s been done since October, 2017.\n—Daniel Ebdrup\n\n\n\nNews Roundup\n\nOne year of flying with the Raven: Ready for the Desktop?\n\nIt has been a little over one year now that I’m with the Ravenports project. Time to reflect my involvement, my expectations and hopes.\n\n\n    Ravenports\n\n\nRavenports is a universal packaging framework for *nix operating systems. For the user it provides easy access to binary packages of common software for multiple platforms. It has been the long-lasting champion on Repology’s top 10 repositories regarding package freshness (rarely dropping below 96 percent while all other projects keep below 90!).\n\nFor the porter it offers a well-designed and elegant means of writing cross-platform buildsheets that allow building the same version of the software with (completely or mostly) the same compile-time configuration on different operating systems or distributions.\n\nAnd for the developer it means a real-world project that’s written in modern Ada (ravenadm) and C (pkg) – as well as some Perl for support scripts and make. Things feel very optimized and fast. Not being a programmer though, I cannot really say anything about the actual code and thus leave it to the interested reader’s judgement.\n\n\n\nModern KDE on FreeBSD\n\nNew stuff in the official FreeBSD repositories! The X11 team has landed a newer version of libinput, opening up the way for KDE Plasma 5.14 in ports. That’s a pretty big update and it may frighten people with a new wallpaper.\nWhat this means is that the graphical stack is once again on-par with what Plasma upstream expects, and we can get back to chasing releases as soon as they happen, rather than gnashing our teeth at missing dependencies. The KDE-FreeBSD CI servers are in the process of being upgraded to 12-STABLE, and we’re integrating with the new experimental CI systems as well. This means we are chasing sensibly-modern systems (13-CURRENT is out of scope).\n\n\n\nThe many ways to launch FreeBSD in EC2\n\nTalking to FreeBSD users recently, I became aware that while I’ve created a lot of tools, I haven’t done a very good job of explaining how, and more importantly when to use them. So for all of the EC2-curious FreeBSD users out there: Here are the many ways to launch and configure FreeBSD in EC2 — ranging from the simplest to the most complicated (but most powerful):\n\n\n    Launch FreeBSD and SSH in\n    Launch FreeBSD and provide user-data\n    Use the AMI Builder to create a customized FreeBSD AMI\n    Build a FreeBSD AMI from a modified FreeBSD source tree\n    Build your own disk image\n\n\nI hope I’ve provided tools which help you to run FreeBSD in EC2, no matter how common or unusual your needs are. If you find my work useful, please consider supporting my work in this area; while this is both something I enjoy working on and something which is useful for my day job (Tarsnap, my online backup service), having support would make it easier for me to prioritize FreeBSD/EC2 issues over other projects.\n\n\n\nUsing the GOG.com installers for Linux, on NetBSD\n\nGOG.com prefers that you use their GOG Galaxy desktop app to download, install and manage all of your GOG games. But customers always have the option to install the game on their own terms, with a platform-specific installer.\nGOG offers these installers for Mac, Windows and/or Linux, depending on which platforms the game is available for.\n\n\n    The installers truly are platform-specific:\n    macOS games are distributed in a standard .pkg\n    Windows games are distributed in a setup wizard .exe\n    Linux games are distributed in a goofy shell archive\n\n\nOf course, none of those are NetBSD. So, if I wanted to even attempt to play a game distributed by GOG.com on NetBSD, which one should I pick? The obvious choice is the Linux installer, since Linux is the most similar to NetBSD, right? Au contraire! In practice, I found that it is easier to download the Windows installer.\n\nHere’s what I mean. For example, I ported the open source version of Aquaria to pkgsrc, but that package is only the game’s engine, not the multimedia data. The multimedia data is still copyrighted. Therefore, you need to get it from somewhere else. GOG is usually a good choice, because they distribute their games without DRM. And as mentioned earlier, picking the Linux installer seemed like a natural choice.\n\nNow, actually PLAYING the games on NetBSD is a separate matter entirely. The game I’ve got here, though, my current obsession Pyre, is built with MonoGame and therefore could theoretically work on NetBSD, too, with the help of a library called FNA and a script for OpenBSD called fnaify. I do hope to create a pkgsrc package for FNA and port the fnaify script to NetBSD at some point.\n\n\n\nBeastie Bits\n\n\n    Software as a Reflection of Values With Bryan Cantrill\n    Collection of bmc talks, updated 2018\n    wump: incorrect wumpus movement probability\n    Debugging Rust with VSCode on FreeBSD\n    SMB/CIFS on FreeBSD\n    BSD Tattoo\n    pkgsrc-2018Q4 branch announcement\n    toying with wireguard on openbsd\n    new USB audio class v2.0 driver\n    Todd Mortimer Removing ROP Gadgets from OpenBSD EuroBSDCon 2018\n    OpenBSD 6.5 release page is online\n    shell access to historical Unix versions in your browser\n\n\n\n\nFeedback/Questions\n\n\n    Brad - ZFS Features and Upgrades\n    Andre - Splitting ZFS array\n    Michael - Priority/nice value for Jails?\n\n\n\n\n\n    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p><span style=\"font-weight: 400;\">The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.</span></p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html\">The future of ZFS in FreeBSD</a></h3>\n\n<blockquote>The sources for FreeBSD’s ZFS support are currently taken directly from Illumos with local ifdefs to support the peculiarities of FreeBSD where the Solaris Portability Layer (SPL) shims fall short. FreeBSD has regularly pulled changes from Illumos and tried to push back any bug fixes and new features done in the context of FreeBSD. In the past few years the vast majority of new development in ZFS has taken place in DelphixOS and zfsonlinux (ZoL). Earlier this year Delphix announced that they will be moving to ZoL: <a href=\"https://www.delphix.com/blog/kickoff-future-eko-2018\">https://www.delphix.com/blog/kickoff-future-eko-2018</a> This shift means that there will be little to no net new development of Illumos. While working through the git history of ZoL I have also discovered that many races and locking bugs have been fixed in ZoL and never made it back to Illumos and thus FreeBSD. This state of affairs has led to a general agreement among the stakeholders that I have spoken to that it makes sense to rebase FreeBSD’s ZFS on ZoL. Brian Behlendorf has graciously encouraged me to add FreeBSD support directly to ZoL <a href=\"https://github.com/zfsonfreebsd/ZoF\">https://github.com/zfsonfreebsd/ZoF</a> so that we might all have a single shared code base.\nA port for ZoF can be found at <a href=\"https://github.com/miwi-fbsd/zof-port\">https://github.com/miwi-fbsd/zof-port</a> Before it can be committed some additional functionality needs to be added to the FreeBSD opencrypto framework. These can be found at <a href=\"https://reviews.freebsd.org/D18520\">https://reviews.freebsd.org/D18520</a>\nThis port will provide FreeBSD users with multi modifier protection, project quotas, encrypted datasets, allocation classes, vectorized raidz, vectorized checksums, and various command line improvements.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.freebsd.org/news/status/report-2018-01-2018-09.html\">FreeBSD Quarterly Status Update</a></h3>\n\n<blockquote>With FreeBSD having gone all the way to 12, it is perhaps useful to take a look back at all the things that have been accomplished, in terms of many visible changes, as well as all the things that happen behind the scenes to ensure that FreeBSD continues to offer an alternative in both design, implementation, and execution.\nThe things you can look forward to reading about are too numerous to summarize, but cover just about everything from finalizing releases, administrative work, optimizations and depessimizations, features added and fixed, and many areas of improvement that might just surprise you a little.\nPlease have a cup of coffee, tea, hot cocoa, or other beverage of choice, and enjoy this culmulative set of reports covering everything that’s been done since October, 2017.\n—Daniel Ebdrup</blockquote>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://eerielinux.wordpress.com/2018/11/30/one-year-of-flying-with-the-raven-ready-for-the-desktop/\">One year of flying with the Raven: Ready for the Desktop?</a></h3>\n\n<blockquote>It has been a little over one year now that I’m with the Ravenports project. Time to reflect my involvement, my expectations and hopes.</blockquote>\n\n<ul>\n    <li>Ravenports</li>\n</ul>\n\n<blockquote>Ravenports is a universal packaging framework for *nix operating systems. For the user it provides easy access to binary packages of common software for multiple platforms. It has been the long-lasting champion on Repology’s top 10 repositories regarding package freshness (rarely dropping below 96 percent while all other projects keep below 90!).</blockquote>\n\n<blockquote>For the porter it offers a well-designed and elegant means of writing cross-platform buildsheets that allow building the same version of the software with (completely or mostly) the same compile-time configuration on different operating systems or distributions.</blockquote>\n\n<blockquote>And for the developer it means a real-world project that’s written in modern Ada (ravenadm) and C (pkg) – as well as some Perl for support scripts and make. Things feel very optimized and fast. Not being a programmer though, I cannot really say anything about the actual code and thus leave it to the interested reader’s judgement.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://euroquis.nl/bobulate/?p=2040\">Modern KDE on FreeBSD</a></h3>\n\n<blockquote>New stuff in the official FreeBSD repositories! The X11 team has landed a newer version of libinput, opening up the way for KDE Plasma 5.14 in ports. That’s a pretty big update and it may frighten people with a new wallpaper.\nWhat this means is that the graphical stack is once again on-par with what Plasma upstream expects, and we can get back to chasing releases as soon as they happen, rather than gnashing our teeth at missing dependencies. The KDE-FreeBSD CI servers are in the process of being upgraded to 12-STABLE, and we’re integrating with the new experimental CI systems as well. This means we are chasing sensibly-modern systems (13-CURRENT is out of scope).</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"http://www.daemonology.net/blog/2018-12-26-the-many-ways-to-launch-FreeBSD-in-EC2.html\">The many ways to launch FreeBSD in EC2</a></h3>\n\n<blockquote>Talking to FreeBSD users recently, I became aware that while I’ve created a lot of tools, I haven’t done a very good job of explaining how, and more importantly when to use them. So for all of the EC2-curious FreeBSD users out there: Here are the many ways to launch and configure FreeBSD in EC2 — ranging from the simplest to the most complicated (but most powerful):</blockquote>\n\n<ul>\n    <li>Launch FreeBSD and SSH in</li>\n    <li>Launch FreeBSD and provide user-data</li>\n    <li>Use the AMI Builder to create a customized FreeBSD AMI</li>\n    <li>Build a FreeBSD AMI from a modified FreeBSD source tree</li>\n    <li>Build your own disk image</li>\n</ul>\n\n<blockquote>I hope I’ve provided tools which help you to run FreeBSD in EC2, no matter how common or unusual your needs are. If you find my work useful, please consider supporting my work in this area; while this is both something I enjoy working on and something which is useful for my day job (Tarsnap, my online backup service), having support would make it easier for me to prioritize FreeBSD/EC2 issues over other projects.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://dressupgeekout.blogspot.com/2018/12/using-gogcom-installers-for-linux-on.html\">Using the GOG.com installers for Linux, on NetBSD</a></h3>\n\n<blockquote><a href=\"http://GOG.com\">GOG.com</a> prefers that you use their GOG Galaxy desktop app to download, install and manage all of your GOG games. But customers always have the option to install the game on their own terms, with a platform-specific installer.\nGOG offers these installers for Mac, Windows and/or Linux, depending on which platforms the game is available for.</blockquote>\n\n<ul>\n    <li>The installers truly are platform-specific:</li>\n    <li>macOS games are distributed in a standard .pkg</li>\n    <li>Windows games are distributed in a setup wizard .exe</li>\n    <li>Linux games are distributed in a goofy shell archive</li>\n</ul>\n\n<blockquote>Of course, none of those are NetBSD. So, if I wanted to even attempt to play a game distributed by <a href=\"http://GOG.com\">GOG.com</a> on NetBSD, which one should I pick? The obvious choice is the Linux installer, since Linux is the most similar to NetBSD, right? Au contraire! In practice, I found that it is easier to download the Windows installer.</blockquote>\n\n<blockquote>Here’s what I mean. For example, I ported the open source version of Aquaria to pkgsrc, but that package is only the game’s engine, not the multimedia data. The multimedia data is still copyrighted. Therefore, you need to get it from somewhere else. GOG is usually a good choice, because they distribute their games without DRM. And as mentioned earlier, picking the Linux installer seemed like a natural choice.</blockquote>\n\n<blockquote>Now, actually PLAYING the games on NetBSD is a separate matter entirely. The game I’ve got here, though, my current obsession Pyre, is built with MonoGame and therefore could theoretically work on NetBSD, too, with the help of a library called FNA and a script for OpenBSD called fnaify. I do hope to create a pkgsrc package for FNA and port the fnaify script to NetBSD at some point.</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n    <li><a href=\"https://corecursive.com/024-software-as-a-reflection-of-values-with-bryan-cantrill/\">Software as a Reflection of Values With Bryan Cantrill</a></li>\n    <li><a href=\"http://dtrace.org/blogs/bmc/2018/02/03/talks/\">Collection of bmc talks, updated 2018</a></li>\n    <li><a href=\"https://marc.info/?l=openbsd-bugs&amp;m=154529364730319&amp;w=2\">wump: incorrect wumpus movement probability</a></li>\n    <li><a href=\"https://venshare.com/debugging-rust-with-vscode-on-freebsd/\">Debugging Rust with VSCode on FreeBSD</a></li>\n    <li><a href=\"https://vermaden.wordpress.com/2018/12/27/smb-cifs-on-freebsd/\">SMB/CIFS on FreeBSD</a></li>\n    <li><a href=\"https://old.reddit.com/r/freebsd/comments/aaihdk/bsd_tattoo/\">BSD Tattoo</a></li>\n    <li><a href=\"https://mail-index.netbsd.org/pkgsrc-users/2018/12/30/msg027871.html\">pkgsrc-2018Q4 branch announcement</a></li>\n    <li><a href=\"https://https.www.google.com.tedunangst.com/flak/post/toying-with-wireguard-on-openbsd\">toying with wireguard on openbsd</a></li>\n    <li><a href=\"https://marc.info/?l=openbsd-tech&amp;m=154627230907954&amp;w=2\">new USB audio class v2.0 driver</a></li>\n    <li><a href=\"https://www.youtube.com/watch?v=ZvSSHtRv5Mg\">Todd Mortimer Removing ROP Gadgets from OpenBSD EuroBSDCon 2018</a></li>\n    <li><a href=\"https://www.openbsd.org/65.html\">OpenBSD 6.5 release page is online</a></li>\n    <li><a href=\"https://twitter.com/jschauma/status/1071069217968013313?s=03\">shell access to historical Unix versions in your browser</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n    <li>Brad - <a href=\"http://dpaste.com/2CVAF1E#wrap\">ZFS Features and Upgrades</a></li>\n    <li>Andre - <a href=\"http://dpaste.com/1XXFPHN#wrap\">Splitting ZFS array</a></li>\n    <li>Michael - <a href=\"http://dpaste.com/2S8GFD0#wrap\">Priority/nice value for Jails?</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"<span style=\"font-weight: 400;\">The future of ZFS in FreeBSD, we pick highlights from the FreeBSD quarterly status report, flying with the raven, modern KDE on FreeBSD, many ways to launch FreeBSD in EC2, GOG installers on NetBSD, and more.</span>","date_published":"2019-01-03T11:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c90e3b38-be68-44fd-97cf-211579e33682.mp3","mime_type":"audio/mp3","size_in_bytes":56197307,"duration_in_seconds":5601}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-3070","title":"Episode 278: The Real McCoy | BSD Now 278","url":"https://www.bsdnow.tv/278","content_text":"We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.\n\n##Interview - Kirk McKusick - mckusick@mckusick.com\n25 years of FreeBSD\n\n\nHow Kirk got started in BSD, at the very beginning\nPredicting the Future\nHow the code and community grew\nThe leadership of the project, and how it changed over time\nUFS over the years (reading disks from 1982 in 2018)\nConferences\nThe rise and fall of Linux\nThe resurgence of FreeBSD\n\n\n\n\nWe want to extend a big thank you to the entire BSD community for making this show possible, and to all of our viewers for watching and providing the feedback that makes this show successful. We wish you all a happy and prosperous new year, and we’ll see you next week.\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.</p>\n\n<p>##Interview - Kirk McKusick - <a href=\"mailto:mckusick@mckusick.com\">mckusick@mckusick.com</a><br>\n25 years of FreeBSD</p>\n\n<ul>\n<li>How Kirk got started in BSD, at the very beginning</li>\n<li>Predicting the Future</li>\n<li>How the code and community grew</li>\n<li>The leadership of the project, and how it changed over time</li>\n<li>UFS over the years (reading disks from 1982 in 2018)</li>\n<li>Conferences</li>\n<li>The rise and fall of Linux</li>\n<li>The resurgence of FreeBSD</li>\n</ul>\n\n<p><hr></p>\n\n<p>We want to extend a big thank you to the entire BSD community for making this show possible, and to all of our viewers for watching and providing the feedback that makes this show successful. We wish you all a happy and prosperous new year, and we’ll see you next week.</p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"We sat down at BSDCan 2018 to interview Kirk McKusick about various topics ranging about the early years of Berkeley Unix, his continuing work on UFS, the governance of FreeBSD, and more.","date_published":"2018-12-27T04:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/20a1a3d9-9553-4eb3-a462-eb6f41b4fa5c.mp3","mime_type":"audio/mp3","size_in_bytes":29982521,"duration_in_seconds":2979}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-3058","title":"Episode 277: Nmap Level Up | BSD Now 277","url":"https://www.bsdnow.tv/277","content_text":"The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD's httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.\n\n##Headlines\n###Open Source Confronts its midlife crisis\n\n\nMidlife is tough: the idealism of youth has faded, as has inevitably some of its fitness and vigor. At the same time, the responsibilities of adulthood have grown. Making things more challenging, while you are navigating the turbulence of teenagers, your own parents are likely entering life’s twilight, needing help in new ways from their adult children. By midlife, in addition to the singular joys of life, you have also likely experienced its terrible sorrows: death, heartbreak, betrayal. Taken together, the fading of youth, the growth in responsibility and the endurance of misfortune can lead to cynicism or (worse) drastic and poorly thought-out choices. Add in a little fear of mortality and some existential dread, and you have the stuff of which midlife crises are made…\nI raise this not because of my own adventures at midlife, but because it is clear to me that open source — now several decades old and fully adult — is going through its own midlife crisis. This has long been in the making: for years, I (and others) have been critical of service providers’ parasitic relationship with open source, as cloud service providers turn open source software into a service offering without giving back to the communities upon which they implicitly depend. At the same time, open source has been (rightfully) entirely unsympathetic to the proprietary software models that have been burned to the ground — but also seemingly oblivious as to the larger economic waves that have buoyed them.\nSo it seemed like only a matter of time before the companies built around open source software would have to confront their own crisis of confidence: open source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it — and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source — the community, the positivity, the energy, the adoption, the downloads — but they also want to enjoy the fruits of proprietary software companies in software lock-in and its monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others (including CockroachDB’s Community License, MongoDB’s Server Side Public License, and Confluent’s Community License) are little better. And in particular, as it apparently needs to be said: no, “community” is not the opposite of “open source” — please stop sullying its good name by attaching it to licenses that are deliberately not open source! But even if they were more aptly named (e.g. “the restricted clause” or “the controlled use license” or — perhaps most honest of all — “the please-don’t-put-me-out-of-business-during-the-next-reInvent-keynote clause”), these licenses suffer from a serious problem: they are almost certainly asserting rights that the copyright holder doesn’t in fact have.\nIf I sell you a book that I wrote, I can restrict your right to read it aloud for an audience, or sell a translation, or write a sequel; these restrictions are rights afforded the copyright holder. I cannot, however, tell you that you can’t put the book on the same bookshelf as that of my rival, or that you can’t read the book while flying a particular airline I dislike, or that you aren’t allowed to read the book and also work for a company that competes with mine. (Lest you think that last example absurd, that’s almost verbatim the language in the new Confluent Community (sic) License.) I personally think that none of these licenses would withstand a court challenge, but I also don’t think it will come to that: because the vendors behind these licenses will surely fear that they wouldn’t survive litigation, they will deliberately avoid inviting such challenges. In some ways, this netherworld is even worse, as the license becomes a vessel for unverifiable fear of arbitrary liability.\nlet me put this to you as directly as possible: cloud services providers are emphatically not going to license your proprietary software. I mean, you knew that, right? The whole premise with your proprietary license is that you are finding that there is no way to compete with the operational dominance of the cloud services providers; did you really believe that those same dominant cloud services providers can’t simply reimplement your LDAP integration or whatever? The cloud services providers are currently reproprietarizing all of computing — they are making their own CPUs for crying out loud! — reimplementing the bits of your software that they need in the name of the service that their customers want (and will pay for!) won’t even move the needle in terms of their effort.\nWorse than all of this (and the reason why this madness needs to stop): licenses that are vague with respect to permitted use are corporate toxin. Any company that has been through an acquisition can speak of the peril of the due diligence license audit: the acquiring entity is almost always deep pocketed and (not unrelatedly) risk averse; the last thing that any company wants is for a deal to go sideways because of concern over unbounded liability to some third-party knuckle-head. So companies that engage in license tomfoolery are doing worse than merely not solving their own problem: they are potentially poisoning the wellspring of their own community.\nin the end, open source will survive its midlife questioning just as people in midlife get through theirs: by returning to its core values and by finding rejuvenation in its communities. Indeed, we can all find solace in the fact that while life is finite, our values and our communities survive us — and that our engagement with them is our most important legacy.\n\n\n\nSee the article for the rest\n\n\n\n\n###Donald Knuth - The Yoda of Silicon Valley\n\n\nFor half a century, the Stanford computer scientist Donald Knuth, who bears a slight resemblance to Yoda — albeit standing 6-foot-4 and wearing glasses — has reigned as the spirit-guide of the algorithmic realm.\nHe is the author of “The Art of Computer Programming,” a continuing four-volume opus that is his life’s work. The first volume debuted in 1968, and the collected volumes (sold as a boxed set for about $250) were included by American Scientist in 2013 on its list of books that shaped the last century of science — alongside a special edition of “The Autobiography of Charles Darwin,” Tom Wolfe’s “The Right Stuff,” Rachel Carson’s “Silent Spring” and monographs by Albert Einstein, John von Neumann and Richard Feynman.\nWith more than one million copies in print, “The Art of Computer Programming” is the Bible of its field. “Like an actual bible, it is long and comprehensive; no other book is as comprehensive,” said Peter Norvig, a director of research at Google. After 652 pages, volume one closes with a blurb on the back cover from Bill Gates: “You should definitely send me a résumé if you can read the whole thing.”\nThe volume opens with an excerpt from “McCall’s Cookbook”:\n\n\nHere is your book, the one your thousands of letters have asked us to publish. It has taken us years to do, checking and rechecking countless recipes to bring you only the best, only the interesting, only the perfect.\n\n\nInside are algorithms, the recipes that feed the digital age — although, as Dr. Knuth likes to point out, algorithms can also be found on Babylonian tablets from 3,800 years ago. He is an esteemed algorithmist; his name is attached to some of the field’s most important specimens, such as the Knuth-Morris-Pratt string-searching algorithm. Devised in 1970, it finds all occurrences of a given word or pattern of letters in a text — for instance, when you hit Command+F to search for a keyword in a document.\nNow 80, Dr. Knuth usually dresses like the youthful geek he was when he embarked on this odyssey: long-sleeved T-shirt under a short-sleeved T-shirt, with jeans, at least at this time of year. In those early days, he worked close to the machine, writing “in the raw,” tinkering with the zeros and ones.\n\n\n\nSee the article for the rest\n\n\n\n\n##News Roundup\n###Let’s Encrypt: Certbot For OpenBSD’s httpd\n\n\nIntro\n\n\n\nLet’s Encrypt is “a free, automated, and open Certificate Authority”.\nCertbot is “an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server”, well known as “the official Let’s Encrypt client”.\nI remember well how excited I felt when I read Let’s Encrypt’s “Our First Certificate Is Now Live” in 2015.\nHow wonderful the goal of them is; it’s to “give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free” “to create a more secure and privacy-respecting Web”!\nSince this year, they have begun to support even ACME v2 and Wildcard Certificate!\nWell, in OpenBSD as well as other operating systems, it’s easy and comfortable to have their big help 😊\n\n\n\nEnvironment\nOS: OpenBSD 6.4 amd64\nWeb Server: OpenBSD’s httpd\nCertification: Let’s Encrypt with Certbot 0.27\nReference: OpenBSD’s httpd\n\n\n\n\n###FreeBSD 12 released: Here is how to upgrade FreeBSD 11 to 12\n\n\nThe FreeBSD project announces the availability of FreeBSD 12.0-RELEASE. It is the first release of the stable/12 branch. The new version comes with updated software and features for a wild variety of architectures. The latest release provides performance improvements and better support for FreeBSD jails and more. One can benefit greatly using an upgraded version of FreeBSD.\n\n\n\nFreeBSD 12.0 supports amd64, i386, powerpc, powerpc64, powerpcspe, sparc64, armv6, armv7, and aarch64 architectures. One can run it on a standalone server or desktop system. Another option is to run it on Raspberry PI computer. FreeBSD 12 also runs on popular cloud service providers such as AWS EC2/Lightsail or Google compute VM.\n\n\n\n\nNew features and highlights:\n\n\nOpenSSL version 1.1.1a (LTS)\n\n\nOpenSSH server 7.8p1\n\n\nUnbound server 1.8.1\n\n\nClang and co 6.0.1\n\n\nThe FreeBSD installer supports EFI+GELI as an installation option\n\n\nVIMAGE FreeBSD kernel configuration option has been enabled by default. VIMAGE was the main reason I custom compiled FreeBSD for the last few years. No more custom compile for me.\n\n\nGraphics drivers for modern ATI/AMD and Intel graphics cards are now available in the FreeBSD ports collection\n\n\nZFS has been updated to include new sysctl(s), vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool scrub subcommand\n\n\nThe pf packet filter is now usable within a jail using vnet\n\n\nKDE updated to version 5.12.5\n\n\nThe NFS version 4.1 includes pNFS server support\n\n\nPerl 5.26.2\n\n\nThe default PAGER now defaults to less for most commands\n\n\nThe dd utility has been updated to add the status=progress option to match GNU/Linux dd command to show progress bar while running dd\n\n\nFreeBSD now supports ext4 for read/write operation\n\n\nPython 2.7\n\n\nmuch more\n\n\n\n\n\n###Six Ways to Level Up Your nmap Game\n\n\nnmap is a network exploration tool and security / port scanner.\nIf you’ve heard of it, and you’re like me, you’ve most likely used it like this:\nie, you’ve pointed it at an IP address and observed the output which tells you the open ports on a host.\nI used nmap like this for years, but only recently grokked the manual to see what else it could do. Here’s a quick look and some of the more useful things I found out.\n\n\n\n\n\nScan a Network\n\n\n\n\nScan All Ports\n\n\n\n\nGet service versions\n\n\n\n\nUse -A for more data\n\n\n\n\nFind out what nmap is up to\n\n\n\n\nScript your own scans with NSE\n\n\n\n\n\n\n###[NetBSD Desktop]\n\n\nPart 1: Manual NetBSD installation on GPT/UEFI\nNetBSD desktop pt.2: Set up wireless networking on NetBSD with wpa_supplicant and dhcpcd\nPart 3: Simple stateful firewall with NPF\nPart 4: 4: The X Display Manager (XDM)\nPart 5: automounting with Berkeley am-utils\n\n\n\n\n##Beastie Bits\n\n\nCall For Testing: ZFS on FreeBSD Project\nDragonFlyBSD 5.4.1 release within a week\nYou Can’t Opt Out of the Patent System. That’s Why Patent Pandas Was Created!\nAnnouncing Yggdrasil Network v0.3\nOpenBSD Network Engineer Job listing\nFreeBSD 12.0 Stable Version Released!\nLibreSSL 2.9.0 released\nLive stream test: Sgi Octane light bar repair / soldering!\nConfigure a FreeBSD Email Server Using Postfix, Dovecot, MySQL, DAVICAL and SpamAssassin\nBerkeley smorgasbord\nFOSDEM BSD Devroom schedule\n\n\n\n\n##Feedback/Questions\n\n\nWarren - Ep.273: OpenZFS on OS X\ncogoman - tarsnap security and using SSDs in raid\nAndrew - Portland BSD Pizza Night\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD&#39;s httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/\">Open Source Confronts its midlife crisis</a></p>\n\n<blockquote>\n<p>Midlife is tough: the idealism of youth has faded, as has inevitably some of its fitness and vigor. At the same time, the responsibilities of adulthood have grown. Making things more challenging, while you are navigating the turbulence of teenagers, your own parents are likely entering life’s twilight, needing help in new ways from their adult children. By midlife, in addition to the singular joys of life, you have also likely experienced its terrible sorrows: death, heartbreak, betrayal. Taken together, the fading of youth, the growth in responsibility and the endurance of misfortune can lead to cynicism or (worse) drastic and poorly thought-out choices. Add in a little fear of mortality and some existential dread, and you have the stuff of which midlife crises are made…<br>\nI raise this not because of my own adventures at midlife, but because it is clear to me that open source — now several decades old and fully adult — is going through its own midlife crisis. This has long been in the making: for years, I (and others) have been critical of service providers’ parasitic relationship with open source, as cloud service providers turn open source software into a service offering without giving back to the communities upon which they implicitly depend. At the same time, open source has been (rightfully) entirely unsympathetic to the proprietary software models that have been burned to the ground — but also seemingly oblivious as to the larger economic waves that have buoyed them.<br>\nSo it seemed like only a matter of time before the companies built around open source software would have to confront their own crisis of confidence: open source business models are really tough, selling software-as-a-service is one of the most natural of them, the cloud service providers are really good at it — and their commercial appetites seem boundless. And, like a new cherry red two-seater sports car next to a minivan in a suburban driveway, some open source companies are dealing with this crisis exceptionally poorly: they are trying to restrict the way that their open source software can be used. These companies want it both ways: they want the advantages of open source — the community, the positivity, the energy, the adoption, the downloads — but they also want to enjoy the fruits of proprietary software companies in software lock-in and its monopolistic rents. If this were entirely transparent (that is, if some bits were merely being made explicitly proprietary), it would be fine: we could accept these companies as essentially proprietary software companies, albeit with an open source loss-leader. But instead, these companies are trying to license their way into this self-contradictory world: continuing to claim to be entirely open source, but perverting the license under which portions of that source are available. Most gallingly, they are doing this by hijacking open source nomenclature. Of these, the laughably named commons clause is the worst offender (it is plainly designed to be confused with the purely virtuous creative commons), but others (including CockroachDB’s Community License, MongoDB’s Server Side Public License, and Confluent’s Community License) are little better. And in particular, as it apparently needs to be said: no, “community” is not the opposite of “open source” — please stop sullying its good name by attaching it to licenses that are deliberately not open source! But even if they were more aptly named (e.g. “the restricted clause” or “the controlled use license” or — perhaps most honest of all — “the please-don’t-put-me-out-of-business-during-the-next-reInvent-keynote clause”), these licenses suffer from a serious problem: they are almost certainly asserting rights that the copyright holder doesn’t in fact have.<br>\nIf I sell you a book that I wrote, I can restrict your right to read it aloud for an audience, or sell a translation, or write a sequel; these restrictions are rights afforded the copyright holder. I cannot, however, tell you that you can’t put the book on the same bookshelf as that of my rival, or that you can’t read the book while flying a particular airline I dislike, or that you aren’t allowed to read the book and also work for a company that competes with mine. (Lest you think that last example absurd, that’s almost verbatim the language in the new Confluent Community (sic) License.) I personally think that none of these licenses would withstand a court challenge, but I also don’t think it will come to that: because the vendors behind these licenses will surely fear that they wouldn’t survive litigation, they will deliberately avoid inviting such challenges. In some ways, this netherworld is even worse, as the license becomes a vessel for unverifiable fear of arbitrary liability.<br>\nlet me put this to you as directly as possible: cloud services providers are emphatically not going to license your proprietary software. I mean, you knew that, right? The whole premise with your proprietary license is that you are finding that there is no way to compete with the operational dominance of the cloud services providers; did you really believe that those same dominant cloud services providers can’t simply reimplement your LDAP integration or whatever? The cloud services providers are currently reproprietarizing all of computing — they are making their own CPUs for crying out loud! — reimplementing the bits of your software that they need in the name of the service that their customers want (and will pay for!) won’t even move the needle in terms of their effort.<br>\nWorse than all of this (and the reason why this madness needs to stop): licenses that are vague with respect to permitted use are corporate toxin. Any company that has been through an acquisition can speak of the peril of the due diligence license audit: the acquiring entity is almost always deep pocketed and (not unrelatedly) risk averse; the last thing that any company wants is for a deal to go sideways because of concern over unbounded liability to some third-party knuckle-head. So companies that engage in license tomfoolery are doing worse than merely not solving their own problem: they are potentially poisoning the wellspring of their own community.<br>\nin the end, open source will survive its midlife questioning just as people in midlife get through theirs: by returning to its core values and by finding rejuvenation in its communities. Indeed, we can all find solace in the fact that while life is finite, our values and our communities survive us — and that our engagement with them is our most important legacy.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.nytimes.com/2018/12/17/science/donald-knuth-computers-algorithms-programming.html\">Donald Knuth - The Yoda of Silicon Valley</a></p>\n\n<blockquote>\n<p>For half a century, the Stanford computer scientist Donald Knuth, who bears a slight resemblance to Yoda — albeit standing 6-foot-4 and wearing glasses — has reigned as the spirit-guide of the algorithmic realm.<br>\nHe is the author of “The Art of Computer Programming,” a continuing four-volume opus that is his life’s work. The first volume debuted in 1968, and the collected volumes (sold as a boxed set for about $250) were included by American Scientist in 2013 on its list of books that shaped the last century of science — alongside a special edition of “The Autobiography of Charles Darwin,” Tom Wolfe’s “The Right Stuff,” Rachel Carson’s “Silent Spring” and monographs by Albert Einstein, John von Neumann and Richard Feynman.<br>\nWith more than one million copies in print, “The Art of Computer Programming” is the Bible of its field. “Like an actual bible, it is long and comprehensive; no other book is as comprehensive,” said Peter Norvig, a director of research at Google. After 652 pages, volume one closes with a blurb on the back cover from Bill Gates: “You should definitely send me a résumé if you can read the whole thing.”<br>\nThe volume opens with an excerpt from “McCall’s Cookbook”:</p>\n</blockquote>\n\n<p><code>Here is your book, the one your thousands of letters have asked us to publish. It has taken us years to do, checking and rechecking countless recipes to bring you only the best, only the interesting, only the perfect.</code></p>\n\n<blockquote>\n<p>Inside are algorithms, the recipes that feed the digital age — although, as Dr. Knuth likes to point out, algorithms can also be found on Babylonian tablets from 3,800 years ago. He is an esteemed algorithmist; his name is attached to some of the field’s most important specimens, such as the Knuth-Morris-Pratt string-searching algorithm. Devised in 1970, it finds all occurrences of a given word or pattern of letters in a text — for instance, when you hit Command+F to search for a keyword in a document.<br>\nNow 80, Dr. Knuth usually dresses like the youthful geek he was when he embarked on this odyssey: long-sleeved T-shirt under a short-sleeved T-shirt, with jeans, at least at this time of year. In those early days, he worked close to the machine, writing “in the raw,” tinkering with the zeros and ones.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://dev.to/nabbisen/lets-encrypt-certbot-for-openbsds-httpd-3ofd\">Let’s Encrypt: Certbot For OpenBSD’s httpd</a></p>\n\n<ul>\n<li>Intro</li>\n</ul>\n\n<blockquote>\n<p>Let’s Encrypt is “a free, automated, and open Certificate Authority”.<br>\nCertbot is “an easy-to-use automatic client that fetches and deploys SSL/TLS certificates for your web server”, well known as “the official Let’s Encrypt client”.<br>\nI remember well how excited I felt when I read Let’s Encrypt’s “Our First Certificate Is Now Live” in 2015.<br>\nHow wonderful the goal of them is; it’s to “give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free” “to create a more secure and privacy-respecting Web”!<br>\nSince this year, they have begun to support even ACME v2 and Wildcard Certificate!<br>\nWell, in OpenBSD as well as other operating systems, it’s easy and comfortable to have their big help &#x1f60a;</p>\n</blockquote>\n\n<ul>\n<li>Environment</li>\n<li>OS: OpenBSD 6.4 amd64</li>\n<li>Web Server: OpenBSD’s httpd</li>\n<li>Certification: Let’s Encrypt with Certbot 0.27</li>\n<li>Reference: OpenBSD’s httpd</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.cyberciti.biz/open-source/freebsd-12-released-here-is-how-to-upgrade-freebsd/\">FreeBSD 12 released: Here is how to upgrade FreeBSD 11 to 12</a></p>\n\n<blockquote>\n<p>The FreeBSD project announces the availability of FreeBSD 12.0-RELEASE. It is the first release of the stable/12 branch. The new version comes with updated software and features for a wild variety of architectures. The latest release provides performance improvements and better support for FreeBSD jails and more. One can benefit greatly using an upgraded version of FreeBSD.</p>\n</blockquote>\n\n<blockquote>\n<p>FreeBSD 12.0 supports amd64, i386, powerpc, powerpc64, powerpcspe, sparc64, armv6, armv7, and aarch64 architectures. One can run it on a standalone server or desktop system. Another option is to run it on Raspberry PI computer. FreeBSD 12 also runs on popular cloud service providers such as AWS EC2/Lightsail or Google compute VM.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>New features and highlights:</p>\n</li>\n<li>\n<p>OpenSSL version 1.1.1a (LTS)</p>\n</li>\n<li>\n<p>OpenSSH server 7.8p1</p>\n</li>\n<li>\n<p>Unbound server 1.8.1</p>\n</li>\n<li>\n<p>Clang and co 6.0.1</p>\n</li>\n<li>\n<p>The FreeBSD installer supports EFI+GELI as an installation option</p>\n</li>\n<li>\n<p>VIMAGE FreeBSD kernel configuration option has been enabled by default. VIMAGE was the main reason I custom compiled FreeBSD for the last few years. No more custom compile for me.</p>\n</li>\n<li>\n<p>Graphics drivers for modern ATI/AMD and Intel graphics cards are now available in the FreeBSD ports collection</p>\n</li>\n<li>\n<p>ZFS has been updated to include new sysctl(s), vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool scrub subcommand</p>\n</li>\n<li>\n<p>The pf packet filter is now usable within a jail using vnet</p>\n</li>\n<li>\n<p>KDE updated to version 5.12.5</p>\n</li>\n<li>\n<p>The NFS version 4.1 includes pNFS server support</p>\n</li>\n<li>\n<p>Perl 5.26.2</p>\n</li>\n<li>\n<p>The default PAGER now defaults to less for most commands</p>\n</li>\n<li>\n<p>The dd utility has been updated to add the status=progress option to match GNU/Linux dd command to show progress bar while running dd</p>\n</li>\n<li>\n<p>FreeBSD now supports ext4 for read/write operation</p>\n</li>\n<li>\n<p>Python 2.7</p>\n</li>\n<li>\n<p>much more</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://zwischenzugs.com/2018/11/25/six-ways-to-level-up-your-nmap-game/\">Six Ways to Level Up Your nmap Game</a></p>\n\n<blockquote>\n<p>nmap is a network exploration tool and security / port scanner.<br>\nIf you’ve heard of it, and you’re like me, you’ve most likely used it like this:<br>\nie, you’ve pointed it at an IP address and observed the output which tells you the open ports on a host.<br>\nI used nmap like this for years, but only recently grokked the manual to see what else it could do. Here’s a quick look and some of the more useful things I found out.</p>\n</blockquote>\n\n<ul>\n<li>\n<ol>\n<li>Scan a Network</li>\n</ol>\n</li>\n<li>\n<ol start=\"2\">\n<li>Scan All Ports</li>\n</ol>\n</li>\n<li>\n<ol start=\"3\">\n<li>Get service versions</li>\n</ol>\n</li>\n<li>\n<ol start=\"4\">\n<li>Use -A for more data</li>\n</ol>\n</li>\n<li>\n<ol start=\"5\">\n<li>Find out what nmap is up to</li>\n</ol>\n</li>\n<li>\n<ol start=\"6\">\n<li>Script your own scans with NSE</li>\n</ol>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###[NetBSD Desktop]</p>\n\n<ul>\n<li><a href=\"https://unitedbsd.com/t/netbsd-desktop-part-1-manual-netbsd-installation-on-gpt-uefi/284\">Part 1: Manual NetBSD installation on GPT/UEFI</a></li>\n<li><a href=\"https://unitedbsd.com/t/netbsd-desktop-pt-2-set-up-wireless-networking-on-netbsd-with-wpa-supplicant-and-dhcpcd/281\">NetBSD desktop pt.2: Set up wireless networking on NetBSD with wpa_supplicant and dhcpcd</a></li>\n<li><a href=\"https://unitedbsd.com/t/netbsd-desktop-pt-3-simple-stateful-firewall-with-npf/286\">Part 3: Simple stateful firewall with NPF</a></li>\n<li><a href=\"https://unitedbsd.com/t/netbsd-desktop-pt-4-the-x-display-manager-xdm/292\">Part 4: 4: The X Display Manager (XDM)</a></li>\n<li><a href=\"https://unitedbsd.com/t/netbsd-desktop-pt-5-automounting-with-berkeley-am-utils/294/3\">Part 5: automounting with Berkeley am-utils</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-December/072422.html\">Call For Testing: ZFS on FreeBSD Project</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2018/12/18/22223.html\">DragonFlyBSD 5.4.1 release within a week</a></li>\n<li><a href=\"https://www.bunniestudios.com/blog/?p=5421\">You Can’t Opt Out of the Patent System. That’s Why Patent Pandas Was Created!</a></li>\n<li><a href=\"https://yggdrasil-network.github.io/2018/12/12/announcing-v0-3.html\">Announcing Yggdrasil Network v0.3</a></li>\n<li><a href=\"https://www.ziprecruiter.com/c/The-Good-Seed/Job/OpenBSD-Network-Engineer/-in-Los-Angeles,CA?jobid=35a52212-57d4d705\">OpenBSD Network Engineer Job listing</a></li>\n<li><a href=\"https://itsfoss.com/freebsd-12-release/\">FreeBSD 12.0 Stable Version Released!</a></li>\n<li><a href=\"http://bsdsec.net/articles/libressl-2-9-0-released\">LibreSSL 2.9.0 released</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=Nq8sLqtzCEQ\">Live stream test: Sgi Octane light bar repair / soldering!</a></li>\n<li><a href=\"https://www.sophimail.com/configure-freebsd-email-server-using-postfix-dovecot-mysql-spamassassin/\">Configure a FreeBSD Email Server Using Postfix, Dovecot, MySQL, DAVICAL and SpamAssassin</a></li>\n<li><a href=\"http://blog.obligd.com/posts/berkeley-smorgasbord.html\">Berkeley smorgasbord</a></li>\n<li><a href=\"https://fosdem.org/2019/schedule/track/bsd/\">FOSDEM BSD Devroom schedule</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Warren - <a href=\"http://dpaste.com/1V1XS01#wrap\">Ep.273: OpenZFS on OS X</a></li>\n<li>cogoman - <a href=\"http://dpaste.com/0P0MWFC#wrap\">tarsnap security and using SSDs in raid</a></li>\n<li>Andrew - <a href=\"http://dpaste.com/3H9M5M0\">Portland BSD Pizza Night</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"The Open Source midlife crisis, Donald Knuth The Yoda of Silicon Valley, Certbot For OpenBSD's httpd, how to upgrade FreeBSD from 11 to 12, level up your nmap game, NetBSD desktop, and more.","date_published":"2018-12-24T11:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d08b7671-6fa3-4a12-864e-9a65603b79ee.mp3","mime_type":"audio/mp3","size_in_bytes":46042591,"duration_in_seconds":4585}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-3028","title":"Episode 276: Ho, Ho, Ho - 12.0 | BSD Now 276","url":"https://www.bsdnow.tv/276","content_text":"FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.\n\n##Headlines\n###FreeBSD 12.0 is available\n\n\nAfter a long release cycle, the wait is over: FreeBSD 12.0 is now officially available.\nWe’ve picked a few interesting things to cover in the show, make sure to read the full Release Notes\n\n\n\nUserland:\nGroup permissions on /dev/acpi have been changed to allow users in the operator GID to invoke acpiconf(8) to suspend the system.\nThe default devfs.rules(5) configuration has been updated to allow mount_fusefs(8) with jail(8).\nThe default PAGER now defaults to less(1) for most commands.\nThe newsyslog(8) utility has been updated to reject configuration entries that specify setuid(2) or executable log files.\nThe WITH_REPRODUCIBLE_BUILD src.conf(5) knob has been enabled by default.\nA new src.conf(5) knob, WITH_RETPOLINE, has been added to enable the retpoline mitigation for userland builds.\nUserland applications:\nThe dtrace(1) utility has been updated to support if and else statements.\nThe legacy gdb(1) utility included in the base system is now installed to /usr/libexec for use with crashinfo(8). The gdbserver and gdbtui utilities are no longer installed. For interactive debugging, lldb(1) or a modern version of gdb(1) from devel/gdb should be used. A new src.conf(5) knob, WITHOUT_GDB_LIBEXEC has been added to disable building gdb(1). The gdb(1) utility is still installed in /usr/bin on sparc64.\nThe setfacl(1) utility has been updated to include a new flag, -R, used to operate recursively on directories.\nThe geli(8) utility has been updated to provide support for initializing multiple providers at once when they use the same passphrase and/or key.\nThe dd(1) utility has been updated to add the status=progress option, which prints the status of its operation on a single line once per second, similar to GNU dd(1).\nThe date(1) utility has been updated to include a new flag, -I, which prints its output in ISO 8601 formatting.\nThe bectl(8) utility has been added, providing an administrative interface for managing ZFS boot environments, similar to sysutils/beadm.\nThe bhyve(8) utility has been updated to add a new subcommand to the -l and -s flags, help, which when used, prints a list of supported LPC and PCI devices, respectively.\nThe tftp(1) utility has been updated to change the default transfer mode from ASCII to binary.\nThe chown(8) utility has been updated to prevent overflow of UID or GID arguments where the argument exceeded UID_MAX or GID_MAX, respectively.\nKernel:\nThe ACPI subsystem has been updated to implement Device object types for ACPI 6.0 support, required for some Dell, Inc. Poweredge™ AMD® Epyc™ systems.\nThe amdsmn(4) and amdtemp(4) drivers have been updated to attach to AMD® Ryzen 2™ host bridges.\nThe amdtemp(4) driver has been updated to fix temperature reporting for AMD® 2990WX CPUs.\nKernel Configuration:\nThe VIMAGE kernel configuration option has been enabled by default.\nThe dumpon(8) utility has been updated to add support for compressed kernel crash dumps when the kernel configuration file includes the GZIO option. See rc.conf(5) and dumpon(8) for additional information.\nThe NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations.\nDevice Drivers:\nThe random(4) driver has been updated to remove the Yarrow algorithm. The Fortuna algorithm remains the default, and now only, available algorithm.\nThe vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster.\nDeprecated Drivers:\nThe lmc(4) driver has been removed.\nThe ixgb(4) driver has been removed.\nThe nxge(4) driver has been removed.\nThe vxge(4) driver has been removed.\nThe jedec_ts(4) driver has been removed in 12.0-RELEASE, and its functionality replaced by jedec_dimm(4).\nThe DRM driver for modern graphics chipsets has been marked deprecated and marked for removal in FreeBSD 13. The DRM kernel modules are available from graphics/drm-stable-kmod or graphics/drm-legacy-kmod in the Ports Collection as well as via pkg(8). Additionally, the kernel modules have been added to the lua loader.conf(5) module_blacklist, as installation from the Ports Collection or pkg(8) is strongly recommended.\nThe following drivers have been deprecated in FreeBSD 12.0, and not present in FreeBSD 13.0: ae(4), de(4), ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), vx(4), wb(4), xe(4)\nStorage:\nThe UFS/FFS filesystem has been updated to support check hashes to cylinder-group maps. Support for check hashes is available only for UFS2.\nThe UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously.\nTRIM consolidation support has been enabled by default in the UFS/FFS filesystem. TRIM consolidation can be disabled by setting the vfs.ffs.dotrimcons sysctl(8) to 0, or adding vfs.ffs.dotrimcons=0 to sysctl.conf(5).\nNFS:\nThe NFS version 4.1 server has been updated to include pNFS server support.\nZFS:\nZFS has been updated to include new sysctl(8)s, vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool(8) scrub subcommand.\nThe new spacemap_v2 zpool feature has been added. This provides more efficient encoding of spacemaps, especially for full vdev spacemaps.\nThe large_dnode zpool feature been imported, allowing better compatibility with pools created under ZFS-on-Linux 0.7.x\nMany bug fixes have been applied to the device removal feature. This feature allows you to remove a non-redundant or mirror vdev from a pool by relocating its data to other vdevs.\nIncludes the fix for PR 229614 that could cause processes to hang in zil_commit()\nBoot Loader Changes:\nThe lua loader(8) has been updated to detect a list of installed kernels to boot.\nThe loader(8) has been updated to support geli(8) for all architectures and all disk-like devices.\nThe loader(8) has been updated to add support for loading Intel® microcode updates early during the boot process.\nNetworking:\nThe pf(4) packet filter is now usable within a jail(8) using vnet(9).\nThe pf(4) packet filter has been updated to use rmlock(9) instead of rwlock(9), resulting in significant performance improvements.\nThe SO_REUSEPORT_LB option has been added to the network stack, allowing multiple programs or threads to bind to the same port, and incoming connections load balanced using a hash function.\n\n\n\nAgain, read the release notes for a full list, check out the errata notices. A big THANKS to the entire release engineering team and all developers involved in the release, much appreciated!\n\n\n\n\n###Abandon Linux. Move to FreeBSD or Illumos\n\n\nIf you use GNU/Linux and you are only on opensource, you may be doing it wrong. Here’s why.\nIs your company based on opensource based software only? Do you have a bunch of developers hitting some kind of server you have installed for them to “do their thing”? Being it for economical reasons (remember to donate), being it for philosophycal ones, you may have skipped good alternatives. The BSD’s and Illumos.\nI bet you are running some sort of Debian, openSuSE or CentOS. It’s very discouraging having entered into the IT field recently and discover many of the people you meet do not even recognise the name BSD. Naming Solaris seems like naming the evil itself. The problem being many do not know why. They can’t point anything specific other than it’s fading out. This has recently shown strong when Oracle officials have stated development for new features has ceased and almost 90 % of developers for Solaris have been layed off. AIX seems alien to almost everybody unless you have a white beard. And all this is silly.\nAnd here’s why. You are certainly missing two important features that FreeBSD and Illumos derivatives are enjoying. A full virtualization technology, much better and fully developed compared to the LXC containers in the Linux world, such as Jails on BSD, Zones in Solaris/Illumos, and the great ZFS file system which both share.\nYou have probably heard of a new Linux filesystem named Btrfs, which by the way, development has been dropped from the Red Hat side. Trying to emulate ZFS, Oracle started developing Btrfs file system before they acquired Sun (the original developer of ZFS), and SuSE joined the effort as well as Red Hat. It is not as well developed as ZFS and it hasn’t been tested in production environments as extensively as the former has. That leaves some uncertainty on using it or not. Red Hat leaving it aside does add some more. Although some organizations have used it with various grades of success.\nBut why is this anyhow interesting for a sysadmin or any organization? Well… FreeBSD (descendant of Berkeley UNIX) and SmartOS (based on Illumos) aglutinate some features that make administration easier, safer, faster and more reliable. The dream of any systems administrator.\nTo start, the ZFS filesystem combines the typical filesystem with a volume manager. It includes protection against corruption, snapshots and copy-on-write clones, as well as volume manager.\nJails is another interesting piece of technology. Linux folks usually associate this as a sort of chroot. It isn’t. It is somehow inspired by it but as you may know you can escape from a chroot environment with a blink of an eye. Jails are not called jails casually. The name has a purpose. Contain processes and programs within a defined and totally controlled environment. Jails appeared first in FreeBSD in the year 2000. Solaris Zones debuted on 2005 (now called containers) are the now proprietary version of those.\nThere are some other technologies on Linux such as Btrfs or Docker. But they have some caveats. Btrfs hasn’t been fully developed yet and it’s hasn’t been proved as much in production environments as ZFS has. And some problems have arisen recently although the developers are pushing the envelope. At some time they will match ZFS capabilities for sure. Docker is growing exponentially and it’s one of the cool technologies of modern times. The caveat is, as before, the development of this technology hasn’t been fully developed. Unlike other virtualization technologies this is not a kernel playing on top of another kernel. This is virtualization at the OS level, meaning differentiated environments can coexist on a single host, “hitting” the same unique kernel which controls and shares the resources. The problem comes when you put Docker on top of any other virtualization technology such as KVM or Xen. It breaks the purpose of it and has a performance penalty.\nI have arrived into the IT field with very little knowledge, that is true. But what I see strikes me. Working in a bank has allowed me to see a big production environment that needs the highest of the availability and reliability. This is, sometimes, achieved by bruteforce. And it’s legitime and adequate. Redundancy has a reason and a purpose for example. But some other times it looks, it feels, like killing flies with cannons. More hardware, more virtual machines, more people, more of this, more of that. They can afford it, so they try to maintain the cost low but at the end of the day there is a chunky budget to back operations.\nBut here comes reality. You’re not a bank and you need to squeeze your investment as much as possible. By using FreeBSD jails you can avoid the performance penalty of KVM or Xen virtualization. Do you use VMWare or Hyper-V? You can avoid both and gain in performance. Not only that, control and manageability are equal as before, and sometimes easier to administer. There are four ways to operate them which can be divided in two categories. Hardcore and Human Being. For the Hardcore use the FreeBSD handbook and investigate as much as you can. For the Human Being way there are three options to use. Ezjail, Iocage and CBSD which are frameworks or programs as you may call to manage jails. I personally use Iocage but I have also used Ezjail.\nHow can you use jails on your benefit? Ever tried to configure some new software and failed miserably? You can have three different jails running at the same time with different configurations. Want to try a new configuration in a production piece of hardware without applying it on the final users? You can do that with a small jail while the production environment is on in another bigger, chunkier jail.\nWant to divide the hardware as a replica of the division of the team/s you are working with? Want to sell virtual machines with bare metal performance? Do you want to isolate some piece of critical software or even data in a more controlled environment? Do you have different clients and you want to use the same hardware but you want to avoid them seeing each other at the same time you maintain performance and reliability?\nAre you a developer and you have to have reliable and portable snapshots of your work? Do you want to try new options-designs without breaking your previous work, in a timeless fashion? You can work on something, clone the jail and apply the new ideas on the project in a matter of seconds. You can stop there, export the filesystem snapshot containing all the environment and all your work and place it on a thumbdrive to later import it on a big production system. Want to change that image properties such as the network stack interface and ip? This is just one command away from you.\nBut what properties can you assign to a jail and how can I manage them you may be wondering. Hostname, disk quota, i/o, memory, cpu limits, network isolation, network virtualization, snapshots and the manage of those, migration and root privilege isolation to name a few. You can also clone them and import and export them between different systems. Some of these things because of ZFS. Iocage is a python program to manage jails and it takes profit from ZFS advantages.\nBut FreeBSD is not Linux you may say. No it is not. There are no run levels. The systemd factor is out of this equation. This is so since the begginning. Ever wondered where did vi come from? The TCP/IP stack? Your beloved macOS from Apple? All this is coming from the FreeBSD project. If you are used to Linux your adaptation period with any BSD will be short, very short. You will almost feel at home. Used to packaged software using yum or apt-get? No worries. With pkgng, the package management tool used in FreeBSD has almost 27.000 compiled packages for you to use. Almost all software found on any of the important GNU/Linux distros can be found here. Java, Python, C, C++, Clang, GCC, Javascript frameworks, Ruby, PHP, MySQL and the major forks, etc. All this opensource software, and much more, is available at your fingertips.\nI am a developer and… frankly my time is money and I appreciate both much more than dealing with systems configuration, etc. You can set a VM using VMWare or VirtualBox and play with barebones FreeBSD or you can use TrueOS (a derivative) which comes in a server version and a desktop oriented one. The latter will be easier for you to play with. You may be doing this already with Linux. There is a third and very sensible option. FreeNAS, developed by iXSystems. It is FreeBSD based and offers all these technologies with a GUI. VMWare, Hyper-V? Nowadays you can get your hands off the CLI and get a decent, usable, nice GUI.\nYou say you play on the cloud. The major players already include FreeBSD in their offerings. You can find it in Amazon AWS or Azure (with official Microsoft support contracts too!). You can also find it in DigitalOcean and other hosting providers. There is no excuse. You can use it at home, at the office, with old or new hardware and in the cloud as well. You can even pay for a support contract to use it. Joyent, the developers of SmartOS have their own cloud with different locations around the globe. Have a look on them too.\nIf you want the original of ZFS and zones you may think of Solaris. But it’s fading away. But it really isn’t. When Oracle bouth Sun many people ran away in an stampide fashion. Some of the good folks working at Sun founded new projects. One of these is Illumos. Joyent is a company formed by people who developed these technologies. They are a cloud operator, have been recently bought by Samsung and have a very competent team of people providing great tech solutions. They have developed an OS, called SmartOS (based on Illumos) with all these features. The source from this goes back to the early days of UNIX. Do you remember the days of OpenSolaris when Sun opensourced the crown jewels? There you have it. A modern opensource UNIX operating system with the roots in their original place and the head planted on today’s needs.\nIn conclusion. If you are on GNU/Linux and you only use opensource software you may be doing it wrong. And missing goodies you may need and like. Once you put your hands on them, trust me, you won’t look back. And if you have some “old fashioned” admins who know Solaris, you can bring them to a new profitable and exciting life with both systems.\nStill not convinced? Would you have ever imagined Microsoft supporting Linux? Even loving it? They do love now FreeBSD. And not only that, they provide their own image in the Azure Cloud and you can get Microsoft support, payed support if you want to use the platform on Azure. Ain’t it… surprising? Convincing at all?\nPS: I haven’t mentioned both softwares, FreeBSD and SmartOS do have a Linux translation layer. This means you can run Linux binaries on them and the program won’t cough at all. Since the ABI stays stable the only thing you need to run a Linux binary is a translation between the different system calls and the libraries. Remember POSIX? Choose your poison and enjoy it.\n\n\n\n\n###A partly-cloudy IPsec VPN\n\n\nAudience\n\n\n\nI’m assuming that readers have at least a basic knowledge of TCP/IP networking and some UNIX or UNIX-like systems, but not necessarily OpenBSD or FreeBSD. This post will therefore be light on details that aren’t OS specific and are likely to be encountered in normal use (e.g., how to use vi or another text editor.) For more information on these topics, read Absolute FreeBSD (3ed.) by Michael W. Lucas.\n\n\n\nOverview\n\n\n\nI’m redoing my DigitalOcean virtual machines (which they call droplets). My requirements are:\n\n\n\nVPN\nRoad-warrior access, so I can use private network resources from anywhere.\nA site-to-site VPN, extending my home network to my VPSes.\nHosting for public and private network services.\nA proxy service to provide a public IP address to services hosted at home.\n\n\n\nThe last item is on the list because I don’t actually have a public IP address at home; my firewall’s external address is in the RFC 1918 space, and the entire apartment building shares a single public IPv4 address.1 (IPv6? Don’t I wish.) The end-state network will include one OpenBSD droplet providing firewall, router, and VPN services; and one FreeBSD droplet hosting multiple jailed services.\nI’ll be providing access via these droplets to a NextCloud instance at home. A simple NAT on the DO router droplet isn’t going to work, because packets going from home to the internet would exit through the apartment building’s connection and not through the VPN. It’s possible that I could do work around this issue with packet tagging using the pf firewall, but HAProxy is simple to configure and unlikely to result in hard-to-debug problems. relayd is also an option, but doesn’t have the TLS parsing abilities of HAProxy, which I’ll be using later on.\nSince this system includes jails running on a VPS, and they’ve got RFC 1918 addresses, I want them reachable from my home network. Once that’s done, I can access the private address space from anywhere through a VPN connection to the cloudy router.\nThe VPN itself will be of the IPsec variety. IPsec is the traditional enterprise VPN standard, and is even used for classified applications, but has a (somewhat-deserved) reputation for complexity, but recent versions of OpenBSD turn down the difficulty by quite a bit.\n\n\n\nThe end-state network should look like: https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg\n\n\n\nThis VPN both separates internal network traffic from public traffic and uses encryption to prevent interception or tampering.\nOnce traffic has been encrypted, decrypting it without the key would, as Bruce Schneier once put it, require a computer built from something other than matter that occupies something other than space. Dyson spheres and a frakton of causality violation would possibly work, as would mathemagical technology that alters the local calendar such that P=NP.2 Black-bag jobs and/or suborning cloud provider employees doesn’t quite have that guarantee of impossibility, however. If you have serious security requirements, you’ll need to do better than a random blog entry.\n\n\n\n\n##News Roundup\n###KLEAK: Practical Kernel Memory Disclosure Detection\n\n\nModern operating systems such as NetBSD, macOS, and Windows isolate their kernel from userspace programs to increase fault tolerance and to protect against malicious manipulations [10]. User space programs have to call into the kernel to request resources, via system calls or ioctls. This communication between user space and kernel space crosses a security boundary. Kernel memory disclosures - also known as kernel information leaks - denote the inadvertent copying of uninitialized bytes from kernel space to user space.  Such disclosed memory may contain cryptographic keys, information about the kernel memory layout, or other forms of secret data. Even though kernel memory disclosures do not allow direct exploitation of a system, they lay the ground for it.\nWe introduce KLEAK, a simple approach to dynamically detect kernel information leaks. Simply said, KLEAK utilizes a rudimentary form of taint tracking: it taints kernel memory with marker values, lets the data travel through the kernel and scans the buffers exchanged between the kernel and the user space for these marker values. By using compiler instrumentation and rotating the markers at regular intervals, KLEAK significantly reduces the number of false positives, and is able to yield relevant results with little effort.\nOur  approach is practically feasible as we prove with an implementation for the NetBSD kernel. A small performance penalty is introduced, but the system remains usable. In addition to implementing KLEAK in the NetBSD kernel, we applied our approach to FreeBSD 11.2. In total,  we detected 21 previously unknown kernel memory disclosures in NetBSD-current and FreeBSD 11.2, which were fixed subsequently. As a follow-up, the projects’ developers manually audited related kernel areas and identified dozens of other kernel memory disclosures.\nThe remainder of this paper is structured as follows. Section II discusses the bug class of kernel memory disclosures. Section III presents KLEAK to dynamically detect instances of this bug class. Section IV discusses the results of applying KLEAK to NetBSD-current and FreeBSD 11.2. Section V reviews prior research. Finally, Section VI concludes this paper.\n\n\n\n\n###How To Create Official Synth Repo\n\n\n\nSystem Environment\n\n\nMake sure /usr/dports is updated and that it contains no cruft (git pull; git status). Remove any cruft.\n\n\nMake sure your ‘synth’ is up-to-date ‘pkg upgrade synth’. If you already updated your system you may have to build synth from scratch, from /usr/dports/ports-mgmt/synth.\n\n\nMake sure /etc/make.conf is clean.\n\n\nUpdate /usr/src to the current master, make sure there is no cruft in it\n\n\nDo a full buildworld, buildkernel, installkernel and installworld\n\n\nReboot\n\n\nAfter the reboot, before proceeding, run ‘uname -a’ and make sure you are now on the desired release or development kernel.\n\n\nSynth Environment\n\n\n/usr/local/etc/synth/ contains the synth configuration. It should contain a synth.ini file (you may have to rename the template), and you will have to create or edit a LiveSystem-make.conf file.\n\n\nSystem requirements are hefty. Just linking chromium alone eats at least 30GB, for example. Concurrent c++ compiles can eat up to 2GB per process. We recommend at least 100GB of SSD based swap space and 300GB of free space on the filesystem.\n\n\nsynth.ini should contain this. Plus modify the builders and jobs to suit your system. With 128G of ram, 30/30 or 40/25 works well. If you have 32G of ram, maybe 8/8 or less.\n\n\n\n; Take care when hand editing!\n\n[Global Configuration]\nprofile_selected= LiveSystem\n\n[LiveSystem]\nOperating_system= DragonFly\nDirectory_packages= /build/synth/live_packages\nDirectory_repository= /build/synth/live_packages/All\nDirectory_portsdir= /build/synth/dports\nDirectory_options= /build/synth/options\nDirectory_distfiles= /usr/distfiles\nDirectory_buildbase= /build/synth/build\nDirectory_logs= /build/synth/logs\nDirectory_ccache= disabled\nDirectory_system= /\nNumber_of_builders= 30\nMax_jobs_per_builder= 30\nTmpfs_workdir= true\nTmpfs_localbase= true\nDisplay_with_ncurses= true\nleverage_prebuilt= false\n\n\nLiveSystem-make.conf should contain one line to restrict licensing to only what is allowed to be built as a binary package:\n\n\nLICENSES_ACCEPTED= NONE\n\n\n\nMake sure there is no other cruft in /usr/local/etc/synth/\n\n\nIn the example above, the synth working dirs are in “/build/synth”. Make sure the base directories exist. Clean out any cruft for a fresh build from-scratch:\n\n\n\nrm -rf /build/synth/live_packages/*\nrm -rf /build/synth/logs\nmkdir /build/synth/logs\n\n\nRun synth everything. I recommend doing this in a ‘screen’ session in case you lose your ssh session (assuming you are ssh’d into the build machine).\n\n\n(optionally start a screen session)\nsynth everything\n\n\nA full synth build takes over 24 hours to run on a 48-core box, around 12 hours to run on a 64-core box. On a 4-core/8-thread box it will take at least 3 days. There will be times when swap space is heavily used. If you have not run synth before, monitor your memory and swap loads to make sure you have configured the jobs properly. If you are overloading the system, you may have to ^C the synth run, reduce the jobs, and start it again. It will pick up where it left off.\nWhen synth finishes, let it rebuild the database. You then have a working binary repo.\nIt is usually a good idea to run synth several times to pick up any stuff it couldn’t build the first time. Each of these incremental runs may take a few hours, depending on what it tries to build.\n\n\n\n\n###Interview with founder and maintainer of GhostBSD, Eric Turgeon\n\n\nThanks you Eric for taking part. To start off, could you  tell us a little about yourself, just a bit of background?\nHow did you become interested in open source?\nWhen and how did you get interested in the BSD operating systems?\nOn your Twitter profile, you state that you are an automation engineer at iXsystems. Can you share what you do in your day-to-day job?\nYou are the founder and project lead of GhostBSD. Could you describe GhostBSD to those who have never used it or never heard of it?\nDeveloping an operating system is not a small thing. What made you decide to start the GhostBSD project and not join another “desktop FreeBSD” related project, such as PC-BSD and DesktopBSD at the time?\nHow did you get to the name GhostBSD? Did you consider any other names?\nYou recently released GhostBSD 18.10? What’s new in that version and what are the key features? What has changed since GhostBSD 11.1?\nThe current version is 18.10. Will the next version be 19.04 (like Ubuntu’s version numbering), or is a new version released after the next stable TrueOS release\nCan you tell us something about the development team? Is it yourself, or are there other core team members? I think I saw two other developers on your Github project page.\nHow about the relationship with the community? Is it possible for a community member to contribute, and how are those contributions handled?\nWhat was the biggest challenge during development?\nIf you had to pick one feature readers should check out in GhostBSD, what is it and why?\nWhat is the relationship between iXsystems and the GhostBSD project? Or is GhostBSD a hobby project that you run separately from your work at iXsystems?\nWhat is the relationship between GhostBSD and TrueOS? Is GhostBSD TrueOS with the MATE desktop on top, or are there other modifications, additions, and differences?\nWhere does GhostBSD go from here? What are your plans for 2019?\nIs there anything else that wasn’t asked or that you want to share?\n\n\n\n\n##Beastie Bits\n\n\ndialog(1) script to select audio output on FreeBSD\nErlang otp on OpenBSD\nCapsicum\nhttps://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html\nIntroduction to µUBSan - a clean-room reimplementation of the Undefined Behavior Sanitizer runtime\npkgsrcCon 2018 in Berlin - Videos\nGetting started with drm-kmod\n\n\n\n\n##Feedback/Questions\n\n\nMalcolm - Show segment idea\nFraser - Question: FreeBSD official binary package options\nHarri - BSD Magazine\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.freebsd.org/releases/12.0R/relnotes.html\">FreeBSD 12.0 is available</a></p>\n\n<ul>\n<li>After a long release cycle, the wait is over: FreeBSD 12.0 is now officially available.</li>\n<li>We’ve picked a few interesting things to cover in the show, make sure to read the full <a href=\"https://www.freebsd.org/releases/12.0R/relnotes.html\">Release Notes</a></li>\n</ul>\n\n<blockquote>\n<p>Userland:<br>\nGroup permissions on /dev/acpi have been changed to allow users in the operator GID to invoke acpiconf(8) to suspend the system.<br>\nThe default devfs.rules(5) configuration has been updated to allow mount_fusefs(8) with jail(8).<br>\nThe default PAGER now defaults to less(1) for most commands.<br>\nThe newsyslog(8) utility has been updated to reject configuration entries that specify setuid(2) or executable log files.<br>\nThe WITH_REPRODUCIBLE_BUILD src.conf(5) knob has been enabled by default.<br>\nA new src.conf(5) knob, WITH_RETPOLINE, has been added to enable the retpoline mitigation for userland builds.<br>\nUserland applications:<br>\nThe dtrace(1) utility has been updated to support if and else statements.<br>\nThe legacy gdb(1) utility included in the base system is now installed to /usr/libexec for use with crashinfo(8). The gdbserver and gdbtui utilities are no longer installed. For interactive debugging, lldb(1) or a modern version of gdb(1) from devel/gdb should be used. A new src.conf(5) knob, WITHOUT_GDB_LIBEXEC has been added to disable building gdb(1). The gdb(1) utility is still installed in /usr/bin on sparc64.<br>\nThe setfacl(1) utility has been updated to include a new flag, -R, used to operate recursively on directories.<br>\nThe geli(8) utility has been updated to provide support for initializing multiple providers at once when they use the same passphrase and/or key.<br>\nThe dd(1) utility has been updated to add the status=progress option, which prints the status of its operation on a single line once per second, similar to GNU dd(1).<br>\nThe date(1) utility has been updated to include a new flag, -I, which prints its output in ISO 8601 formatting.<br>\nThe bectl(8) utility has been added, providing an administrative interface for managing ZFS boot environments, similar to sysutils/beadm.<br>\nThe bhyve(8) utility has been updated to add a new subcommand to the -l and -s flags, help, which when used, prints a list of supported LPC and PCI devices, respectively.<br>\nThe tftp(1) utility has been updated to change the default transfer mode from ASCII to binary.<br>\nThe chown(8) utility has been updated to prevent overflow of UID or GID arguments where the argument exceeded UID_MAX or GID_MAX, respectively.<br>\nKernel:<br>\nThe ACPI subsystem has been updated to implement Device object types for ACPI 6.0 support, required for some Dell, Inc. Poweredge™ AMD® Epyc™ systems.<br>\nThe amdsmn(4) and amdtemp(4) drivers have been updated to attach to AMD® Ryzen 2™ host bridges.<br>\nThe amdtemp(4) driver has been updated to fix temperature reporting for AMD® 2990WX CPUs.<br>\nKernel Configuration:<br>\nThe VIMAGE kernel configuration option has been enabled by default.<br>\nThe dumpon(8) utility has been updated to add support for compressed kernel crash dumps when the kernel configuration file includes the GZIO option. See rc.conf(5) and dumpon(8) for additional information.<br>\nThe NUMA option has been enabled by default in the amd64 GENERIC and MINIMAL kernel configurations.<br>\nDevice Drivers:<br>\nThe random(4) driver has been updated to remove the Yarrow algorithm. The Fortuna algorithm remains the default, and now only, available algorithm.<br>\nThe vt(4) driver has been updated with performance improvements, drawing text at rates ranging from 2- to 6-times faster.<br>\nDeprecated Drivers:<br>\nThe lmc(4) driver has been removed.<br>\nThe ixgb(4) driver has been removed.<br>\nThe nxge(4) driver has been removed.<br>\nThe vxge(4) driver has been removed.<br>\nThe jedec_ts(4) driver has been removed in 12.0-RELEASE, and its functionality replaced by jedec_dimm(4).<br>\nThe DRM driver for modern graphics chipsets has been marked deprecated and marked for removal in FreeBSD 13. The DRM kernel modules are available from graphics/drm-stable-kmod or graphics/drm-legacy-kmod in the Ports Collection as well as via pkg(8). Additionally, the kernel modules have been added to the lua loader.conf(5) module_blacklist, as installation from the Ports Collection or pkg(8) is strongly recommended.<br>\nThe following drivers have been deprecated in FreeBSD 12.0, and not present in FreeBSD 13.0: ae(4), de(4), ed(4), ep(4), ex(4), fe(4), pcn(4), sf(4), sn(4), tl(4), tx(4), txp(4), vx(4), wb(4), xe(4)<br>\nStorage:<br>\nThe UFS/FFS filesystem has been updated to support check hashes to cylinder-group maps. Support for check hashes is available only for UFS2.<br>\nThe UFS/FFS filesystem has been updated to consolidate TRIM/BIO_DELETE commands, reducing read/write requests due to fewer TRIM messages being sent simultaneously.<br>\nTRIM consolidation support has been enabled by default in the UFS/FFS filesystem. TRIM consolidation can be disabled by setting the vfs.ffs.dotrimcons sysctl(8) to 0, or adding vfs.ffs.dotrimcons=0 to sysctl.conf(5).<br>\nNFS:<br>\nThe NFS version 4.1 server has been updated to include pNFS server support.<br>\nZFS:<br>\nZFS has been updated to include new sysctl(8)s, vfs.zfs.arc_min_prefetch_ms and vfs.zfs.arc_min_prescient_prefetch_ms, which improve performance of the zpool(8) scrub subcommand.<br>\nThe new spacemap_v2 zpool feature has been added. This provides more efficient encoding of spacemaps, especially for full vdev spacemaps.<br>\nThe large_dnode zpool feature been imported, allowing better compatibility with pools created under ZFS-on-Linux 0.7.x<br>\nMany bug fixes have been applied to the device removal feature. This feature allows you to remove a non-redundant or mirror vdev from a pool by relocating its data to other vdevs.<br>\nIncludes the fix for PR 229614 that could cause processes to hang in zil_commit()<br>\nBoot Loader Changes:<br>\nThe lua loader(8) has been updated to detect a list of installed kernels to boot.<br>\nThe loader(8) has been updated to support geli(8) for all architectures and all disk-like devices.<br>\nThe loader(8) has been updated to add support for loading Intel® microcode updates early during the boot process.</p>\n<p>Networking:<br>\nThe pf(4) packet filter is now usable within a jail(8) using vnet(9).<br>\nThe pf(4) packet filter has been updated to use rmlock(9) instead of rwlock(9), resulting in significant performance improvements.<br>\nThe SO_REUSEPORT_LB option has been added to the network stack, allowing multiple programs or threads to bind to the same port, and incoming connections load balanced using a hash function.</p>\n</blockquote>\n\n<ul>\n<li>Again, read the release notes for a full list, check out the <a href=\"https://www.freebsd.org/releases/12.0R/errata.html\">errata notices</a>. A big THANKS to the entire release engineering team and all developers involved in the release, much appreciated!</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.adminbyaccident.com/politics/abandon-linux-move-freebsd-illumos/\">Abandon Linux. Move to FreeBSD or Illumos</a></p>\n\n<blockquote>\n<p>If you use GNU/Linux and you are only on opensource, you may be doing it wrong. Here’s why.<br>\nIs your company based on opensource based software only? Do you have a bunch of developers hitting some kind of server you have installed for them to “do their thing”? Being it for economical reasons (remember to donate), being it for philosophycal ones, you may have skipped good alternatives. The BSD’s and Illumos.<br>\nI bet you are running some sort of Debian, openSuSE or CentOS. It’s very discouraging having entered into the IT field recently and discover many of the people you meet do not even recognise the name BSD. Naming Solaris seems like naming the evil itself. The problem being many do not know why. They can’t point anything specific other than it’s fading out. This has recently shown strong when Oracle officials have stated development for new features has ceased and almost 90 % of developers for Solaris have been layed off. AIX seems alien to almost everybody unless you have a white beard. And all this is silly.<br>\nAnd here’s why. You are certainly missing two important features that FreeBSD and Illumos derivatives are enjoying. A full virtualization technology, much better and fully developed compared to the LXC containers in the Linux world, such as Jails on BSD, Zones in Solaris/Illumos, and the great ZFS file system which both share.<br>\nYou have probably heard of a new Linux filesystem named Btrfs, which by the way, development has been dropped from the Red Hat side. Trying to emulate ZFS, Oracle started developing Btrfs file system before they acquired Sun (the original developer of ZFS), and SuSE joined the effort as well as Red Hat. It is not as well developed as ZFS and it hasn’t been tested in production environments as extensively as the former has. That leaves some uncertainty on using it or not. Red Hat leaving it aside does add some more. Although some organizations have used it with various grades of success.<br>\nBut why is this anyhow interesting for a sysadmin or any organization? Well… FreeBSD (descendant of Berkeley UNIX) and SmartOS (based on Illumos) aglutinate some features that make administration easier, safer, faster and more reliable. The dream of any systems administrator.<br>\nTo start, the ZFS filesystem combines the typical filesystem with a volume manager. It includes protection against corruption, snapshots and copy-on-write clones, as well as volume manager.<br>\nJails is another interesting piece of technology. Linux folks usually associate this as a sort of chroot. It isn’t. It is somehow inspired by it but as you may know you can escape from a chroot environment with a blink of an eye. Jails are not called jails casually. The name has a purpose. Contain processes and programs within a defined and totally controlled environment. Jails appeared first in FreeBSD in the year 2000. Solaris Zones debuted on 2005 (now called containers) are the now proprietary version of those.<br>\nThere are some other technologies on Linux such as Btrfs or Docker. But they have some caveats. Btrfs hasn’t been fully developed yet and it’s hasn’t been proved as much in production environments as ZFS has. And some problems have arisen recently although the developers are pushing the envelope. At some time they will match ZFS capabilities for sure. Docker is growing exponentially and it’s one of the cool technologies of modern times. The caveat is, as before, the development of this technology hasn’t been fully developed. Unlike other virtualization technologies this is not a kernel playing on top of another kernel. This is virtualization at the OS level, meaning differentiated environments can coexist on a single host, “hitting” the same unique kernel which controls and shares the resources. The problem comes when you put Docker on top of any other virtualization technology such as KVM or Xen. It breaks the purpose of it and has a performance penalty.<br>\nI have arrived into the IT field with very little knowledge, that is true. But what I see strikes me. Working in a bank has allowed me to see a big production environment that needs the highest of the availability and reliability. This is, sometimes, achieved by bruteforce. And it’s legitime and adequate. Redundancy has a reason and a purpose for example. But some other times it looks, it feels, like killing flies with cannons. More hardware, more virtual machines, more people, more of this, more of that. They can afford it, so they try to maintain the cost low but at the end of the day there is a chunky budget to back operations.<br>\nBut here comes reality. You’re not a bank and you need to squeeze your investment as much as possible. By using FreeBSD jails you can avoid the performance penalty of KVM or Xen virtualization. Do you use VMWare or Hyper-V? You can avoid both and gain in performance. Not only that, control and manageability are equal as before, and sometimes easier to administer. There are four ways to operate them which can be divided in two categories. Hardcore and Human Being. For the Hardcore use the FreeBSD handbook and investigate as much as you can. For the Human Being way there are three options to use. Ezjail, Iocage and CBSD which are frameworks or programs as you may call to manage jails. I personally use Iocage but I have also used Ezjail.<br>\nHow can you use jails on your benefit? Ever tried to configure some new software and failed miserably? You can have three different jails running at the same time with different configurations. Want to try a new configuration in a production piece of hardware without applying it on the final users? You can do that with a small jail while the production environment is on in another bigger, chunkier jail.<br>\nWant to divide the hardware as a replica of the division of the team/s you are working with? Want to sell virtual machines with bare metal performance? Do you want to isolate some piece of critical software or even data in a more controlled environment? Do you have different clients and you want to use the same hardware but you want to avoid them seeing each other at the same time you maintain performance and reliability?<br>\nAre you a developer and you have to have reliable and portable snapshots of your work? Do you want to try new options-designs without breaking your previous work, in a timeless fashion? You can work on something, clone the jail and apply the new ideas on the project in a matter of seconds. You can stop there, export the filesystem snapshot containing all the environment and all your work and place it on a thumbdrive to later import it on a big production system. Want to change that image properties such as the network stack interface and ip? This is just one command away from you.<br>\nBut what properties can you assign to a jail and how can I manage them you may be wondering. Hostname, disk quota, i/o, memory, cpu limits, network isolation, network virtualization, snapshots and the manage of those, migration and root privilege isolation to name a few. You can also clone them and import and export them between different systems. Some of these things because of ZFS. Iocage is a python program to manage jails and it takes profit from ZFS advantages.<br>\nBut FreeBSD is not Linux you may say. No it is not. There are no run levels. The systemd factor is out of this equation. This is so since the begginning. Ever wondered where did vi come from? The TCP/IP stack? Your beloved macOS from Apple? All this is coming from the FreeBSD project. If you are used to Linux your adaptation period with any BSD will be short, very short. You will almost feel at home. Used to packaged software using yum or apt-get? No worries. With pkgng, the package management tool used in FreeBSD has almost 27.000 compiled packages for you to use. Almost all software found on any of the important GNU/Linux distros can be found here. Java, Python, C, C++, Clang, GCC, Javascript frameworks, Ruby, PHP, MySQL and the major forks, etc. All this opensource software, and much more, is available at your fingertips.<br>\nI am a developer and… frankly my time is money and I appreciate both much more than dealing with systems configuration, etc. You can set a VM using VMWare or VirtualBox and play with barebones FreeBSD or you can use TrueOS (a derivative) which comes in a server version and a desktop oriented one. The latter will be easier for you to play with. You may be doing this already with Linux. There is a third and very sensible option. FreeNAS, developed by iXSystems. It is FreeBSD based and offers all these technologies with a GUI. VMWare, Hyper-V? Nowadays you can get your hands off the CLI and get a decent, usable, nice GUI.<br>\nYou say you play on the cloud. The major players already include FreeBSD in their offerings. You can find it in Amazon AWS or Azure (with official Microsoft support contracts too!). You can also find it in DigitalOcean and other hosting providers. There is no excuse. You can use it at home, at the office, with old or new hardware and in the cloud as well. You can even pay for a support contract to use it. Joyent, the developers of SmartOS have their own cloud with different locations around the globe. Have a look on them too.<br>\nIf you want the original of ZFS and zones you may think of Solaris. But it’s fading away. But it really isn’t. When Oracle bouth Sun many people ran away in an stampide fashion. Some of the good folks working at Sun founded new projects. One of these is Illumos. Joyent is a company formed by people who developed these technologies. They are a cloud operator, have been recently bought by Samsung and have a very competent team of people providing great tech solutions. They have developed an OS, called SmartOS (based on Illumos) with all these features. The source from this goes back to the early days of UNIX. Do you remember the days of OpenSolaris when Sun opensourced the crown jewels? There you have it. A modern opensource UNIX operating system with the roots in their original place and the head planted on today’s needs.<br>\nIn conclusion. If you are on GNU/Linux and you only use opensource software you may be doing it wrong. And missing goodies you may need and like. Once you put your hands on them, trust me, you won’t look back. And if you have some “old fashioned” admins who know Solaris, you can bring them to a new profitable and exciting life with both systems.<br>\nStill not convinced? Would you have ever imagined Microsoft supporting Linux? Even loving it? They do love now FreeBSD. And not only that, they provide their own image in the Azure Cloud and you can get Microsoft support, payed support if you want to use the platform on Azure. Ain’t it… surprising? Convincing at all?<br>\nPS: I haven’t mentioned both softwares, FreeBSD and SmartOS do have a Linux translation layer. This means you can run Linux binaries on them and the program won’t cough at all. Since the ABI stays stable the only thing you need to run a Linux binary is a translation between the different system calls and the libraries. Remember POSIX? Choose your poison and enjoy it.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://bradackerman.com/posts/2018-12-05-bsd-cloudy-vpn/\">A partly-cloudy IPsec VPN</a></p>\n\n<ul>\n<li>Audience</li>\n</ul>\n\n<blockquote>\n<p>I’m assuming that readers have at least a basic knowledge of TCP/IP networking and some UNIX or UNIX-like systems, but not necessarily OpenBSD or FreeBSD. This post will therefore be light on details that aren’t OS specific and are likely to be encountered in normal use (e.g., how to use vi or another text editor.) For more information on these topics, read Absolute FreeBSD (3ed.) by Michael W. Lucas.</p>\n</blockquote>\n\n<ul>\n<li>Overview</li>\n</ul>\n\n<blockquote>\n<p>I’m redoing my DigitalOcean virtual machines (which they call droplets). My requirements are:</p>\n</blockquote>\n\n<ul>\n<li>VPN</li>\n<li>Road-warrior access, so I can use private network resources from anywhere.</li>\n<li>A site-to-site VPN, extending my home network to my VPSes.</li>\n<li>Hosting for public and private network services.</li>\n<li>A proxy service to provide a public IP address to services hosted at home.</li>\n</ul>\n\n<blockquote>\n<p>The last item is on the list because I don’t actually have a public IP address at home; my firewall’s external address is in the RFC 1918 space, and the entire apartment building shares a single public IPv4 address.1 (IPv6? Don’t I wish.) The end-state network will include one OpenBSD droplet providing firewall, router, and VPN services; and one FreeBSD droplet hosting multiple jailed services.<br>\nI’ll be providing access via these droplets to a NextCloud instance at home. A simple NAT on the DO router droplet isn’t going to work, because packets going from home to the internet would exit through the apartment building’s connection and not through the VPN. It’s possible that I could do work around this issue with packet tagging using the pf firewall, but HAProxy is simple to configure and unlikely to result in hard-to-debug problems. relayd is also an option, but doesn’t have the TLS parsing abilities of HAProxy, which I’ll be using later on.<br>\nSince this system includes jails running on a VPS, and they’ve got RFC 1918 addresses, I want them reachable from my home network. Once that’s done, I can access the private address space from anywhere through a VPN connection to the cloudy router.<br>\nThe VPN itself will be of the IPsec variety. IPsec is the traditional enterprise VPN standard, and is even used for classified applications, but has a (somewhat-deserved) reputation for complexity, but recent versions of OpenBSD turn down the difficulty by quite a bit.</p>\n</blockquote>\n\n<ul>\n<li>The end-state network should look like: <a href=\"https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg\">https://d33wubrfki0l68.cloudfront.net/0ccf46fb057e0d50923209bb2e2af0122637e72d/e714e/201812-cloudy/endstate.svg</a></li>\n</ul>\n\n<blockquote>\n<p>This VPN both separates internal network traffic from public traffic and uses encryption to prevent interception or tampering.<br>\nOnce traffic has been encrypted, decrypting it without the key would, as Bruce Schneier once put it, require a computer built from something other than matter that occupies something other than space. Dyson spheres and a frakton of causality violation would possibly work, as would mathemagical technology that alters the local calendar such that P=NP.2 Black-bag jobs and/or suborning cloud provider employees doesn’t quite have that guarantee of impossibility, however. If you have serious security requirements, you’ll need to do better than a random blog entry.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://netbsd.org/gallery/presentations/maxv/kleak.pdf\">KLEAK: Practical Kernel Memory Disclosure Detection</a></p>\n\n<blockquote>\n<p>Modern operating systems such as NetBSD, macOS, and Windows isolate their kernel from userspace programs to increase fault tolerance and to protect against malicious manipulations [10]. User space programs have to call into the kernel to request resources, via system calls or ioctls. This communication between user space and kernel space crosses a security boundary. Kernel memory disclosures - also known as kernel information leaks - denote the inadvertent copying of uninitialized bytes from kernel space to user space.  Such disclosed memory may contain cryptographic keys, information about the kernel memory layout, or other forms of secret data. Even though kernel memory disclosures do not allow direct exploitation of a system, they lay the ground for it.<br>\nWe introduce KLEAK, a simple approach to dynamically detect kernel information leaks. Simply said, KLEAK utilizes a rudimentary form of taint tracking: it taints kernel memory with marker values, lets the data travel through the kernel and scans the buffers exchanged between the kernel and the user space for these marker values. By using compiler instrumentation and rotating the markers at regular intervals, KLEAK significantly reduces the number of false positives, and is able to yield relevant results with little effort.<br>\nOur  approach is practically feasible as we prove with an implementation for the NetBSD kernel. A small performance penalty is introduced, but the system remains usable. In addition to implementing KLEAK in the NetBSD kernel, we applied our approach to FreeBSD 11.2. In total,  we detected 21 previously unknown kernel memory disclosures in NetBSD-current and FreeBSD 11.2, which were fixed subsequently. As a follow-up, the projects’ developers manually audited related kernel areas and identified dozens of other kernel memory disclosures.<br>\nThe remainder of this paper is structured as follows. Section II discusses the bug class of kernel memory disclosures. Section III presents KLEAK to dynamically detect instances of this bug class. Section IV discusses the results of applying KLEAK to NetBSD-current and FreeBSD 11.2. Section V reviews prior research. Finally, Section VI concludes this paper.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.dragonflybsd.org/docs/howtos/How_To_Create_Official_Synth_Repo/\">How To Create Official Synth Repo</a></p>\n\n<ul>\n<li>\n<p>System Environment</p>\n</li>\n<li>\n<p>Make sure /usr/dports is updated and that it contains no cruft (git pull; git status). Remove any cruft.</p>\n</li>\n<li>\n<p>Make sure your ‘synth’ is up-to-date ‘pkg upgrade synth’. If you already updated your system you may have to build synth from scratch, from /usr/dports/ports-mgmt/synth.</p>\n</li>\n<li>\n<p>Make sure /etc/make.conf is clean.</p>\n</li>\n<li>\n<p>Update /usr/src to the current master, make sure there is no cruft in it</p>\n</li>\n<li>\n<p>Do a full buildworld, buildkernel, installkernel and installworld</p>\n</li>\n<li>\n<p>Reboot</p>\n</li>\n<li>\n<p>After the reboot, before proceeding, run ‘uname -a’ and make sure you are now on the desired release or development kernel.</p>\n</li>\n<li>\n<p>Synth Environment</p>\n</li>\n<li>\n<p>/usr/local/etc/synth/ contains the synth configuration. It should contain a synth.ini file (you may have to rename the template), and you will have to create or edit a LiveSystem-make.conf file.</p>\n</li>\n<li>\n<p>System requirements are hefty. Just linking chromium alone eats at least 30GB, for example. Concurrent c++ compiles can eat up to 2GB per process. We recommend at least 100GB of SSD based swap space and 300GB of free space on the filesystem.</p>\n</li>\n<li>\n<p>synth.ini should contain this. Plus modify the builders and jobs to suit your system. With 128G of ram, 30/30 or 40/25 works well. If you have 32G of ram, maybe 8/8 or less.</p>\n</li>\n</ul>\n\n<p><code>; Take care when hand editing!</code><br>\n<code></code><br>\n<code>[Global Configuration]</code><br>\n<code>profile_selected= LiveSystem</code><br>\n<code></code><br>\n<code>[LiveSystem]</code><br>\n<code>Operating_system= DragonFly</code><br>\n<code>Directory_packages= /build/synth/live_packages</code><br>\n<code>Directory_repository= /build/synth/live_packages/All</code><br>\n<code>Directory_portsdir= /build/synth/dports</code><br>\n<code>Directory_options= /build/synth/options</code><br>\n<code>Directory_distfiles= /usr/distfiles</code><br>\n<code>Directory_buildbase= /build/synth/build</code><br>\n<code>Directory_logs= /build/synth/logs</code><br>\n<code>Directory_ccache= disabled</code><br>\n<code>Directory_system= /</code><br>\n<code>Number_of_builders= 30</code><br>\n<code>Max_jobs_per_builder= 30</code><br>\n<code>Tmpfs_workdir= true</code><br>\n<code>Tmpfs_localbase= true</code><br>\n<code>Display_with_ncurses= true</code><br>\n<code>leverage_prebuilt= false</code></p>\n\n<ul>\n<li>LiveSystem-make.conf should contain one line to restrict licensing to only what is allowed to be built as a binary package:</li>\n</ul>\n\n<p><code>LICENSES_ACCEPTED= NONE</code></p>\n\n<ul>\n<li>\n<p>Make sure there is no other cruft in /usr/local/etc/synth/</p>\n</li>\n<li>\n<p>In the example above, the synth working dirs are in “/build/synth”. Make sure the base directories exist. Clean out any cruft for a fresh build from-scratch:</p>\n</li>\n</ul>\n\n<p><code>rm -rf /build/synth/live_packages/*</code><br>\n<code>rm -rf /build/synth/logs</code><br>\n<code>mkdir /build/synth/logs</code></p>\n\n<ul>\n<li>Run synth everything. I recommend doing this in a ‘screen’ session in case you lose your ssh session (assuming you are ssh’d into the build machine).</li>\n</ul>\n\n<p><code>(optionally start a screen session)</code><br>\n<code>synth everything</code></p>\n\n<ul>\n<li>A full synth build takes over 24 hours to run on a 48-core box, around 12 hours to run on a 64-core box. On a 4-core/8-thread box it will take at least 3 days. There will be times when swap space is heavily used. If you have not run synth before, monitor your memory and swap loads to make sure you have configured the jobs properly. If you are overloading the system, you may have to ^C the synth run, reduce the jobs, and start it again. It will pick up where it left off.</li>\n<li>When synth finishes, let it rebuild the database. You then have a working binary repo.</li>\n<li>It is usually a good idea to run synth several times to pick up any stuff it couldn’t build the first time. Each of these incremental runs may take a few hours, depending on what it tries to build.</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.freebsdbytes.com/2018/11/interview-eric-turgeon-founder-maintainer-ghostbsd/\">Interview with founder and maintainer of GhostBSD, Eric Turgeon</a></p>\n\n<ul>\n<li>Thanks you Eric for taking part. To start off, could you  tell us a little about yourself, just a bit of background?</li>\n<li>How did you become interested in open source?</li>\n<li>When and how did you get interested in the BSD operating systems?</li>\n<li>On your Twitter profile, you state that you are an automation engineer at iXsystems. Can you share what you do in your day-to-day job?</li>\n<li>You are the founder and project lead of GhostBSD. Could you describe GhostBSD to those who have never used it or never heard of it?</li>\n<li>Developing an operating system is not a small thing. What made you decide to start the GhostBSD project and not join another “desktop FreeBSD” related project, such as PC-BSD and DesktopBSD at the time?</li>\n<li>How did you get to the name GhostBSD? Did you consider any other names?</li>\n<li>You recently released GhostBSD 18.10? What’s new in that version and what are the key features? What has changed since GhostBSD 11.1?</li>\n<li>The current version is 18.10. Will the next version be 19.04 (like Ubuntu’s version numbering), or is a new version released after the next stable TrueOS release</li>\n<li>Can you tell us something about the development team? Is it yourself, or are there other core team members? I think I saw two other developers on your Github project page.</li>\n<li>How about the relationship with the community? Is it possible for a community member to contribute, and how are those contributions handled?</li>\n<li>What was the biggest challenge during development?</li>\n<li>If you had to pick one feature readers should check out in GhostBSD, what is it and why?</li>\n<li>What is the relationship between iXsystems and the GhostBSD project? Or is GhostBSD a hobby project that you run separately from your work at iXsystems?</li>\n<li>What is the relationship between GhostBSD and TrueOS? Is GhostBSD TrueOS with the MATE desktop on top, or are there other modifications, additions, and differences?</li>\n<li>Where does GhostBSD go from here? What are your plans for 2019?</li>\n<li>Is there anything else that wasn’t asked or that you want to share?</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://twitter.com/gonzoua/status/1071252700023508993\">dialog(1) script to select audio output on FreeBSD</a></li>\n<li><a href=\"http://blog.obligd.com/posts/erlang-otp-on-openbsd.html\">Erlang otp on OpenBSD</a></li>\n<li><a href=\"https://oshogbo.vexillium.org/blog/57/\">Capsicum</a></li>\n<li><a href=\"https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html\">https://blog.grem.de/sysadmin/FreeBSD-On-rpi3-With-crochet-2018-10-27-18-00.html</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/introduction_to_%C2%B5ubsan_a_clean\">Introduction to µUBSan - a clean-room reimplementation of the Undefined Behavior Sanitizer runtime</a></li>\n<li><a href=\"https://pkgsrc.org/pkgsrcCon/2018/talks.html\">pkgsrcCon 2018 in Berlin - Videos</a></li>\n<li><a href=\"https://freebsddesktop.github.io/2018/12/08/drm-kmod-primer.html\">Getting started with drm-kmod</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Malcolm - <a href=\"http://dpaste.com/28PYSGK\">Show segment idea</a></li>\n<li>Fraser - <a href=\"http://dpaste.com/38W3PRB\">Question: FreeBSD official binary package options</a></li>\n<li>Harri - <a href=\"http://dpaste.com/3SENZ7H#wrap\">BSD Magazine</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"FreeBSD 12.0 is finally here, partly-cloudy IPsec VPN, KLEAK with NetBSD, How to create synth repos, GhostBSD author interview, and more.","date_published":"2018-12-13T04:15:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9e174552-285e-4d49-9120-830715479ac5.mp3","mime_type":"audio/mp3","size_in_bytes":42596758,"duration_in_seconds":4241}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2997","title":"Episode 275: OpenBSD in Stereo | BSD Now 275","url":"https://www.bsdnow.tv/275","content_text":"DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.\n\nHeadlines\n\nDragonflyBSD 5.4 released\n\nDragonFly version 5.4 brings a new system compiler in GCC 8, improved NUMA support, a large of number network and virtual machine driver updates, and updates to video support. This release is 64-bit only, as with previous releases.\nThe details of all commits between the 5.2 and 5.4 branches are available in the associated commit messages for 5.4.0rc and 5.4.0.\n\n\n    Big-ticket items\n    Much better support for asymmetric NUMA (Non-Uniform Memory Access) configurations. In particular, both the memory subsystem and the scheduler now understand the Threadripper 2990WX’s architecture. The scheduler will prioritize CPU nodes with direct-attached memory and the memory subsystem will normalize memory queues for CPU nodes without direct-attached memory (which improves cache locality on those CPUs).\n    Incremental performance work. DragonFly as a whole is very SMP friendly. The type of performance work we are doing now mostly revolves around improving fairness for shared-vs-exclusive lock clashes, reducing cache ping-ponging due to non-contending SMP locks (i.e. massive use of shared locks on shared resources), and so forth.\n    Major updates to dports brings us to within a week or two of FreeBSD’s ports as of this writing, in particular major updates to chromium, and making the whole mess work with gcc-8.\n    Major rewriting of the tty clist code and the tty locking code, significantly improving concurrency across multiple ttys and ptys.\n    GCC 8\n    DragonFly now ships with GCC 8.0, and runs as the default compiler. It is also now used for building dports.\n    GCC 4.7.4 and GCC 5.4.1 are still installed. 4.7.4 is our backup compiler, and 5.4.1 is still there to ensure a smooth transition, but should generally not be used. buildworld builds all three by default to ensure maximum compatibility.\n    Many passes through world sources were made to address various warnings and errors the new GCC brought with it.\n    HAMMER2\n    HAMMER2 is recommended as the default root filesystem in non-clustered mode.\n    Clustered support is not yet available.\n    Increased bulkfree cache to reduce the number of iterations required.\n    Fixed numerous bugs.\n    Improved support on low-memory machines.\n    Significant pre-work on the XOP API to help support future networked operations.\n    Details\n    Checksums\nMD5 (dfly-x86_64-5.4.0_REL.img) = 7277d7cffc92837c7d1c5dd11a11b98f\nMD5 (dfly-x86_64-5.4.0_REL.iso) = 6da7abf036fe9267479837b3c3078408\nMD5 (dfly-x86_64-5.4.0_REL.img.bz2) = a77a072c864f4b72fd56b4250c983ff1\nMD5 (dfly-x86_64-5.4.0_REL.iso.bz2) = 4dbfec6ccfc1d59c5049455db914d499\n    Downloads Links\n\n\nDragonFly BSD is 64-bit only, as announced during the 3.8 release.\n\n\n    USB: dfly-x86_64-5.4.0_REL.img as bzip2 file\n    ISO: dfly-x86_64-5.4.0_REL.iso as bzip2 file\n    Uncompressed ISO: dfly-x86_64-5.4.0_REL.iso (For use with VPS providers as an install image.)\n\n\n\n\nDown the Gopher hole with OpenBSD, Gophernicus, and TLS\n\nIn the early 2000s I thought I had seen the worst of the web - Java applets, Macromedia (&gt;Adobe) Flash, animated GIFs, javascript snow that kept you warm in the winter by burning out your CPU, and so on. For a time we learned from these mistakes, and started putting the burden on the server-side - then with improvements in javascript engines we started abusing it again with JSON/AJAX and it all went down hill from there.\n\nLike cloud computing, blockchains, machine learning and a tonne of other a la mode technologies around today - most users and service providers don’t need websites that consume 1GB of memory processing JS and downloading 50MB of compressed data just to read Alice’s one-page travel blog or Bob’s notes on porting NetBSD to his blood-pressure monitor.\n\nBefore the HTTP web we relied on Prestel/Minitel style systems, BBS systems, and arguably the most accessible of all - Gopher! Gopher was similar to the locally accessed AmigaGuide format, in that it allowed users to search and retrieve documents interactively, with links and cross-references. Its efficiency and distraction-free nature make it attractive to those who are tired of the invasive, clickbait, ad-filled, javascript-laden web2/3.x. But enough complaining and evangelism - here’s how to get your own Gopher Hole!\n\nGophernicus is a modern gopher daemon which aims to be secure (although it still uses inetd -_-); it’s even in OpenBSD ports so at least we can rely on it to be reasonably audited.\n\nIf you need a starting point with Gopher, SDF-EU’s wiki has a good article here.\n\n\n    https://sdfeu.org/w/tutorials:gopher\n\n\nFinally, if you don’t like gopher(1) - there’s always lynx(1) or NCSA Mosaic!\n\n\n    https://cryogenix.net/NCSA_Mosaic_OpenBSD.html\n\n\nI’ve added TLS support to Gophernicus so you don’t need to use stunnel anymore. The code is ugly and unpolished though so I wouldn’t recommend for production use.\n\n\n    https://github.com/0x16h/gophernicus\n    https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd\n\n\n\n\nNews Roundup\n\nOpenBSD in Stereo with Linux VFIO\n\nI use a Huawei Matebook X as my primary OpenBSD laptop and one aspect of its hardware support has always been lacking: audio never played out of the right-side speaker. The speaker did actually work, but only in Windows and only after the Realtek Dolby Atmos audio driver from Huawei was installed. Under OpenBSD and Linux, and even Windows with the default Intel sound driver, audio only ever played out of the left speaker.\nNow, after some extensive reverse engineering and debugging with the help of VFIO on Linux, I finally have audio playing out of both speakers on OpenBSD.\n\n\n    VFIO\n\n\nThe Linux kernel has functionality called VFIO which enables direct access to a physical device (like a PCI card) from userspace, usually passing it to an emulator like QEMU.\nTo my surprise, these days, it seems to be primarily by gamers who boot Linux, then use QEMU to run a game in Windows and use VFIO to pass the computer’s GPU device through to Windows.\nBy using Linux and VFIO, I was able to boot Windows 10 inside of QEMU and pass my laptop’s PCI audio device through to Windows, allowing the Realtek audio drivers to natively control the audio device. Combined with QEMU’s tracing functionality, I was able to get a log of all PCI I/O between Windows and the PCI audio device.\n\n\n    Using VFIO\n\n\nTo use VFIO to pass-through a PCI device, it first needs to be stubbed out so the Linux kernel’s default drivers don’t attach to it. GRUB can be configured to instruct the kernel to ignore the PCI audio device (8086:9d71) and explicitly enable the Intel IOMMU driver by adding the following to /etc/default/grub and running update-grub\nWith the audio device stubbed out, a new VFIO device can be created from it\nThen the VFIO device (00:1f.3) can be passed to QEMU\nI was using my own build of QEMU for this, due to some custom logging I needed (more on that later), but the default QEMU package should work fine. The events.txt was a file of all VFIO events I wanted logged (which was all of them).\nSince I was frequently killing QEMU and restarting it, Windows 10 wanted to go through its unexpected shutdown routine each time (and would sometimes just fail to boot again). To avoid this and to get a consistent set of logs each time, I used qemu-img to take a snapshot of a base image first, then boot QEMU with that snapshot. The snapshot just gets thrown away the next time qemu-img is run and Windows always starts from a consistent state.\nQEMU will now log each VFIO event which gets saved to a debug-output file.\nWith a full log of all PCI I/O activity from Windows, I compared it to the output from OpenBSD and tried to find the magic register writes that enabled the second speaker. After days of combing through the logs and annotating them by looking up hex values in the documentation, diffing runtime register values, and even brute-forcing it by mechanically duplicating all PCI I/O activity in the OpenBSD driver, nothing would activate the right speaker.\nOne strange thing that I noticed was if I booted Windows 10 in QEMU and it activated the speaker, then booted OpenBSD in QEMU without resetting the PCI device’s power in-between (as a normal system reboot would do), both speakers worked in OpenBSD and the configuration that the HDA controller presented was different, even without any changes in OpenBSD.\n\nA Primer on Intel HDA\nMost modern computers with integrated sound chips use an Intel High Definition Audio (HDA) Controller device, with one or more codecs (like the Realtek ALC269) hanging off of it. These codecs do the actual audio processing and communicate with DACs and ADCs to send digital audio to the connected speakers, or read analog audio from a microphone and convert it to a digital input stream. In my Huawei Matebook X, this is done through a Realtek ALC298 codec.\nOn OpenBSD, these HDA controllers are supported by the azalia(4) driver, with all of the per-codec details in the lengthy azalia_codec.c file. This file has grown quite large with lots of codec- and machine-specific quirks to route things properly, toggle various GPIO pins, and unmute speakers that are for some reason muted by default.\nThe azalia driver talks to the HDA controller and sets up various buffers and then walks the list of codecs. Each codec supports a number of widget nodes which can be interconnected in various ways. Some of these nodes can be reconfigured on the fly to do things like turning a microphone port into a headphone port.\nThe newer Huawei Matebook X Pro released a few months ago is also plagued with this speaker problem, although it has four speakers and only two work by default. A fix is being proposed for the Linux kernel which just reconfigures those widget pins in the Intel HDA driver. Unfortunately no pin reconfiguration is enough to fix my Matebook X with its two speakers.\nWhile reading more documentation on the HDA, I realized there was a lot more activity going on than I was able to see through the PCI tracing.\nFor speed and efficiency, HDA controllers use a DMA engine to transfer audio streams as well as the commands from the OS driver to the codecs. In the output above, the CORBWP=0; size=256 and RIRBRP=0, size=256 indicate the setup of the CORB (Command Output Ring Buffer) and RIRB (Response Input Ring Buffer) each with 256 entries. The HDA driver allocates a DMA address and then writes it to the two CORBLBASE and CORBUBASE registers, and again for the RIRB.\nWhen the driver wants to send a command to a codec, such as CORB_GET_PARAMETER with a parameter of COP_VOLUME_KNOB_CAPABILITIES, it encodes the codec address, the node index, the command verb, and the parameter, and then writes that value to the CORB ring at the address it set up with the controller at initialization time (CORBLBASE/CORBUBASE) plus the offset of the ring index. Once the command is on the ring, it does a PCI write to the CORBWP register, advancing it by one. This lets the controller know a new command is queued, which it then acts on and writes the response value on the RIRB ring at the same position as the command (but at the RIRB’s DMA address). It then generates an interrupt, telling the driver to read the new RIRBWP value and process the new results.\nSince the actual command contents and responses are handled through DMA writes and reads, these important values weren’t showing up in the VFIO PCI trace output that I had gathered. Time to hack QEMU.\n\n\n    Logging DMA Memory Values in QEMU\n\n\nSince DMA activity wouldn’t show up through QEMU’s VFIO tracing and I obviously couldn’t get Windows to dump these values like I could in OpenBSD, I could make QEMU recognize the PCI write to the CORBWP register as an indication that a command has just been written to the CORB ring.\nMy custom hack in QEMU adds some HDA awareness to remember the CORB and RIRB DMA addresses as they get programmed in the controller. Then any time a PCI write to the CORBWP register is done, QEMU fetches the new CORB command from DMA memory, decodes it into the codec address, node address, command, and parameter, and prints it out. When a PCI read of the RIRBWP register is requested, QEMU reads the response and prints the corresponding CORB command that it stored earlier.\nWith this hack in place, I now had a full log of all CORB commands and RIRB responses sent to and read from the codec:\nAn early version of this patch left me stumped for a few days because, even after submitting all of the same CORB commands in OpenBSD, the second speaker still didn’t work. It wasn’t until re-reading the HDA spec that I realized the Windows driver was submitting more than one command at a time, writing multiple CORB entries and writing a CORBWP value that was advanced by two. This required turning my CORB/RIRB reading into a for loop, reading each new command and response between the new CORBWP/RIRBWP value and the one previously seen.\nSure enough, the magic commands to enable the second speaker were sent in these periods where it submitted more than one command at a time.\n\n\n    Minimizing the Magic\n\n\nThe full log of VFIO PCI activity from the Windows driver was over 65,000 lines and contained 3,150 CORB commands, which is a lot to sort through. It took me a couple more days to reduce that down to a small subset that was actually required to activate the second speaker, and that could only be done through trial and error:\n\n\n    Boot OpenBSD with the full list of CORB commands in the azalia driver\n    Comment out a group of them\n    Compile kernel and install it, halt the QEMU guest\n    Suspend and wake the laptop, resetting PCI power to the audio device to reset the speaker/Dolby initialization and ensure the previous run isn’t influencing the current test (I’m guessing there is an easier to way to reset PCI power than suspending the laptop, but oh well)\n    Start QEMU, boot OpenBSD with the new kernel\n    Play an MP3 with mpg123 which has alternating left- and right-channel audio and listen for both channels to play\n\n\nThis required a dozen or so iterations because sometimes I’d comment out too many commands and the right speaker would stop working. Other times the combination of commands would hang the controller and it wouldn’t process any further commands. At one point the combination of commands actually flipped the channels around so the right channel audio was playing through the left speaker.\n\n\n    The Result\n\n\nAfter about a week of this routine, I ended up with a list of 662 CORB commands that are needed to get the second speaker working. Based on the number of repeated-but-slightly-different values written with the 0x500 and 0x400 commands, I’m guessing this is some kind of training data and that this is doing the full Dolby/Atmos system initialization, not just turning on the second speaker, but I could be completely wrong.\nIn any case, the stereo sound from OpenBSD is wonderful now and I can finally stop downmixing everything to mono to play from the left speaker. In case you ever need to do this, sndiod can be run with -c 0:0 to reduce the channels to one.\nDue to the massive size of the code needed for this quirk, I’m not sure if I’ll be committing it upstream in OpenBSD or just saving it for my own tree. But at least now the hardware support chart for my Matebook is all yeses for the things I care about.\nI’ve also updated the Linux bug report that I opened before venturing down this path, hoping one of the maintainers of that HDA code that works at Intel or Realtek knew of a solution I could just port to OpenBSD. I’m curious to see what they’ll do with it.\n\n\n\nWhy BSD/OS is the best candidate for being the only tested legally open UNIX\n\n\n    Introduction\n\n\nThe UNIX® system is an old operating system, possibly older than many of the readers of this post. However, despite its age, it still has not been open sourced completely. In this post, I will try to detail which parts of which UNIX systems have not yet been open sourced. I will focus on the legal situation in Germany in particular, taking it representative of European law in general – albeit that is a stretch, knowing the diversity of European jurisdictions. Please note that familiarity with basic terms of copyright law is assumed.\n\n\n    Ancient UNIX\n\n\nThe term “Ancient UNIX” refers to the versions of UNIX up to and including Seventh Edition UNIX (1979) including the 32V port to the VAX. Ancient UNIX was created at Bell Laboratories, a subsidiary of AT&amp;T at the time. It was later transferred of the AT&amp;T UNIX Support Group, then AT&amp;T Information Systems and finally the AT&amp;T subsidiary UNIX System Laboratories, Inc. (USL). The legal situation differs between the United States of America and Germany.\nIn a ruling as part of the UNIX System Laboratories, Inc. v. Berkeley Software Design, Inc. (USL v. BSDi) case, a U.S. court found that USL had no copyright to the Seventh Edition UNIX system and 32V – arguably, by extension, all earlier versions of Ancient UNIX as well – because USL/AT&amp;T had failed to affix copyright notices and could not demonstrate a trade secret. Due to the obsessive tendency of U.S. courts to consider themselves bound to precedents (cf. the infamous Pierson v. Post case), it can be reasonably expected that this ruling would be honored and applied in subsequent cases. Thus under U.S. law, Ancient UNIX can be safely assumed to belong in the public domain.\nThe situation differs in Germany. Unlike the U.S., copyright never needed registration in order to exist. Computer programs are works in the sense of the German 1965 Act on Copyright and Related Rights (Copyright Act, henceforth CopyA) as per CopyA § 2(1) no. 1. Even prior to the amendment of CopyA § 2(1) to include computer programs, computer programs have been recognized as copyrightable works by the German Supreme Court (BGHZ 112, 264 Betriebssystem, no. 19); CopyA § 137d(1) rightly clarifies that. The copyright holder at 1979 would still have been USL via Bell Labs and AT&amp;T. Copyright of computer programs is transferred to the employer upon creation under CopyA § 69(1).\nNote that this does not affect expiry (Daniel Kaboth/Benjamin Spies, commentary on CopyA §§ 69a‒69g, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), Urheberrecht: UrhG, KUG, VerlG, VGG, Kommentar, 4th ed., C. H. Beck, 2018, no. 16 ad CopyA § 69b; cf. Bundestag-Drucksache [BT-Drs.] 12/4022, p. 10). Expiry occurs 70 years after the death of the (co-)author that died most recently as per CopyA § 65(1) and 64; this has been the case since at least the 1960s, meaning there is no way for copyright to have expired already (old version, as per Bundesgesetzblatt Part I No. 51 of September 16, 1965, pp. 1273‒1294).\nIn Germany, private international law applies the so-called “Territorialitätsprinzip” for intellectual property rights. This means that the effect of an intellectual property right is limited to the territory of a state (Anne Lauber-Rönsberg, KollisionsR, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), ibid., pp. 2241 et seqq., no. 4). Additionally, the “Schutzlandprinzip” applies; this means that protection of intellectual property follows the lex loci protectionis, i.e. the law of the country for which protection is sought (BGH GRUR 2015, 264 HiHotel II, no. 25; BGH GRUR 2003, 328 Sender Felsberg, no. 24), albeit this is criticized in parts of doctrine (Lauber-Rönsberg, ibid., no. 10). The “Schutzlandprinzip” requires that the existence of an intellectual property right be verified as well (BGH ZUM 2016, 522 Wagenfeld-Leuchte II, no. 19).\nThus, in Germany, copyright on Ancient UNIX is still alive and well. Who has it, though? A ruling by the U.S. Court of Appeals, Tenth Circuit, in the case of The SCO Group, Inc. v. Novell, Inc. (SCO v. Novell) in the U.S. made clear that Novell owns the rights to System V – thus presumably UNIX System III as well – and Ancient UNIX, though SCO acquired enough rights to develop UnixWare/OpenServer (Ruling 10-4122 [D.C. No. 2:04-CV-00139-TS], pp. 19 et seq.). Novell itself was purchased by the Attachmate Group, which was in turn acquired by the COBOL vendor Micro Focus. Therefore, the rights to SVRX and – outside the U.S. – are with Micro Focus right now. If all you care about is the U.S., you can stop reading about Ancient UNIX here.\nSo how does the Caldera license factor into all of this? For some context, the license was issued January 23, 2002 and covers Ancient UNIX (V1 through V7 including 32V), specifically excluding System III and System V. Caldera, Inc. was founded in 1994. The Santa Cruz Operation, Inc. sold its rights to UNIX to Caldera in 2001, renamed itself to Tarantella Inc. and Caldera renamed itself The SCO Group. Nemo plus iuris ad alium transferre potest quam ipse habet; no one can transfer more rights than he has. The question now becomes whether Caldera had the rights to issue the Caldera license.\nI’ve noted it above but it needs restating: Foreign decisions are not necessarily accepted in Germany due to the “Territorialitätsprinzip” and “Schutzlandprinzip” – however, I will be citing a U.S. ruling for its assessment of the facts for the sake of simplicity. As per ruling 10-4122, “The district court found the parties intended for SCO to serve as Novell’s agent with respect to the old SVRX licenses and the only portion of the UNIX business transferred outright under the APA [asset purchase agreement] was the ability to exploit and further develop the newer UnixWare system. SCO was able to protect that business because it was able to copyright its own improvements to the system. The only reason to protect the earlier UNIX code would be to protect the existing SVRX licenses, and the court concluded Novell retained ultimate control over that portion of the business under the APA.” The relevant agreements consist of multiple pieces:\nthe base Asset Purchase Agreement “APA” (Part I)\nthe base Asset Purchase Agreement “APA” (Part II)\nthe Operating Agremeent and Amendment 1 to the APA\nthe Amendment 2 to the APA\nThe APA dates September 19, 1995, from before the Caldera license. Caldera cannot possibly have acquired rights that The Santa Cruz Operation, Inc. itself never had. Furthermore, I’ve failed to find any mention of Ancient UNIX; all that is transferred is rights to SVRX. Overall, I believe that the U.S. courts’ assesment of the facts represents the situation accurately. Thus for all intents and purposes, UNIX up to and including System V remained with Novell/Attachmate/Micro Focus. Caldera therefore never had any rights to Ancient UNIX, which means it never had the rights to issue the Caldera license. The Caldera license is null and void – in the U.S. because the copyright has been lost due to formalities, everywhere else because Caldera never had the rights to issue it.\nThe first step to truly freeing UNIX would this be to get Micro Focus to re-issue the Caldera license for Ancient UNIX, ideally it would now also include System III and System V.\n\n\n    BSD/OS\n\n\nAnother operating system near UNIX is of interest. The USL v. BSDi lawsuit includes two parties: USL, which we have seen above, and Berkeley Software Design, Inc. BSDi sold BSD/386 (later BSD/OS), which was a derivative of 4.4BSD. The software parts of the BSDi company were acquired by Wind River Systems, whereas the hardware parts went to iXsystems. Copyright is not disputed there, though Wind River Systems ceased selling BSD/OS products 15 years ago, in 2003. In addition, Wind River System let their trademark on BSD expire, though this is without consequence for copyright.\nBSD/OS is notable in the sense that it powered much of early internet infrastructure. Traces of its legacy can still be found on Richard Stevens’ FAQ.\nTo truly make UNIX history free, BSD/OS would arguably also need to see a source code release. BSD/OS at least in its earliest releases under BSDi would ship with source code, though under a non-free license, far from BSD or even GPL licensing.\n\n\n    System V\n\n\nThe fate of System V as a whole is difficult to determine. Various licenses have been granted to a number of vendors (Dell UNIX comes to mind; HP for HP-UX, IBM for AIX, SGI UNIX, etc.). Sun released OpenSolaris – notoriously, Oracle closed the source to Solaris again after its release –, which is a System V Release 4 descendant. However, this means nothing for the copyright or licensing status of System V itself. Presumably, the rights with System V still remain with Novell (now Micro Focus): SCO managed to sublicense rights to develop and sell UnixWare/OpenServer, themselves System V/III descendants, to unXis, Inc. (now known as Xinuos, Inc.), which implies that Xinuos is not the copyright holder of System V.\nObviously, to free UNIX, System V and its entire family of descendants would also need to be open sourced. However, I expect tremendous resistance on part of all the companies mentioned. As noted in the “Ancient UNIX” section, Micro Focus alone would probably be sufficient to release System V, though this would mean nothing for the other commercial System V derivatives.\n\n\n    Newer Research UNIX\n\n\nThe fate of Bell Labs would be a different one; it would go on to be purchased by Lucent, now part of Nokia. After commercial UNIX got separated out to USL, Research UNIX would continue to exist inside of Bell Labs. Research UNIX V8, V9 and V10 were not quite released by Alcatel-Lucent USA Inc. and Nokia in 2017.\nHowever, this is merely a notice that the companies involved will not assert their copyrights only with respect to any non-commercial usage of the code. It is still not possible, over 30 years later, to freely use the V8 code.\n\n\n    Conclusion\nIn the U.S., Ancient UNIX is freely available. People located everywhere else, however, are unable to legally obtain UNIX code for any of the systems mentioned above. The exception being BSD/OS, assuming a purchase of a legitimate copy of the source code CD. This is deeply unsatisfying and I implore all involved companies to consider open sourcing (preferably under a BSD-style license) their code older than a decade, if nothing else, then at least for the sake of historical purposes. I would like to encourage everybody reading this to consider reaching out to Micro Focus and Wind River Systems about System V and BSD/OS, respectively. Perhaps the masses can change their minds.\n\n\nA small note about patents: Some technologies used in newer iterations of the UNIX system (in particular the System V derivatives) may be encumbered with software patents. An open source license will not help against patent infringement claims. However, the patents on anything used in the historical operating systems will certainly have expired by now. In addition, European readers can ignore this entirely – software patents just aren’t a thing.\n\n\n\nOpenBGPD - Adding Diversity to the Route Server Landscape\n\n\n    Introduction\n\n\nAs of last year, there was effectively only a single solution in the Route Server vendor market: the BIRD Internet routing daemon. NIC.CZ (the organisation developing BIRD) has done fantastic work on maintaining their BGP-4 implementation, however, it’s not healthy to have virtually every Internet Exchange Point (IXP) in the RIPE NCC service region depend on a single open source project. The current situation can be compared to the state of the DNS root nameservers back in 2002 - their dependence on the BIND nameserver daemon and the resulting development of NSD as an alternative by NLnet, in cooperation with the RIPE NCC.\nOpenBGPD used to be one of the most popular Route Server implementations until the early 2010s. OpenBGPD’s main problem was that its performance couldn’t keep up with the Internet’s growth, so it lost market share. An analysis by Job Snijders suggested that a modernised OpenBGPD distribution would be a most viable option to regain diversity on the Route Server level.\n\n\n    Missing features in OpenBGPD\n\n\nThe following main missing features were identified in OpenBGPD:\n\n\n    Performance\n\n\nIn previous versions of OpenBGPD, the filtering performance didn’t allow proper filtering of all EBGP sessions. Current best practice at IXP Route Servers is to carefully evaluate and validate of all routes learned from EBGP peers. The OpenBGPD ruleset required to do correct filtering (in many deployment scenarios) was simply too lengthy - and negatively impacted service performance during configuration reloads. While filtering performance is the biggest bottleneck, general improvements to the Routing Information Base were also made to improve scalability. IXP Route Servers with a few hundred peering sessions are commonplace and adding new sessions shouldn’t impact the Route Servers’ service to other peers. We found that performance was the most pressing issue that needed to be tackled.\n\n\n    Lack of RPKI Origin Validation\n\n\nAs we’ve seen, Internet operators are moving to adopt RPKI based BGP Origin Validation. While it was theoretically possible to emulate RFC 6811-style Origin Validation in previous versions of OpenBGPD, the required configuration wasn’t optimised for performance and wasn’t user friendly. We believe that BGP Origin Validation should be as easy as possible - this requires BGP-4 vendors to implement native, optimised routines for Origin Validation. Of course, enabling Origin Validation shouldn’t have an impact on performance either when processing BGP updates or when updating the Route Origin Authorisation (ROA) table itself.\n\n\n    Portability\n\n\nOpenBGPD is an integral part of OpenBSD, but IXPs may prefer to run their services infrastructure on an operating system of their choice. Making sure that there’s a portable OpenBGPD version which follows the OpenBSD project release cycle will give IXPs this option.\n\n\n    Development steps\n\n\nBy addressing the issues mentioned above, we could bring back OpenBGPD as a viable Route Server implementation.\nSince I was one of the core OpenBGPD developers, I was asked if I wanted to pick up this project again. Thanks to the funding from the RIPE NCC Project Fund, this was possible. Starting in June 2018, I worked full time on this important community project. Over the last few months, many of the problems are already addressed and are now part of the OpenBSD 6.4 release. So far, 154 commits were made to OpenBGPD during the 6.4 development cycle - around 8% of all commits ever to OpenBGPD! This shows that due to funding and dedicated resources, a lot of work could be pushed into the latest release of OpenBGPD.\n\n\n    OpenBGPD 6.4\n\n\nThe OpenBGPD version, as part of OpenBSD 6.4 release, demonstrates great progress. Even though there have been many changes to the core of OpenBGPD, the released version is as solid and reliable as previous releases and the many bug fixes and improvements make this the best OpenBGPD release so far. The changes in the filter language allow users to write more efficient rulesets while the introduction of RPKI origination validation fixes an important missing feature. For IXPs, OpenBGPD now is an alternative again. There are still open issues, but the gap is closing!\n\n\n    Feature highlights\n\n\nThe following changes should be highlighted:\n\n\n    Introduction of background soft-reconfiguration on config reload. Running the soft-reconfiguration task in the background allows for new updates and withdraws to be processed at the same time. This improves convergence time - one of the key metrics for Route Servers.\n    BGP Origin Validation when a roa-set is configured Every EBGP route announcement is validated against the locally configured VRP table entries. Depending on the validation process’s outcome, the validation state is set to valid, invalid or not found. The filter language has been extended to allow checking for the origin validation state, and thanks to this, it is possible to deny invalid prefixes or regard valid prefixes different to the ones that aren’t found. The roa-set table is read from the configuration file and updated during configuration reloads. On production systems reloading the roa-set and applying it to all prefixes is done in a couple of seconds.\n    Fast prefix-set lookups In OpenBSD 6.3 prefix-sets got introduced in OpenBGPD. A prefix-set combines many prefix lookups into a single filter rule. The original implementation wasn’t optimised but now a fast trie lookup is used. Thanks to this, large IRR DB prefix tables can now be implemented efficiently.\n    Introduction of as-sets Similar to prefix-sets, as-sets help group many AS numbers into a single lookup. Thanks to this, large IRR DB origin AS tables can be implemented efficiently.\nIntroduction of origin-sets\n    Looking at the configurations of Route Servers doing full filtering, it was noticed that a common lookup was binding a prefix to an origin AS - similar to how a roa-set is used for RPKI. These origin-set tables are used to extend the IRR prefix lookup and generated from alternative sources.\n    Improving third party tools\n\n\nUsers can only benefit from the changes introduced in OpenBGPD 6.4 when the surrounding 3rd party tools are adjusted accordingly. Two opensource projects such as bgpq3 and arouteserver are frequently used by network operators and IXPs to generate BGP configurations. Thanks to our contributions to those projects, we were able to get them ready for all the new features in OpenBGPD.\n\n\n    bgpq3 was extended to create as-set and prefix-set tables based on IRR DB entries. This is replacing the old way of doing the same with a large amount of filter rules. Thanks to the quick response from the bgpq3 maintainer, it was possible to ship OpenBSD 6.4 with a bgpq3 package that includes all the new features.\n    arouteserver was adjusted to implement RPKI roa-set, as-set, prefix-set, and origin-set to generate a much better-performing configurations for the 6.4 version. With the v0.20.0 release of arouteserver, IXPs are able to generate an OpenBGPD configuration which is a ton faster but also implements the new functionalities. Looking at YYCIX (the resident IXP in Calgary, Canada) the ruleset generated by arouteserver was reduced from 370,000 rules to well under 6,000 rules. This resulted in the initial convergence time dropping from over 1 hour to less than 2 minutes, and subsequent configuration reloads are hitless and no longer noticeable.\n    What still needs to be done\n\n\nA sizeable chunk of work still left on the table is the rework of the RIB data structures in OpenBGPD - these haven’t been changed since the initial design of OpenBGPD in 2003. There’s currently ongoing work (in small steps, to avoid jeopardising the stability of OpenBGPD) to modernise these data-structures. The goal is to provide better decoupling of the filter step from storing RIB database changes, to pave the way to multi-threaded operations at a later point.\n\n\n    Looking forward\n    Job Snijders oversaw this year’s fundraising and project management, he adds:\n\n\nIt’s been incredibly productive to create an environment where a core developer is allowed to work full time on the OpenBGPD code base. However, it’s important to note there still is room for a number of new features to help improve its operational capabilities (such as BMP, RFC 7313, ADD_PATH, etc). It’d be beneficial to the Internet community at large if we can extend Claudio Jeker’s involvement for another year. Open source software doesn’t grow on trees! Strategic investments are the only way to keep OpenBGPD’s roadmap aligned with Internet growth and operator requirements.\n\n\n\nBeastie Bits\n\n\n    DragonFly - git: annotated tag v5.5.0 created\n    Torchlight 2 on NetBSD\n    Older, but still good USENIX Login Article on Capsicum\n    The Super Capsicumizer 9000\n    Dedicated and Virtual Server PXE provisioning tool\n    Cirrus CI have announced FreeBSD support\n    NetBSD PineBook Gameplay\n    BSDCan 2019 CfP is out\n    Allan’s first ZFS array, Zulu, turned 7 years old on Nov 29th\n\n\n\n\nFeedback/Questions\n\n\n    Malcom - Installing Drivers in Development\n    Samir - Introduction to ZFS\n    Newnix - Drive Failures\n\n\n\n\n\n    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.dragonflybsd.org/release54/\">DragonflyBSD 5.4 released</a></h3>\n\n<blockquote>DragonFly version 5.4 brings a new system compiler in GCC 8, improved NUMA support, a large of number network and virtual machine driver updates, and updates to video support. This release is 64-bit only, as with previous releases.\nThe details of all commits between the 5.2 and 5.4 branches are available in the associated commit messages for 5.4.0rc and 5.4.0.</blockquote>\n\n<ul>\n    <li>Big-ticket items</li>\n    <li>Much better support for asymmetric NUMA (Non-Uniform Memory Access) configurations. In particular, both the memory subsystem and the scheduler now understand the Threadripper 2990WX’s architecture. The scheduler will prioritize CPU nodes with direct-attached memory and the memory subsystem will normalize memory queues for CPU nodes without direct-attached memory (which improves cache locality on those CPUs).</li>\n    <li>Incremental performance work. DragonFly as a whole is very SMP friendly. The type of performance work we are doing now mostly revolves around improving fairness for shared-vs-exclusive lock clashes, reducing cache ping-ponging due to non-contending SMP locks (i.e. massive use of shared locks on shared resources), and so forth.</li>\n    <li>Major updates to dports brings us to within a week or two of FreeBSD’s ports as of this writing, in particular major updates to chromium, and making the whole mess work with gcc-8.</li>\n    <li>Major rewriting of the tty clist code and the tty locking code, significantly improving concurrency across multiple ttys and ptys.</li>\n    <li>GCC 8</li>\n    <li>DragonFly now ships with GCC 8.0, and runs as the default compiler. It is also now used for building dports.</li>\n    <li>GCC 4.7.4 and GCC 5.4.1 are still installed. 4.7.4 is our backup compiler, and 5.4.1 is still there to ensure a smooth transition, but should generally not be used. buildworld builds all three by default to ensure maximum compatibility.</li>\n    <li>Many passes through world sources were made to address various warnings and errors the new GCC brought with it.</li>\n    <li>HAMMER2</li>\n    <li>HAMMER2 is recommended as the default root filesystem in non-clustered mode.</li>\n    <li>Clustered support is not yet available.</li>\n    <li>Increased bulkfree cache to reduce the number of iterations required.</li>\n    <li>Fixed numerous bugs.</li>\n    <li>Improved support on low-memory machines.</li>\n    <li>Significant pre-work on the XOP API to help support future networked operations.</li>\n    <li>Details</li>\n    <li>Checksums\n<code>MD5 (dfly-x86_64-5.4.0_REL.img) = 7277d7cffc92837c7d1c5dd11a11b98f</code>\n<code>MD5 (dfly-x86_64-5.4.0_REL.iso) = 6da7abf036fe9267479837b3c3078408</code>\n<code>MD5 (dfly-x86_64-5.4.0_REL.img.bz2) = a77a072c864f4b72fd56b4250c983ff1</code>\n<code>MD5 (dfly-x86_64-5.4.0_REL.iso.bz2) = 4dbfec6ccfc1d59c5049455db914d499</code></li>\n    <li>Downloads Links</li>\n</ul>\n\n<blockquote>DragonFly BSD is 64-bit only, as announced during the 3.8 release.</blockquote>\n\n<ul>\n    <li>USB: dfly-x86_64-5.4.0_REL.img as bzip2 file</li>\n    <li>ISO: dfly-x86_64-5.4.0_REL.iso as bzip2 file</li>\n    <li>Uncompressed ISO: dfly-x86_64-5.4.0_REL.iso (For use with VPS providers as an install image.)</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://cryogenix.net/gophernicus.html\">Down the Gopher hole with OpenBSD, Gophernicus, and TLS</a></h3>\n\n<blockquote>In the early 2000s I thought I had seen the worst of the web - Java applets, Macromedia (&gt;Adobe) Flash, animated GIFs, javascript snow that kept you warm in the winter by burning out your CPU, and so on. For a time we learned from these mistakes, and started putting the burden on the server-side - then with improvements in javascript engines we started abusing it again with JSON/AJAX and it all went down hill from there.</blockquote>\n\n<blockquote>Like cloud computing, blockchains, machine learning and a tonne of other a la mode technologies around today - most users and service providers don’t need websites that consume 1GB of memory processing JS and downloading 50MB of compressed data just to read Alice’s one-page travel blog or Bob’s notes on porting NetBSD to his blood-pressure monitor.</blockquote>\n\n<blockquote>Before the HTTP web we relied on Prestel/Minitel style systems, BBS systems, and arguably the most accessible of all - Gopher! Gopher was similar to the locally accessed AmigaGuide format, in that it allowed users to search and retrieve documents interactively, with links and cross-references. Its efficiency and distraction-free nature make it attractive to those who are tired of the invasive, clickbait, ad-filled, javascript-laden web2/3.x. But enough complaining and evangelism - here’s how to get your own Gopher Hole!</blockquote>\n\n<blockquote>Gophernicus is a modern gopher daemon which aims to be secure (although it still uses inetd -_-); it’s even in OpenBSD ports so at least we can rely on it to be reasonably audited.</blockquote>\n\n<blockquote>If you need a starting point with Gopher, SDF-EU’s wiki has a good article here.</blockquote>\n\n<ul>\n    <li><a href=\"https://sdfeu.org/w/tutorials:gopher\">https://sdfeu.org/w/tutorials:gopher</a></li>\n</ul>\n\n<blockquote>Finally, if you don’t like gopher(1) - there’s always lynx(1) or NCSA Mosaic!</blockquote>\n\n<ul>\n    <li><a href=\"https://cryogenix.net/NCSA_Mosaic_OpenBSD.html\">https://cryogenix.net/NCSA_Mosaic_OpenBSD.html</a></li>\n</ul>\n\n<blockquote>I’ve added TLS support to Gophernicus so you don’t need to use stunnel anymore. The code is ugly and unpolished though so I wouldn’t recommend for production use.</blockquote>\n\n<ul>\n    <li><a href=\"https://github.com/0x16h/gophernicus\">https://github.com/0x16h/gophernicus</a></li>\n    <li><a href=\"https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd\">https://github.com/0x16h/gophernicus/blob/master/INSTALL.openbsd</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://jcs.org/2018/11/12/vfio\">OpenBSD in Stereo with Linux VFIO</a></h3>\n\n<blockquote>I use a Huawei Matebook X as my primary OpenBSD laptop and one aspect of its hardware support has always been lacking: audio never played out of the right-side speaker. The speaker did actually work, but only in Windows and only after the Realtek Dolby Atmos audio driver from Huawei was installed. Under OpenBSD and Linux, and even Windows with the default Intel sound driver, audio only ever played out of the left speaker.\nNow, after some extensive reverse engineering and debugging with the help of VFIO on Linux, I finally have audio playing out of both speakers on OpenBSD.</blockquote>\n\n<ul>\n    <li>VFIO</li>\n</ul>\n\n<blockquote>The Linux kernel has functionality called VFIO which enables direct access to a physical device (like a PCI card) from userspace, usually passing it to an emulator like QEMU.\nTo my surprise, these days, it seems to be primarily by gamers who boot Linux, then use QEMU to run a game in Windows and use VFIO to pass the computer’s GPU device through to Windows.\nBy using Linux and VFIO, I was able to boot Windows 10 inside of QEMU and pass my laptop’s PCI audio device through to Windows, allowing the Realtek audio drivers to natively control the audio device. Combined with QEMU’s tracing functionality, I was able to get a log of all PCI I/O between Windows and the PCI audio device.</blockquote>\n\n<ul>\n    <li>Using VFIO</li>\n</ul>\n\n<blockquote>To use VFIO to pass-through a PCI device, it first needs to be stubbed out so the Linux kernel’s default drivers don’t attach to it. GRUB can be configured to instruct the kernel to ignore the PCI audio device (8086:9d71) and explicitly enable the Intel IOMMU driver by adding the following to /etc/default/grub and running update-grub\nWith the audio device stubbed out, a new VFIO device can be created from it\nThen the VFIO device (00:1f.3) can be passed to QEMU\nI was using my own build of QEMU for this, due to some custom logging I needed (more on that later), but the default QEMU package should work fine. The events.txt was a file of all VFIO events I wanted logged (which was all of them).\nSince I was frequently killing QEMU and restarting it, Windows 10 wanted to go through its unexpected shutdown routine each time (and would sometimes just fail to boot again). To avoid this and to get a consistent set of logs each time, I used qemu-img to take a snapshot of a base image first, then boot QEMU with that snapshot. The snapshot just gets thrown away the next time qemu-img is run and Windows always starts from a consistent state.\nQEMU will now log each VFIO event which gets saved to a debug-output file.\nWith a full log of all PCI I/O activity from Windows, I compared it to the output from OpenBSD and tried to find the magic register writes that enabled the second speaker. After days of combing through the logs and annotating them by looking up hex values in the documentation, diffing runtime register values, and even brute-forcing it by mechanically duplicating all PCI I/O activity in the OpenBSD driver, nothing would activate the right speaker.\nOne strange thing that I noticed was if I booted Windows 10 in QEMU and it activated the speaker, then booted OpenBSD in QEMU without resetting the PCI device’s power in-between (as a normal system reboot would do), both speakers worked in OpenBSD and the configuration that the HDA controller presented was different, even without any changes in OpenBSD.</blockquote>\n\n<blockquote>A Primer on Intel HDA\nMost modern computers with integrated sound chips use an Intel High Definition Audio (HDA) Controller device, with one or more codecs (like the Realtek ALC269) hanging off of it. These codecs do the actual audio processing and communicate with DACs and ADCs to send digital audio to the connected speakers, or read analog audio from a microphone and convert it to a digital input stream. In my Huawei Matebook X, this is done through a Realtek ALC298 codec.\nOn OpenBSD, these HDA controllers are supported by the azalia(4) driver, with all of the per-codec details in the lengthy azalia_codec.c file. This file has grown quite large with lots of codec- and machine-specific quirks to route things properly, toggle various GPIO pins, and unmute speakers that are for some reason muted by default.\nThe azalia driver talks to the HDA controller and sets up various buffers and then walks the list of codecs. Each codec supports a number of widget nodes which can be interconnected in various ways. Some of these nodes can be reconfigured on the fly to do things like turning a microphone port into a headphone port.\nThe newer Huawei Matebook X Pro released a few months ago is also plagued with this speaker problem, although it has four speakers and only two work by default. A fix is being proposed for the Linux kernel which just reconfigures those widget pins in the Intel HDA driver. Unfortunately no pin reconfiguration is enough to fix my Matebook X with its two speakers.\nWhile reading more documentation on the HDA, I realized there was a lot more activity going on than I was able to see through the PCI tracing.\nFor speed and efficiency, HDA controllers use a DMA engine to transfer audio streams as well as the commands from the OS driver to the codecs. In the output above, the CORBWP=0; size=256 and RIRBRP=0, size=256 indicate the setup of the CORB (Command Output Ring Buffer) and RIRB (Response Input Ring Buffer) each with 256 entries. The HDA driver allocates a DMA address and then writes it to the two CORBLBASE and CORBUBASE registers, and again for the RIRB.\nWhen the driver wants to send a command to a codec, such as CORB_GET_PARAMETER with a parameter of COP_VOLUME_KNOB_CAPABILITIES, it encodes the codec address, the node index, the command verb, and the parameter, and then writes that value to the CORB ring at the address it set up with the controller at initialization time (CORBLBASE/CORBUBASE) plus the offset of the ring index. Once the command is on the ring, it does a PCI write to the CORBWP register, advancing it by one. This lets the controller know a new command is queued, which it then acts on and writes the response value on the RIRB ring at the same position as the command (but at the RIRB’s DMA address). It then generates an interrupt, telling the driver to read the new RIRBWP value and process the new results.\nSince the actual command contents and responses are handled through DMA writes and reads, these important values weren’t showing up in the VFIO PCI trace output that I had gathered. Time to hack QEMU.</blockquote>\n\n<ul>\n    <li>Logging DMA Memory Values in QEMU</li>\n</ul>\n\n<blockquote>Since DMA activity wouldn’t show up through QEMU’s VFIO tracing and I obviously couldn’t get Windows to dump these values like I could in OpenBSD, I could make QEMU recognize the PCI write to the CORBWP register as an indication that a command has just been written to the CORB ring.\nMy custom hack in QEMU adds some HDA awareness to remember the CORB and RIRB DMA addresses as they get programmed in the controller. Then any time a PCI write to the CORBWP register is done, QEMU fetches the new CORB command from DMA memory, decodes it into the codec address, node address, command, and parameter, and prints it out. When a PCI read of the RIRBWP register is requested, QEMU reads the response and prints the corresponding CORB command that it stored earlier.\nWith this hack in place, I now had a full log of all CORB commands and RIRB responses sent to and read from the codec:\nAn early version of this patch left me stumped for a few days because, even after submitting all of the same CORB commands in OpenBSD, the second speaker still didn’t work. It wasn’t until re-reading the HDA spec that I realized the Windows driver was submitting more than one command at a time, writing multiple CORB entries and writing a CORBWP value that was advanced by two. This required turning my CORB/RIRB reading into a for loop, reading each new command and response between the new CORBWP/RIRBWP value and the one previously seen.\nSure enough, the magic commands to enable the second speaker were sent in these periods where it submitted more than one command at a time.</blockquote>\n\n<ul>\n    <li>Minimizing the Magic</li>\n</ul>\n\n<blockquote>The full log of VFIO PCI activity from the Windows driver was over 65,000 lines and contained 3,150 CORB commands, which is a lot to sort through. It took me a couple more days to reduce that down to a small subset that was actually required to activate the second speaker, and that could only be done through trial and error:</blockquote>\n\n<ul>\n    <li>Boot OpenBSD with the full list of CORB commands in the azalia driver</li>\n    <li>Comment out a group of them</li>\n    <li>Compile kernel and install it, halt the QEMU guest</li>\n    <li>Suspend and wake the laptop, resetting PCI power to the audio device to reset the speaker/Dolby initialization and ensure the previous run isn’t influencing the current test (I’m guessing there is an easier to way to reset PCI power than suspending the laptop, but oh well)</li>\n    <li>Start QEMU, boot OpenBSD with the new kernel</li>\n    <li>Play an MP3 with mpg123 which has alternating left- and right-channel audio and listen for both channels to play</li>\n</ul>\n\n<blockquote>This required a dozen or so iterations because sometimes I’d comment out too many commands and the right speaker would stop working. Other times the combination of commands would hang the controller and it wouldn’t process any further commands. At one point the combination of commands actually flipped the channels around so the right channel audio was playing through the left speaker.</blockquote>\n\n<ul>\n    <li>The Result</li>\n</ul>\n\n<blockquote>After about a week of this routine, I ended up with a list of 662 CORB commands that are needed to get the second speaker working. Based on the number of repeated-but-slightly-different values written with the 0x500 and 0x400 commands, I’m guessing this is some kind of training data and that this is doing the full Dolby/Atmos system initialization, not just turning on the second speaker, but I could be completely wrong.\nIn any case, the stereo sound from OpenBSD is wonderful now and I can finally stop downmixing everything to mono to play from the left speaker. In case you ever need to do this, sndiod can be run with -c 0:0 to reduce the channels to one.\nDue to the massive size of the code needed for this quirk, I’m not sure if I’ll be committing it upstream in OpenBSD or just saving it for my own tree. But at least now the hardware support chart for my Matebook is all yeses for the things I care about.\nI’ve also updated the Linux bug report that I opened before venturing down this path, hoping one of the maintainers of that HDA code that works at Intel or Realtek knew of a solution I could just port to OpenBSD. I’m curious to see what they’ll do with it.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://virtuallyfun.com/wordpress/2018/11/26/why-bsd-os-is-the-best-candidate-for-being-the-only-tested-legally-open-unix/\">Why BSD/OS is the best candidate for being the only tested legally open UNIX</a></h3>\n\n<ul>\n    <li>Introduction</li>\n</ul>\n\n<blockquote>The UNIX® system is an old operating system, possibly older than many of the readers of this post. However, despite its age, it still has not been open sourced completely. In this post, I will try to detail which parts of which UNIX systems have not yet been open sourced. I will focus on the legal situation in Germany in particular, taking it representative of European law in general – albeit that is a stretch, knowing the diversity of European jurisdictions. Please note that familiarity with basic terms of copyright law is assumed.</blockquote>\n\n<ul>\n    <li>Ancient UNIX</li>\n</ul>\n\n<blockquote>The term “Ancient UNIX” refers to the versions of UNIX up to and including Seventh Edition UNIX (1979) including the 32V port to the VAX. Ancient UNIX was created at Bell Laboratories, a subsidiary of AT&amp;T at the time. It was later transferred of the AT&amp;T UNIX Support Group, then AT&amp;T Information Systems and finally the AT&amp;T subsidiary UNIX System Laboratories, Inc. (USL). The legal situation differs between the United States of America and Germany.\nIn a ruling as part of the UNIX System Laboratories, Inc. v. Berkeley Software Design, Inc. (USL v. BSDi) case, a U.S. court found that USL had no copyright to the Seventh Edition UNIX system and 32V – arguably, by extension, all earlier versions of Ancient UNIX as well – because USL/AT&amp;T had failed to affix copyright notices and could not demonstrate a trade secret. Due to the obsessive tendency of U.S. courts to consider themselves bound to precedents (cf. the infamous Pierson v. Post case), it can be reasonably expected that this ruling would be honored and applied in subsequent cases. Thus under U.S. law, Ancient UNIX can be safely assumed to belong in the public domain.\nThe situation differs in Germany. Unlike the U.S., copyright never needed registration in order to exist. Computer programs are works in the sense of the German 1965 Act on Copyright and Related Rights (Copyright Act, henceforth CopyA) as per CopyA § 2(1) no. 1. Even prior to the amendment of CopyA § 2(1) to include computer programs, computer programs have been recognized as copyrightable works by the German Supreme Court (BGHZ 112, 264 Betriebssystem, no. 19); CopyA § 137d(1) rightly clarifies that. The copyright holder at 1979 would still have been USL via Bell Labs and AT&amp;T. Copyright of computer programs is transferred to the employer upon creation under CopyA § 69(1).\nNote that this does not affect expiry (Daniel Kaboth/Benjamin Spies, commentary on CopyA §§ 69a‒69g, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), Urheberrecht: UrhG, KUG, VerlG, VGG, Kommentar, 4th ed., C. H. Beck, 2018, no. 16 ad CopyA § 69b; cf. Bundestag-Drucksache [BT-Drs.] 12/4022, p. 10). Expiry occurs 70 years after the death of the (co-)author that died most recently as per CopyA § 65(1) and 64; this has been the case since at least the 1960s, meaning there is no way for copyright to have expired already (old version, as per Bundesgesetzblatt Part I No. 51 of September 16, 1965, pp. 1273‒1294).\nIn Germany, private international law applies the so-called “Territorialitätsprinzip” for intellectual property rights. This means that the effect of an intellectual property right is limited to the territory of a state (Anne Lauber-Rönsberg, KollisionsR, in: Hartwig Ahlberg/Horst-Peter Götting (eds.), ibid., pp. 2241 et seqq., no. 4). Additionally, the “Schutzlandprinzip” applies; this means that protection of intellectual property follows the lex loci protectionis, i.e. the law of the country for which protection is sought (BGH GRUR 2015, 264 HiHotel II, no. 25; BGH GRUR 2003, 328 Sender Felsberg, no. 24), albeit this is criticized in parts of doctrine (Lauber-Rönsberg, ibid., no. 10). The “Schutzlandprinzip” requires that the existence of an intellectual property right be verified as well (BGH ZUM 2016, 522 Wagenfeld-Leuchte II, no. 19).\nThus, in Germany, copyright on Ancient UNIX is still alive and well. Who has it, though? A ruling by the U.S. Court of Appeals, Tenth Circuit, in the case of The SCO Group, Inc. v. Novell, Inc. (SCO v. Novell) in the U.S. made clear that Novell owns the rights to System V – thus presumably UNIX System III as well – and Ancient UNIX, though SCO acquired enough rights to develop UnixWare/OpenServer (Ruling 10-4122 [D.C. No. 2:04-CV-00139-TS], pp. 19 et seq.). Novell itself was purchased by the Attachmate Group, which was in turn acquired by the COBOL vendor Micro Focus. Therefore, the rights to SVRX and – outside the U.S. – are with Micro Focus right now. If all you care about is the U.S., you can stop reading about Ancient UNIX here.\nSo how does the Caldera license factor into all of this? For some context, the license was issued January 23, 2002 and covers Ancient UNIX (V1 through V7 including 32V), specifically excluding System III and System V. Caldera, Inc. was founded in 1994. The Santa Cruz Operation, Inc. sold its rights to UNIX to Caldera in 2001, renamed itself to Tarantella Inc. and Caldera renamed itself The SCO Group. Nemo plus iuris ad alium transferre potest quam ipse habet; no one can transfer more rights than he has. The question now becomes whether Caldera had the rights to issue the Caldera license.\nI’ve noted it above but it needs restating: Foreign decisions are not necessarily accepted in Germany due to the “Territorialitätsprinzip” and “Schutzlandprinzip” – however, I will be citing a U.S. ruling for its assessment of the facts for the sake of simplicity. As per ruling 10-4122, “The district court found the parties intended for SCO to serve as Novell’s agent with respect to the old SVRX licenses and the only portion of the UNIX business transferred outright under the APA [asset purchase agreement] was the ability to exploit and further develop the newer UnixWare system. SCO was able to protect that business because it was able to copyright its own improvements to the system. The only reason to protect the earlier UNIX code would be to protect the existing SVRX licenses, and the court concluded Novell retained ultimate control over that portion of the business under the APA.” The relevant agreements consist of multiple pieces:\nthe base Asset Purchase Agreement “APA” (Part I)\nthe base Asset Purchase Agreement “APA” (Part II)\nthe Operating Agremeent and Amendment 1 to the APA\nthe Amendment 2 to the APA\nThe APA dates September 19, 1995, from before the Caldera license. Caldera cannot possibly have acquired rights that The Santa Cruz Operation, Inc. itself never had. Furthermore, I’ve failed to find any mention of Ancient UNIX; all that is transferred is rights to SVRX. Overall, I believe that the U.S. courts’ assesment of the facts represents the situation accurately. Thus for all intents and purposes, UNIX up to and including System V remained with Novell/Attachmate/Micro Focus. Caldera therefore never had any rights to Ancient UNIX, which means it never had the rights to issue the Caldera license. The Caldera license is null and void – in the U.S. because the copyright has been lost due to formalities, everywhere else because Caldera never had the rights to issue it.\nThe first step to truly freeing UNIX would this be to get Micro Focus to re-issue the Caldera license for Ancient UNIX, ideally it would now also include System III and System V.</blockquote>\n\n<ul>\n    <li>BSD/OS</li>\n</ul>\n\n<blockquote>Another operating system near UNIX is of interest. The USL v. BSDi lawsuit includes two parties: USL, which we have seen above, and Berkeley Software Design, Inc. BSDi sold BSD/386 (later BSD/OS), which was a derivative of 4.4BSD. The software parts of the BSDi company were acquired by Wind River Systems, whereas the hardware parts went to iXsystems. Copyright is not disputed there, though Wind River Systems ceased selling BSD/OS products 15 years ago, in 2003. In addition, Wind River System let their trademark on BSD expire, though this is without consequence for copyright.\nBSD/OS is notable in the sense that it powered much of early internet infrastructure. Traces of its legacy can still be found on Richard Stevens’ FAQ.\nTo truly make UNIX history free, BSD/OS would arguably also need to see a source code release. BSD/OS at least in its earliest releases under BSDi would ship with source code, though under a non-free license, far from BSD or even GPL licensing.</blockquote>\n\n<ul>\n    <li>System V</li>\n</ul>\n\n<blockquote>The fate of System V as a whole is difficult to determine. Various licenses have been granted to a number of vendors (Dell UNIX comes to mind; HP for HP-UX, IBM for AIX, SGI UNIX, etc.). Sun released OpenSolaris – notoriously, Oracle closed the source to Solaris again after its release –, which is a System V Release 4 descendant. However, this means nothing for the copyright or licensing status of System V itself. Presumably, the rights with System V still remain with Novell (now Micro Focus): SCO managed to sublicense rights to develop and sell UnixWare/OpenServer, themselves System V/III descendants, to unXis, Inc. (now known as Xinuos, Inc.), which implies that Xinuos is not the copyright holder of System V.\nObviously, to free UNIX, System V and its entire family of descendants would also need to be open sourced. However, I expect tremendous resistance on part of all the companies mentioned. As noted in the “Ancient UNIX” section, Micro Focus alone would probably be sufficient to release System V, though this would mean nothing for the other commercial System V derivatives.</blockquote>\n\n<ul>\n    <li>Newer Research UNIX</li>\n</ul>\n\n<blockquote>The fate of Bell Labs would be a different one; it would go on to be purchased by Lucent, now part of Nokia. After commercial UNIX got separated out to USL, Research UNIX would continue to exist inside of Bell Labs. Research UNIX V8, V9 and V10 were not quite released by Alcatel-Lucent USA Inc. and Nokia in 2017.\nHowever, this is merely a notice that the companies involved will not assert their copyrights only with respect to any non-commercial usage of the code. It is still not possible, over 30 years later, to freely use the V8 code.</blockquote>\n\n<ul>\n    <li>Conclusion\nIn the U.S., Ancient UNIX is freely available. People located everywhere else, however, are unable to legally obtain UNIX code for any of the systems mentioned above. The exception being BSD/OS, assuming a purchase of a legitimate copy of the source code CD. This is deeply unsatisfying and I implore all involved companies to consider open sourcing (preferably under a BSD-style license) their code older than a decade, if nothing else, then at least for the sake of historical purposes. I would like to encourage everybody reading this to consider reaching out to Micro Focus and Wind River Systems about System V and BSD/OS, respectively. Perhaps the masses can change their minds.</li>\n</ul>\n\n<blockquote>A small note about patents: Some technologies used in newer iterations of the UNIX system (in particular the System V derivatives) may be encumbered with software patents. An open source license will not help against patent infringement claims. However, the patents on anything used in the historical operating systems will certainly have expired by now. In addition, European readers can ignore this entirely – software patents just aren’t a thing.</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://labs.ripe.net/Members/claudio_jeker/openbgpd-adding-diversity-to-route-server-landscape\">OpenBGPD - Adding Diversity to the Route Server Landscape</a></h3>\n\n<ul>\n    <li>Introduction</li>\n</ul>\n\n<blockquote>As of last year, there was effectively only a single solution in the Route Server vendor market: the BIRD Internet routing daemon. <a href=\"http://NIC.CZ\">NIC.CZ</a> (the organisation developing BIRD) has done fantastic work on maintaining their BGP-4 implementation, however, it’s not healthy to have virtually every Internet Exchange Point (IXP) in the RIPE NCC service region depend on a single open source project. The current situation can be compared to the state of the DNS root nameservers back in 2002 - their dependence on the BIND nameserver daemon and the resulting development of NSD as an alternative by NLnet, in cooperation with the RIPE NCC.\nOpenBGPD used to be one of the most popular Route Server implementations until the early 2010s. OpenBGPD’s main problem was that its performance couldn’t keep up with the Internet’s growth, so it lost market share. An analysis by Job Snijders suggested that a modernised OpenBGPD distribution would be a most viable option to regain diversity on the Route Server level.</blockquote>\n\n<ul>\n    <li>Missing features in OpenBGPD</li>\n</ul>\n\n<blockquote>The following main missing features were identified in OpenBGPD:</blockquote>\n\n<ul>\n    <li>Performance</li>\n</ul>\n\n<blockquote>In previous versions of OpenBGPD, the filtering performance didn’t allow proper filtering of all EBGP sessions. Current best practice at IXP Route Servers is to carefully evaluate and validate of all routes learned from EBGP peers. The OpenBGPD ruleset required to do correct filtering (in many deployment scenarios) was simply too lengthy - and negatively impacted service performance during configuration reloads. While filtering performance is the biggest bottleneck, general improvements to the Routing Information Base were also made to improve scalability. IXP Route Servers with a few hundred peering sessions are commonplace and adding new sessions shouldn’t impact the Route Servers’ service to other peers. We found that performance was the most pressing issue that needed to be tackled.</blockquote>\n\n<ul>\n    <li>Lack of RPKI Origin Validation</li>\n</ul>\n\n<blockquote>As we’ve seen, Internet operators are moving to adopt RPKI based BGP Origin Validation. While it was theoretically possible to emulate RFC 6811-style Origin Validation in previous versions of OpenBGPD, the required configuration wasn’t optimised for performance and wasn’t user friendly. We believe that BGP Origin Validation should be as easy as possible - this requires BGP-4 vendors to implement native, optimised routines for Origin Validation. Of course, enabling Origin Validation shouldn’t have an impact on performance either when processing BGP updates or when updating the Route Origin Authorisation (ROA) table itself.</blockquote>\n\n<ul>\n    <li>Portability</li>\n</ul>\n\n<blockquote>OpenBGPD is an integral part of OpenBSD, but IXPs may prefer to run their services infrastructure on an operating system of their choice. Making sure that there’s a portable OpenBGPD version which follows the OpenBSD project release cycle will give IXPs this option.</blockquote>\n\n<ul>\n    <li>Development steps</li>\n</ul>\n\n<blockquote>By addressing the issues mentioned above, we could bring back OpenBGPD as a viable Route Server implementation.\nSince I was one of the core OpenBGPD developers, I was asked if I wanted to pick up this project again. Thanks to the funding from the RIPE NCC Project Fund, this was possible. Starting in June 2018, I worked full time on this important community project. Over the last few months, many of the problems are already addressed and are now part of the OpenBSD 6.4 release. So far, 154 commits were made to OpenBGPD during the 6.4 development cycle - around 8% of all commits ever to OpenBGPD! This shows that due to funding and dedicated resources, a lot of work could be pushed into the latest release of OpenBGPD.</blockquote>\n\n<ul>\n    <li>OpenBGPD 6.4</li>\n</ul>\n\n<blockquote>The OpenBGPD version, as part of OpenBSD 6.4 release, demonstrates great progress. Even though there have been many changes to the core of OpenBGPD, the released version is as solid and reliable as previous releases and the many bug fixes and improvements make this the best OpenBGPD release so far. The changes in the filter language allow users to write more efficient rulesets while the introduction of RPKI origination validation fixes an important missing feature. For IXPs, OpenBGPD now is an alternative again. There are still open issues, but the gap is closing!</blockquote>\n\n<ul>\n    <li>Feature highlights</li>\n</ul>\n\n<blockquote>The following changes should be highlighted:</blockquote>\n\n<ul>\n    <li>Introduction of background soft-reconfiguration on config reload. Running the soft-reconfiguration task in the background allows for new updates and withdraws to be processed at the same time. This improves convergence time - one of the key metrics for Route Servers.</li>\n    <li>BGP Origin Validation when a roa-set is configured Every EBGP route announcement is validated against the locally configured VRP table entries. Depending on the validation process’s outcome, the validation state is set to valid, invalid or not found. The filter language has been extended to allow checking for the origin validation state, and thanks to this, it is possible to deny invalid prefixes or regard valid prefixes different to the ones that aren’t found. The roa-set table is read from the configuration file and updated during configuration reloads. On production systems reloading the roa-set and applying it to all prefixes is done in a couple of seconds.</li>\n    <li>Fast prefix-set lookups In OpenBSD 6.3 prefix-sets got introduced in OpenBGPD. A prefix-set combines many prefix lookups into a single filter rule. The original implementation wasn’t optimised but now a fast trie lookup is used. Thanks to this, large IRR DB prefix tables can now be implemented efficiently.</li>\n    <li>Introduction of as-sets Similar to prefix-sets, as-sets help group many AS numbers into a single lookup. Thanks to this, large IRR DB origin AS tables can be implemented efficiently.\nIntroduction of origin-sets</li>\n    <li>Looking at the configurations of Route Servers doing full filtering, it was noticed that a common lookup was binding a prefix to an origin AS - similar to how a roa-set is used for RPKI. These origin-set tables are used to extend the IRR prefix lookup and generated from alternative sources.</li>\n    <li>Improving third party tools</li>\n</ul>\n\n<blockquote>Users can only benefit from the changes introduced in OpenBGPD 6.4 when the surrounding 3rd party tools are adjusted accordingly. Two opensource projects such as bgpq3 and arouteserver are frequently used by network operators and IXPs to generate BGP configurations. Thanks to our contributions to those projects, we were able to get them ready for all the new features in OpenBGPD.</blockquote>\n\n<ul>\n    <li>bgpq3 was extended to create as-set and prefix-set tables based on IRR DB entries. This is replacing the old way of doing the same with a large amount of filter rules. Thanks to the quick response from the bgpq3 maintainer, it was possible to ship OpenBSD 6.4 with a bgpq3 package that includes all the new features.</li>\n    <li>arouteserver was adjusted to implement RPKI roa-set, as-set, prefix-set, and origin-set to generate a much better-performing configurations for the 6.4 version. With the v0.20.0 release of arouteserver, IXPs are able to generate an OpenBGPD configuration which is a ton faster but also implements the new functionalities. Looking at YYCIX (the resident IXP in Calgary, Canada) the ruleset generated by arouteserver was reduced from 370,000 rules to well under 6,000 rules. This resulted in the initial convergence time dropping from over 1 hour to less than 2 minutes, and subsequent configuration reloads are hitless and no longer noticeable.</li>\n    <li>What still needs to be done</li>\n</ul>\n\n<blockquote>A sizeable chunk of work still left on the table is the rework of the RIB data structures in OpenBGPD - these haven’t been changed since the initial design of OpenBGPD in 2003. There’s currently ongoing work (in small steps, to avoid jeopardising the stability of OpenBGPD) to modernise these data-structures. The goal is to provide better decoupling of the filter step from storing RIB database changes, to pave the way to multi-threaded operations at a later point.</blockquote>\n\n<ul>\n    <li>Looking forward</li>\n    <li>Job Snijders oversaw this year’s fundraising and project management, he adds:</li>\n</ul>\n\n<blockquote>It’s been incredibly productive to create an environment where a core developer is allowed to work full time on the OpenBGPD code base. However, it’s important to note there still is room for a number of new features to help improve its operational capabilities (such as BMP, RFC 7313, ADD_PATH, etc). It’d be beneficial to the Internet community at large if we can extend Claudio Jeker’s involvement for another year. Open source software doesn’t grow on trees! Strategic investments are the only way to keep OpenBGPD’s roadmap aligned with Internet growth and operator requirements.</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n    <li><a href=\"http://lists.dragonflybsd.org/pipermail/commits/2018-November/718130.html\">DragonFly - git: annotated tag v5.5.0 created</a></li>\n    <li><a href=\"https://www.youtube.com/watch?v=Qvj7Mkr13d8\">Torchlight 2 on NetBSD</a></li>\n    <li><a href=\"https://www.usenix.org/system/files/login/articles/login_dec14_03_dawidek.pdf\">Older, but still good USENIX Login Article on Capsicum</a></li>\n    <li><a href=\"https://github.com/myfreeweb/capsicumizer\">The Super Capsicumizer 9000</a></li>\n    <li><a href=\"https://www.noc-ps.com/\">Dedicated and Virtual Server PXE provisioning tool</a></li>\n    <li><a href=\"https://cirrus-ci.org/guide/FreeBSD/\">Cirrus CI have announced FreeBSD support</a></li>\n    <li><a href=\"https://twitter.com/astr0baby/status/1065353771952336897\">NetBSD PineBook Gameplay</a></li>\n    <li><a href=\"http://www.bsdcan.org/2019/papers.php\">BSDCan 2019 CfP is out</a></li>\n    <li>Allan’s first ZFS array, Zulu, turned 7 years old on Nov 29th</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n    <li>Malcom - <a href=\"http://dpaste.com/35TNNX4\">Installing Drivers in Development</a></li>\n    <li>Samir - <a href=\"http://dpaste.com/2RCB37Y#wrap\">Introduction to ZFS</a></li>\n    <li>Newnix - <a href=\"http://dpaste.com/01YJ4EB#wrap\">Drive Failures</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n    <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"DragonflyBSD 5.4 has been released, down the Gopher hole with OpenBSD, OpenBSD in stereo with VFIO, BSD/OS the best candidate for legally tested open source Unix, OpenBGPD adds diversity to the routing server landscape, and more.","date_published":"2018-12-09T04:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/233f4bf5-4bc3-453e-9e99-c78b18a453e0.mp3","mime_type":"audio/mp3","size_in_bytes":51110355,"duration_in_seconds":5092}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2962","title":"Episode 274: Language: Assembly | BSD Now 274","url":"https://www.bsdnow.tv/274","content_text":"Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.\n\n##Headlines\n###Assembly language on OpenBSD amd64+arm64\n\n\nThis is a short introduction to assembly language programming on OpenBSD/amd64+arm64. Because of security features in the kernel, I have had to rethink a series of tutorials covering Aarch64 assembly language on OpenBSD, and therefore this will serve as a placeholder-cum-reminder.\n\n\n\nOpenBSD, like many UNIX and unix-like operating systems, now uses the Executable and Linkable Format (ELF) for its binary libraries and executables. Although the structure of this format is beyond the scope of this short introduction, it is necessary for me to explain part of one of the headers.\n\n\n\nWithin the program header there are sections known as PT_NOTE that OpenBSD and other systems use to distinguish their ELF executables - OpenBSD looks for this section to check if it should attempt to execute the program or not.\n\n\n\nOur first program: in C!\n\n\n\nIt’s often a good idea to prototype your assembly programs in a high level language such as C - it can then double up as both a set of notes and a working program that you can debug and compile into assembly language to compare with your own asm code.\n\n\n\nSee the article for the rest on:\nOur first program: in x86-64 Asm (AT&amp;T/GAS syntax)\nOur first program: in inline x86-64 assembly\nOur first program: in x86-64 asm (NASM syntax)\nOur first program: in ARMv8 AArch64 assembly\n\n\n\n\n###Using bhyve for FreeBSD Development\n\n\nThe Hypervisor\n\n\n\nThe bhyve hypervisor requires a 64-bit x86 processor with hardware support for virtualization.  This requirement allows for a simple, clean hypervisor implementation, but it does require a fairly recent\nprocessor.  The current hypervisor requires an Intel processor, but there is an active development branch with support for AMD processors.\nThe hypervisor itself contains both user and kernel components.  The kernel driver is contained in the vmm.ko module and can be loaded either at boot from the boot loader or at runtime.  It must\nbe loaded before any guests can be created.  When a guest is created, the kernel driver creates a device file in /dev/vmm which is used by the user programs to interact with the guest.\nThe primary user component is the bhyve(8) program.  It constructs the emulated device tree in the guest and provides the implementation for most of the emulated devices.  It also calls the kernel driver to execute the guest.  Note that the guest always executes inside the driver itself, so guest execution time in the host is counted as system time in the bhyve process.\nCurrently, bhyve does not provide a system firmware interface to the guest (neither BIOS nor UEFI).  Instead, a user program running on the host is used to perform boot time operations including loading the guest operating system kernel into the guest’s memory and setting the initial guest state so that the guest begins execution at the kernel’s entry point.  For FreeBSD guests, the bhyveload(8) program can be used to load the kernel and prepare the guest for execution.  Support for some other operating systems is available via the grub2-bhyve program which is available via the sysutils/grub2-bhyve port or as a prebuilt package.\nThe bhyveload(8) program in FreeBSD 10.0 only supports 64-bit guests.  Support for 32-bit guests will be included in FreeBSD 10.1.\n\n\n\n\nSee the article for the very technical breakdown of the following:\n\n\nNetwork Setup\n\n\nBridged Configuration\n\n\nPrivate Network with NAT\n\n\nUsing dnsmasq with a Private Network\n\n\nRunning Guests via vmrun.sh\n\n\nConfiguring Guests\n\n\nUsing a bhyve Guest as a Target\n\n\nConclusion\n\n\n\n\nThe bhyve hypervisor is a nice addition to a FreeBSD developer’s toolbox.  Guests can be used both to develop new features and to test merges to stable branches.  The hypervisor has a wide variety of uses beyond developing FreeBSD as well.\n\n\n\n\n##News Roundup\n###Games on FreeBSD\n\n\nWhat do all programmers like to do after work? Ok, what do most programers like to do after work? The answer is simple: play a good game! Recently at the Polish BSD User Group meetup mulander was telling us how you can play games on OpenBSD. Today let’s discuss how this looks in the FreeBSD world using the “server only” operating system.\n\n\n\nXNA based games\n\n\n\nOne of the ways of playing natively is to play indie games which use XNA. XNA is a framework from Microsoft which uses .NET, for creating games. Fortunately, in the BSD world we have Mono, an open source implementation of Microsoft’s .NET Framework which you can use to run games. There is also FNA framework which is a reimplementation of XNA which allows you to run the games under Linux. Thomas Frohwein, from OpenBSD, prepared a script, fnaify. Fnaify translate all dependencies used by an FNA game to OpenBSD dependencies.\nI decided to port the script to FreeBSD. The script is using /bin/sh which in the case of OpenBSD is a Korn Shell.\n\n\n\nI didn’t test it with many games, but I don’t see any reason why it shouldn’t work with all the games tested by the OpenBSD guys. For example, with:\n\n\n\n\nCryptark\n\n\nRouge Legacy\n\n\nApotheon\n\n\nEscape Goat\n\n\nBastion\n\n\nCrossCode\n\n\nAtom Zombie Smasher\n\n\nOpen-Source games\n\n\n\n\nIn FreeBSD and OpenBSD we also will find popular games which were open sourced. For example, I spend a lot of time playing in Quake 3 Arena on my FreeBSD machine. You can very simply install it using pkg: # pkg install ioquake3\n\n\n\nThen move the files for the skins and maps to the .ioquake3 directory from your copy of Quake. In the past I also played UrbanTerror which is a fully open source shooter based on the Quake 3 Arena engine. It’s is also very easy to install it from ports: # pkg install iourbanterror\n\n\n\nIn the ports tree in the games directory you can find over 1000 directories, many of them with fully implemented games. I didn’t test many games in this category, but you can find some interesting titles like:\n\n\n\nopenxcom (Open-source re-implementation of the original X-Com)\nopenjazz (Free re-implementation of the Jazz Jackrabbit™ game engine)\ncorsixth (Open source re-implementation of Theme Hospital)\nquake2\nopenra (Red Alert)\nopenrct2 (Open source re-implementation of RollerCoaster Tycoon 2)\nopenmw (Open source engine reimplementation of the game Morrowind)\n\n\n\nAll those titles are simply installed through the packages. In that case I don’t think FreeBSD has any difference from OpenBSD.\n\n\n\nWine\n\n\n\nOne of the big advantages of FreeBSD over OpenBSD is that FreeBSD supports wine. Wine allows you to run Windows applications under other operating systems (including mac). If you are a FreeBSD 11 user, you can simply fetch wine from packages: # pkg install i386-wine\n\n\n\nTo run Windows games, you need to have a 32-bit wine because most of the games on Windows are built on 32-bits (maybe this has changed – I don’t play so much these days). In my case, because I run FreeBSD-CURRENT I needed to build wine from ports. It wasn’t nice, but it also wasn’t unpleasant. The whole step-by-step building process of a wine from ports can be found here.\n\n\n\nSummary\n\n\n\nAs you can see there are many titles available for *BSDs. Thanks to the FNA and fnaify, OpenBSD and FreeBSD can work with indie games which use the XNA framework. There are many interesting games implemented using this framework. Open source is not only for big server machines, and there are many re-implementations of popular games like Theme Hospital or RollerCoaster Tycoon 2. The biggest market is still enabled through wine, although its creates a lot of problems to run the games. Also, if you are an OpenBSD user only this option is not available for you. Please also note that we didn’t discuss any other emulators besides wine. In OpenBSD and FreeBSD there are many of them for GameBoy, SNES, NeoGeo and other games consoles.\n\n\n\n\n###FreeBSD For Thanksgiving\n\n\nI’ve been working on FreeBSD for Intel for almost 6 months now. In the world of programmers, I am considered an old dog, and these 6 months have been all about learning new tricks. Luckily, I’ve found myself in a remarkably inclusive and receptive community whose patience seems plentiful. As I get ready to take some time off for the holidays, and move into that retrospective time of year, I thought I’d beat the rush a bit and update on the progress\nEarlier this year, I decided to move from architect of the Linux graphics driver into a more nebulous role of FreeBSD enabling. I was excited, but also uncertain if I was making the right decision.\nEarlier this half, I decided some general work in power management was highly important and began working there. I attended BSDCam (handsome guy on the right), and led a session on Power Management. I was honored to be able to lead this kind of effort.\nEarlier this quarter, I put the first round of my patches up for review, implementing suspend-to-idle. I have some rougher patches to handle s0ix support when suspending-to-idle. I gave a talk MeetBSD about our team’s work.\nEarlier this month, I noticed that FreeBSD doesn’t have an implementation for Intel Speed Shift (HWPstates), and I started working on that.\nEarlier this week, I was promoted from a lowly mentee committer to a full src committer.\nEarlier today, I decided to relegate my Linux laptop to the role of my backup machine, and I am writing this from my Dell XPS13 running FreeBSD\n\n\nvandamme 13.0-CURRENT FreeBSD 13.0-CURRENT #45 881fee072ff(hwp)-dirty: Mon Nov 19 16:19:32 PST 2018 bwidawsk@vandamme:/usr/home/bwidawsk/usr/obj/usr/home/bwidawsk/usr/src/amd64.amd64/sys/DEVMACHINE amd64\n\n\n6 months later, I feel a lot less uncertain about making the right decision. In fact, I think both opportunities would be great, and I’m thankful this Thanksgiving that this is my life and career. I have more plans and things I want to get done. I’m looking forward to being thankful again next year.\n\n\n\n\n###hammer2: no space left on device on Dragonfly BSD\n\n\nThe Issue\n\n\n\nhammer2 does not actually delete a file when you rm or unlink it. Since recovery of the file is possible (this is the design of hammer2), there will still be an entry taking up data. It’s similar to how git works.\nEven with 75% usage listed here, the filesystem could still have filled up. If you are using it as your root filesystem, then attempts to clean up data may fail. If the kernel panics over this, you will see something like this.\n\n\n\nThe Fix\n\n\n\nIf you have a recent enough version of the rescue ramdisk installed, on bootup you can press ‘r’ and access the rescue ramdisk. Your provider will have to offer some sort of remote interface for interacting with the operating system before it boots, like VNC or IPMI. You can then mount your filesystem using:\n\n\n[root@ ~]# mkdir /tmp/fs\n[root@ ~]# mount_hammer2 -o local /dev/vbd0s1a /tmp/fs\n\n\nIf you receive an error that /sbin/hammer2 is not found, then your rescue ramdisk is not up to date enough. In that scenario, download the latest 5.2 iso from dragonflybsd.org and boot from the cd-rom on your virtual machine or physical device. Just login as root instead of installer.\nIf the mount does succeed, then all you have to do is run the following twice:\n\n\n[root@ ~]# /sbin/hammer2 bulkfree /tmp/fs\n\n\nIf you do not have enough memory on your machine, you may need to mount swap. Add your swap partition to the /etc/fstab and then do:\n\n\n[root@ ~]# swapon -a\n\n\nOnce you have ran the bulkfree command twice, the usage reported by df -h will be correct. However, there is a chance on reboot that a core dump will be placed in /var/crash/ so be prepared to have plenty of space free in case that happens. You should also delete any files you can and run the bulkfree operation twice afterwards to clear up additional space.\n\n\n\n\n##Beastie Bits\n\n\nBSD Pizza Night - Portland\nbsd@35c3: …the place for you…*NIX!\nProject Trident PreRelease Image now available\nPlay Stardew Valley on OpenBSD\nGUI Wrapper for OpenBSD mixerctl\nqtv - QuickTextViewer\n\n\n\n\n##Feedback/Questions\n\n\nRon - Ideas for feedback section\nPaulo - SDIO Firmware\nDan - Some fun ZFS questions about labels\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://cryogenix.net/OpenBSD_assembly.html\">Assembly language on OpenBSD amd64+arm64</a></p>\n\n<blockquote>\n<p>This is a short introduction to assembly language programming on OpenBSD/amd64+arm64. Because of security features in the kernel, I have had to rethink a series of tutorials covering Aarch64 assembly language on OpenBSD, and therefore this will serve as a placeholder-cum-reminder.</p>\n</blockquote>\n\n<blockquote>\n<p>OpenBSD, like many UNIX and unix-like operating systems, now uses the Executable and Linkable Format (ELF) for its binary libraries and executables. Although the structure of this format is beyond the scope of this short introduction, it is necessary for me to explain part of one of the headers.</p>\n</blockquote>\n\n<blockquote>\n<p>Within the program header there are sections known as PT_NOTE that OpenBSD and other systems use to distinguish their ELF executables - OpenBSD looks for this section to check if it should attempt to execute the program or not.</p>\n</blockquote>\n\n<ul>\n<li>Our first program: in C!</li>\n</ul>\n\n<blockquote>\n<p>It’s often a good idea to prototype your assembly programs in a high level language such as C - it can then double up as both a set of notes and a working program that you can debug and compile into assembly language to compare with your own asm code.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the rest on:</li>\n<li>Our first program: in x86-64 Asm (AT&amp;T/GAS syntax)</li>\n<li>Our first program: in inline x86-64 assembly</li>\n<li>Our first program: in x86-64 asm (NASM syntax)</li>\n<li>Our first program: in ARMv8 AArch64 assembly</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://bsdjhb.blogspot.com/2018/10/using-bhyve-for-freebsd-development.html\">Using bhyve for FreeBSD Development</a></p>\n\n<ul>\n<li>The Hypervisor</li>\n</ul>\n\n<blockquote>\n<p>The bhyve hypervisor requires a 64-bit x86 processor with hardware support for virtualization.  This requirement allows for a simple, clean hypervisor implementation, but it does require a fairly recent<br>\nprocessor.  The current hypervisor requires an Intel processor, but there is an active development branch with support for AMD processors.<br>\nThe hypervisor itself contains both user and kernel components.  The kernel driver is contained in the vmm.ko module and can be loaded either at boot from the boot loader or at runtime.  It must<br>\nbe loaded before any guests can be created.  When a guest is created, the kernel driver creates a device file in /dev/vmm which is used by the user programs to interact with the guest.<br>\nThe primary user component is the bhyve(8) program.  It constructs the emulated device tree in the guest and provides the implementation for most of the emulated devices.  It also calls the kernel driver to execute the guest.  Note that the guest always executes inside the driver itself, so guest execution time in the host is counted as system time in the bhyve process.<br>\nCurrently, bhyve does not provide a system firmware interface to the guest (neither BIOS nor UEFI).  Instead, a user program running on the host is used to perform boot time operations including loading the guest operating system kernel into the guest’s memory and setting the initial guest state so that the guest begins execution at the kernel’s entry point.  For FreeBSD guests, the bhyveload(8) program can be used to load the kernel and prepare the guest for execution.  Support for some other operating systems is available via the grub2-bhyve program which is available via the sysutils/grub2-bhyve port or as a prebuilt package.<br>\nThe bhyveload(8) program in FreeBSD 10.0 only supports 64-bit guests.  Support for 32-bit guests will be included in FreeBSD 10.1.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>See the article for the very technical breakdown of the following:</p>\n</li>\n<li>\n<p>Network Setup</p>\n</li>\n<li>\n<p>Bridged Configuration</p>\n</li>\n<li>\n<p>Private Network with NAT</p>\n</li>\n<li>\n<p>Using dnsmasq with a Private Network</p>\n</li>\n<li>\n<p>Running Guests via <a href=\"http://vmrun.sh\">vmrun.sh</a></p>\n</li>\n<li>\n<p>Configuring Guests</p>\n</li>\n<li>\n<p>Using a bhyve Guest as a Target</p>\n</li>\n<li>\n<p>Conclusion</p>\n</li>\n</ul>\n\n<blockquote>\n<p>The bhyve hypervisor is a nice addition to a FreeBSD developer’s toolbox.  Guests can be used both to develop new features and to test merges to stable branches.  The hypervisor has a wide variety of uses beyond developing FreeBSD as well.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://oshogbo.vexillium.org/blog/58/\">Games on FreeBSD</a></p>\n\n<blockquote>\n<p>What do all programmers like to do after work? Ok, what do most programers like to do after work? The answer is simple: play a good game! Recently at the Polish BSD User Group meetup mulander was telling us how you can play games on OpenBSD. Today let’s discuss how this looks in the FreeBSD world using the “server only” operating system.</p>\n</blockquote>\n\n<ul>\n<li>XNA based games</li>\n</ul>\n\n<blockquote>\n<p>One of the ways of playing natively is to play indie games which use XNA. XNA is a framework from Microsoft which uses .NET, for creating games. Fortunately, in the BSD world we have Mono, an open source implementation of Microsoft’s .NET Framework which you can use to run games. There is also FNA framework which is a reimplementation of XNA which allows you to run the games under Linux. Thomas Frohwein, from OpenBSD, prepared a script, fnaify. Fnaify translate all dependencies used by an FNA game to OpenBSD dependencies.<br>\nI decided to port the script to FreeBSD. The script is using /bin/sh which in the case of OpenBSD is a Korn Shell.</p>\n</blockquote>\n\n<blockquote>\n<p>I didn’t test it with many games, but I don’t see any reason why it shouldn’t work with all the games tested by the OpenBSD guys. For example, with:</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Cryptark</p>\n</li>\n<li>\n<p>Rouge Legacy</p>\n</li>\n<li>\n<p>Apotheon</p>\n</li>\n<li>\n<p>Escape Goat</p>\n</li>\n<li>\n<p>Bastion</p>\n</li>\n<li>\n<p>CrossCode</p>\n</li>\n<li>\n<p>Atom Zombie Smasher</p>\n</li>\n<li>\n<p>Open-Source games</p>\n</li>\n</ul>\n\n<blockquote>\n<p>In FreeBSD and OpenBSD we also will find popular games which were open sourced. For example, I spend a lot of time playing in Quake 3 Arena on my FreeBSD machine. You can very simply install it using pkg: <code># pkg install ioquake3</code></p>\n</blockquote>\n\n<blockquote>\n<p>Then move the files for the skins and maps to the .ioquake3 directory from your copy of Quake. In the past I also played UrbanTerror which is a fully open source shooter based on the Quake 3 Arena engine. It’s is also very easy to install it from ports: <code># pkg install iourbanterror</code></p>\n</blockquote>\n\n<blockquote>\n<p>In the ports tree in the games directory you can find over 1000 directories, many of them with fully implemented games. I didn’t test many games in this category, but you can find some interesting titles like:</p>\n</blockquote>\n\n<ul>\n<li>openxcom (Open-source re-implementation of the original X-Com)</li>\n<li>openjazz (Free re-implementation of the Jazz Jackrabbit™ game engine)</li>\n<li>corsixth (Open source re-implementation of Theme Hospital)</li>\n<li>quake2</li>\n<li>openra (Red Alert)</li>\n<li>openrct2 (Open source re-implementation of RollerCoaster Tycoon 2)</li>\n<li>openmw (Open source engine reimplementation of the game Morrowind)</li>\n</ul>\n\n<blockquote>\n<p>All those titles are simply installed through the packages. In that case I don’t think FreeBSD has any difference from OpenBSD.</p>\n</blockquote>\n\n<ul>\n<li>Wine</li>\n</ul>\n\n<blockquote>\n<p>One of the big advantages of FreeBSD over OpenBSD is that FreeBSD supports wine. Wine allows you to run Windows applications under other operating systems (including mac). If you are a FreeBSD 11 user, you can simply fetch wine from packages: <code># pkg install i386-wine</code></p>\n</blockquote>\n\n<blockquote>\n<p>To run Windows games, you need to have a 32-bit wine because most of the games on Windows are built on 32-bits (maybe this has changed – I don’t play so much these days). In my case, because I run FreeBSD-CURRENT I needed to build wine from ports. It wasn’t nice, but it also wasn’t unpleasant. The whole step-by-step building process of a wine from ports can be found here.</p>\n</blockquote>\n\n<ul>\n<li>Summary</li>\n</ul>\n\n<blockquote>\n<p>As you can see there are many titles available for *BSDs. Thanks to the FNA and fnaify, OpenBSD and FreeBSD can work with indie games which use the XNA framework. There are many interesting games implemented using this framework. Open source is not only for big server machines, and there are many re-implementations of popular games like Theme Hospital or RollerCoaster Tycoon 2. The biggest market is still enabled through wine, although its creates a lot of problems to run the games. Also, if you are an OpenBSD user only this option is not available for you. Please also note that we didn’t discuss any other emulators besides wine. In OpenBSD and FreeBSD there are many of them for GameBoy, SNES, NeoGeo and other games consoles.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://bwidawsk.net/blog/index.php/2018/11/freebsd-for-thanksgiving/\">FreeBSD For Thanksgiving</a></p>\n\n<blockquote>\n<p>I’ve been working on FreeBSD for Intel for almost 6 months now. In the world of programmers, I am considered an old dog, and these 6 months have been all about learning new tricks. Luckily, I’ve found myself in a remarkably inclusive and receptive community whose patience seems plentiful. As I get ready to take some time off for the holidays, and move into that retrospective time of year, I thought I’d beat the rush a bit and update on the progress<br>\nEarlier this year, I decided to move from architect of the Linux graphics driver into a more nebulous role of FreeBSD enabling. I was excited, but also uncertain if I was making the right decision.<br>\nEarlier this half, I decided some general work in power management was highly important and began working there. I attended BSDCam (handsome guy on the right), and led a session on Power Management. I was honored to be able to lead this kind of effort.<br>\nEarlier this quarter, I put the first round of my patches up for review, implementing suspend-to-idle. I have some rougher patches to handle s0ix support when suspending-to-idle. I gave a talk MeetBSD about our team’s work.<br>\nEarlier this month, I noticed that FreeBSD doesn’t have an implementation for Intel Speed Shift (HWPstates), and I started working on that.<br>\nEarlier this week, I was promoted from a lowly mentee committer to a full src committer.<br>\nEarlier today, I decided to relegate my Linux laptop to the role of my backup machine, and I am writing this from my Dell XPS13 running FreeBSD</p>\n</blockquote>\n\n<p><code>vandamme 13.0-CURRENT FreeBSD 13.0-CURRENT #45 881fee072ff(hwp)-dirty: Mon Nov 19 16:19:32 PST 2018 bwidawsk@vandamme:/usr/home/bwidawsk/usr/obj/usr/home/bwidawsk/usr/src/amd64.amd64/sys/DEVMACHINE amd64</code></p>\n\n<blockquote>\n<p>6 months later, I feel a lot less uncertain about making the right decision. In fact, I think both opportunities would be great, and I’m thankful this Thanksgiving that this is my life and career. I have more plans and things I want to get done. I’m looking forward to being thankful again next year.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.garyshood.com/hammer2-space/\">hammer2: no space left on device on Dragonfly BSD</a></p>\n\n<ul>\n<li>The Issue</li>\n</ul>\n\n<blockquote>\n<p>hammer2 does not actually delete a file when you rm or unlink it. Since recovery of the file is possible (this is the design of hammer2), there will still be an entry taking up data. It’s similar to how git works.<br>\nEven with 75% usage listed here, the filesystem could still have filled up. If you are using it as your root filesystem, then attempts to clean up data may fail. If the kernel panics over this, you will see something like this.</p>\n</blockquote>\n\n<ul>\n<li>The Fix</li>\n</ul>\n\n<blockquote>\n<p>If you have a recent enough version of the rescue ramdisk installed, on bootup you can press ‘r’ and access the rescue ramdisk. Your provider will have to offer some sort of remote interface for interacting with the operating system before it boots, like VNC or IPMI. You can then mount your filesystem using:</p>\n</blockquote>\n\n<p><code>[root@ ~]# mkdir /tmp/fs</code><br>\n<code>[root@ ~]# mount_hammer2 -o local /dev/vbd0s1a /tmp/fs</code></p>\n\n<blockquote>\n<p>If you receive an error that /sbin/hammer2 is not found, then your rescue ramdisk is not up to date enough. In that scenario, download the latest 5.2 iso from <a href=\"http://dragonflybsd.org\">dragonflybsd.org</a> and boot from the cd-rom on your virtual machine or physical device. Just login as root instead of installer.<br>\nIf the mount does succeed, then all you have to do is run the following twice:</p>\n</blockquote>\n\n<p><code>[root@ ~]# /sbin/hammer2 bulkfree /tmp/fs</code></p>\n\n<blockquote>\n<p>If you do not have enough memory on your machine, you may need to mount swap. Add your swap partition to the /etc/fstab and then do:</p>\n</blockquote>\n\n<p><code>[root@ ~]# swapon -a</code></p>\n\n<blockquote>\n<p>Once you have ran the bulkfree command twice, the usage reported by df -h will be correct. However, there is a chance on reboot that a core dump will be placed in /var/crash/ so be prepared to have plenty of space free in case that happens. You should also delete any files you can and run the bulkfree operation twice afterwards to clear up additional space.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"http://dpaste.com/1S9NMZA\">BSD Pizza Night - Portland</a></li>\n<li><a href=\"http://dpaste.com/3T0AB7M\">bsd@35c3: …the place for you…*NIX!</a></li>\n<li><a href=\"http://project-trident.org/download/\">Project Trident PreRelease Image now available</a></li>\n<li><a href=\"https://dataswamp.org/~solene/2018-11-09-stardew-valley.html\">Play Stardew Valley on OpenBSD</a></li>\n<li><a href=\"https://github.com/charlesdaniels/gmixerctl\">GUI Wrapper for OpenBSD mixerctl</a></li>\n<li><a href=\"https://github.com/q5sys/qtv/\">qtv - QuickTextViewer</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Ron - <a href=\"http://dpaste.com/16XT6PQ#wrap\">Ideas for feedback section</a></li>\n<li>Paulo - <a href=\"http://dpaste.com/0BEE730\">SDIO Firmware</a></li>\n<li>Dan - <a href=\"http://dpaste.com/3Q7DERN#wrap\">Some fun ZFS questions about labels</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Assembly language on OpenBSD, using bhyve for FreeBSD development, FreeBSD Gaming, FreeBSD for Thanksgiving, no space left on Dragonfly’s hammer2, and more.","date_published":"2018-11-29T02:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/64460b53-258b-484d-be91-f4b60eac299f.mp3","mime_type":"audio/mp3","size_in_bytes":38828711,"duration_in_seconds":3864}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2927","title":"Episode 273: A Thoughtful Episode | BSD Now 273","url":"https://www.bsdnow.tv/273","content_text":"Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.\n\n##Headlines\n###Some thoughts on NetBSD 8.0\n\n\nNetBSD is a highly portable operating system which can be run on dozens of different hardware architectures. The operating system’s clean and minimal design allow it to be run in all sorts of environments, ranging from embedded devices, to servers, to workstations. While the base operating system is minimal, NetBSD users have access to a large repository of binary packages and a ports tree which I will touch upon later.\nI last tried NetBSD 7.0 about three years ago and decided it was time to test drive the operating system again. In the past three years NetBSD has introduced a few new features, many of them security enhancements. For example, NetBSD now supports write exclusive-or execute (W^X) protection and address space layout randomization (ASLR) to protect programs against common attacks. NetBSD 8.0 also includes USB3 support and the ability to work with ZFS storage volumes.\n\n\n\nEarly impressions\n\n\n\nSince I had set up NetBSD with a Full install and enabled xdm during the setup process, the operating system booted to a graphical login screen. From here we can sign into our account. The login screen does not provide options to shut down or restart the computer. Logging into our account brings up the twm window manager and provides a virtual terminal, courtesy of xterm. There is a panel that provides a method for logging out of the window manager. The twm environment is sparse, fast and devoid of distractions.\n\n\n\nSoftware management\n\n\n\nNetBSD ships with a fairly standard collection of command line tools and manual pages, but otherwise it is a fairly minimal platform. If we want to run network services, have access to a web browser, or use a word processor we are going to need to install more software. There are two main approaches to installing new packages. The first, and easier approach, is to use the pkgin package manager. The pkgin utility works much the same way APT or DNF work in the Linux world, or as pkg works on FreeBSD. We can search for software by name, install or remove items. I found pkgin worked well, though its output can be terse. My only complaint with pkgin is that it does not handle “close enough” package names. For example, if I tried to run “pkgin install vlc” or “pkgin install firefox” I would quickly be told these items did not exist. But a more forgiving package manager will realize items like vlc2 or firefox45 are available and offer to install those.\nThe pkgin tool installs new programs in the /usr/pkg/bin directory. Depending on your configuration and shell, this location may not be in your user’s path, and it will be helpful to adjust your PATH variable accordingly.\nThe other common approach to acquiring new software is to use the pkgsrc framework. I have talked about using pkgsrc before and I will skip the details. Basically, we can download a collection of recipes for building popular open source software and run a command to download and install these items from their source code. Using pkgsrc basically gives us the same software as using pkgin would, but with some added flexibility on the options we use.\nOnce new software has been installed, it may need to be enabled and activated, particularly if it uses (or is) a background service. New items can be enabled in the /etc/rc.conf file and started or stopped using the service command. This works about the same as the service command on FreeBSD and most non-systemd Linux distributions.\n\n\n\nHardware\n\n\n\nI found that, when logged into the twm environment, NetBSD used about 130MB of RAM. This included kernel memory and all active memory. A fresh, Full install used up 1.5GB of disk space. I generally found NetBSD ran well in both VirtualBox and on my desktop computer. The system was quick and stable. I did have trouble getting a higher screen resolution in both environments. NetBSD does not offer VirtualBox add-on modules. There are NetBSD patches for VirtualBox out there, but there is some manual work involved in getting them working. When running on my desktop computer I think the resolution issue was one of finding and dealing with the correct video driver. Screen resolution aside, NetBSD performed well and detected all my hardware.\n\n\n\nPersonal projects\n\n\n\nSince NetBSD provides users with a small, core operating system without many utilities if we want to use NetBSD for something we need to have a project in mind. I had four mini projects in mind I wanted to try this week: install a desktop environment, enable file sharing for computers on the local network, test multimedia (video, audio and YouTube capabilities), and set up a ZFS volume for storage.\nI began with the desktop. Specifically, I followed the same tutorial I used three years ago to try to set up the Xfce desktop. While Xfce and its supporting services installed, I was unable to get a working desktop out of the experience. I could get the Xfce window manager working, but not the entire session. This tutorial worked beautifully with NetBSD 7.0, but not with version 8.0. Undeterred, I switched gears and installed Fluxbox instead. This gave me a slightly more powerful graphical environment than what I had before with twm while maintaining performance. Fluxbox ran without any problems, though its application menu was automatically populated with many programs which were not actually installed.\nNext, I tried installing a few multimedia applications to play audio and video files. Here I ran into a couple of interesting problems. I found the music players I installed would play audio files, but the audio was quite slow. It always sounded like a cassette tape dragging. When I tried to play a video, the entire graphical session would crash, taking me back to the login screen. When I installed Firefox, I found I could play YouTube videos, and the video played smoothly, but again the audio was unusually slow.\nI set up two methods of sharing files on the local network: OpenSSH and FTP. NetBSD basically gives us OpenSSH for free at install time and I added an FTP server through the pkgin package manager which worked beautifully with its default configuration.\nI experimented with ZFS support a little, just enough to confirm I could create and access ZFS volumes. ZFS seems to work on NetBSD just as well, and with the same basic features, as it does on FreeBSD and mainstream Linux distributions. I think this is a good feature for the portable operating system to have since it means we can stick NetBSD on nearly any networked computer and use it as a NAS.\n\n\n\nConclusions\n\n\n\nNetBSD, like its close cousins (FreeBSD and OpenBSD) does not do a lot of hand holding or automation. It offers a foundation that will run on most CPUs and we can choose to build on that foundation. I mention this because, on its own, NetBSD does not do much. If we want to get something out of it, we need to be willing to build on its foundation - we need a project. This is important to keep in mind as I think going into NetBSD and thinking, “Oh I’ll just explore around and expand on this as I go,” will likely lead to disappointment. I recommend figuring out what you want to do before installing NetBSD and making sure the required tools are available in the operating system’s repositories.\nSome of the projects I embarked on this week (using ZFS and setting up file sharing) worked well. Others, like getting multimedia support and a full-featured desktop, did not. Given more time, I’m sure I could find a suitable desktop to install (along with the required documentation to get it and its services running), or customize one based on one of the available window managers. However, any full featured desktop is going to require some manual work. Media support was not great. The right players and codecs were there, but I was not able to get audio to play smoothly.\nMy main complaint with NetBSD relates to my struggle to get some features working to my satisfaction: the documentation is scattered. There are four different sections of the project’s website for documentation (FAQs, The Guide, manual pages and the wiki). Whatever we are looking for is likely to be in one of those, but which one? Or, just as likely, the tutorial we want is not there, but is on a forum or blog somewhere. I found that the documentation provided was often thin, more of a quick reference to remind people how something works rather than a full explanation.\nAs an example, I found a couple of documents relating to setting up a firewall. One dealt with networking NetBSD on a LAN, another explored IPv6 support, but neither gave an overview on syntax or a basic guide to blocking all but one or two ports. It seemed like that information should already be known, or picked up elsewhere.\nNewcomers are likely to be a bit confused by software management guides for the same reason. Some pages refer to using a tool called pkg_add, others use pkgsrc and its make utility, others mention pkgin. Ultimately, these tools each give approximately the same result, but work differently and yet are mentioned almost interchangeably. I have used NetBSD before a few times and could stumble through these guides, but new users are likely to come away confused.\nOne quirk of NetBSD, which may be a security feature or an inconvenience, depending on one’s point of view, is super user programs are not included in regular users’ paths. This means we need to change our path if we want to be able to run programs typically used by root. For example, shutdown and mount are not in regular users’ paths by default. This made checking some things tricky for me.\nUltimately though, NetBSD is not famous for its convenience or features so much as its flexibility. The operating system will run on virtually any processor and should work almost identically across multiple platforms. That gives NetBSD users a good deal of consistency across a range of hardware and the chance to experiment with a member of the Unix family on hardware that might not be compatible with Linux or the other BSDs.\n\n\n\n\n###Showing a Gigabit OpenBSD Firewall Some Monitoring Love\n\n\nI have a pretty long history of running my home servers or firewalls on “exotic” hardware. At first, it was Sun Microsystem hardware, then it moved to the excellent Soekris line, with some cool single board computers thrown in the mix. Recently I’ve been running OpenBSD Octeon on the Ubiquiti Edge Router Lite, an amazing little piece of kit at an amazing price point.\n\n\n\nUpgrade Time!\n\n\n\nThis setup has served me for some time and I’ve been extremely happy with it. But, in the #firstworldproblems category, I recently upgraded the household to the amazing Gigabit fibre offering from Sonic. A great problem to have, but also too much of a problem for the little Edge Router Lite (ERL).\nThe way the OpenBSD PF firewall works, it’s only able to process packets on a single core. Not a problem for the dual-core 500 MHz ERL when you’re pushing under ~200 Mbps, but more of a problem when you’re trying to push 1000 Mbps.\nI needed something that was faster on a per core basis but still satisfied my usual firewall requirements. Loosely:\n\n\n\nsmall form factor\nfan-less\nmultiple Intel Ethernet ports (good driver support)\nlow power consumption\nnot your regular off-the-shelf kit\nrelatively inexpensive\n\n\n\nAfter evaluating a LOT of different options I settled on the Protectli Vault FW2B. With the specs required for the firewall (2 GB RAM and 8 GB drive) it comes in at a mere $239 USD! Installation of OpenBSD 6.4 was pretty straight forward, with the only problem I had was Etcher did not want to recognize the ‘.fs’ extension on the install image as bootable image. I quickly fixed this with good old Unix dd(1) on the Mac. Everything else was incredibly smooth.\nAfter loading the same rulesets on my new install, the results were fantastic!\n\n\n\nMonitoring\n\n\n\nNow that the machine was up and running (and fast!), I wanted to know what it was doing. Over the years, I’ve always relied on the venerable pfstat software to give me an overview of my traffic, blocked packets, etc. It looks like this:\nAs you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.\nI came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.\nA bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!\nAs you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.\nI came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.\nA bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!\n\n\n###The Source History of Cat\n\n\nI once had a debate with members of my extended family about whether a computer science degree is a degree worth pursuing. I was in college at the time and trying to decide whether I should major in computer science. My aunt and a cousin of mine believed that I shouldn’t. They conceded that knowing how to program is of course a useful and lucrative thing, but they argued that the field of computer science advances so quickly that everything I learned would almost immediately be outdated. Better to pick up programming on the side and instead major in a field like economics or physics where the basic principles would be applicable throughout my lifetime.\nI knew that my aunt and cousin were wrong and decided to major in computer science. (Sorry, aunt and cousin!) It is easy to see why the average person might believe that a field like computer science, or a profession like software engineering, completely reinvents itself every few years. We had personal computers, then the web, then phones, then machine learning… technology is always changing, so surely all the underlying principles and techniques change too. Of course, the amazing thing is how little actually changes. Most people, I’m sure, would be stunned to know just how old some of the important software on their computer really is. I’m not talking about flashy application software, admittedly—my copy of Firefox, the program I probably use the most on my computer, is not even two weeks old. But, if you pull up the manual page for something like grep, you will see that it has not been updated since 2010 (at least on MacOS). And the original version of grep was written in 1974, which in the computing world was back when dinosaurs roamed Silicon Valley. People (and programs) still depend on grep every day.\nMy aunt and cousin thought of computer technology as a series of increasingly elaborate sand castles supplanting one another after each high tide clears the beach. The reality, at least in many areas, is that we steadily accumulate programs that have solved problems. We might have to occasionally modify these programs to avoid software rot, but otherwise they can be left alone.  grep is a simple program that solves a still-relevant problem, so it survives. Most application programming is done at a very high level, atop a pyramid of much older code solving much older problems. The ideas and concepts of 30 or 40 years ago, far from being obsolete today, have in many cases been embodied in software that you can still find installed on your laptop.\nI thought it would be interesting to take a look at one such old program and see how much it had changed since it was first written. cat is maybe the simplest of all the Unix utilities, so I’m going to use it as my example. Ken Thompson wrote the original implementation of cat in 1969. If I were to tell somebody that I have a program on my computer from 1969, would that be accurate? How much has cat really evolved over the decades? How old is the software on our computers?\nThanks to repositories like this one, we can see exactly how cat has evolved since 1969. I’m going to focus on implementations of cat that are ancestors of the implementation I have on my Macbook. You will see, as we trace cat from the first versions of Unix down to the cat in MacOS today, that the program has been rewritten more times than you might expect—but it ultimately works more or less the same way it did fifty years ago.\n\n\n\nResearch Unix\n\n\n\nKen Thompson and Dennis Ritchie began writing Unix on a PDP 7. This was in 1969, before C, so all of the early Unix software was written in PDP 7 assembly. The exact flavor of assembly they used was unique to Unix, since Ken Thompson wrote his own assembler that added some features on top of the assembler provided by DEC, the PDP 7’s manufacturer. Thompson’s changes are all documented in the original Unix Programmer’s Manual under the entry for as, the assembler.\nThe first implementation of cat is thus in PDP 7 assembly. I’ve added comments that try to explain what each instruction is doing, but the program is still difficult to follow unless you understand some of the extensions Thompson made while writing his assembler. There are two important ones. First, the ; character can be used to separate multiple statements on the same line. It appears that this was used most often to put system call arguments on the same line as the sys instruction. Second, Thompson added support for “temporary labels” using the digits 0 through 9. These are labels that can be reused throughout a program, thus being, according to the Unix Programmer’s Manual, “less taxing both on the imagination of the programmer and on the symbol space of the assembler.” From any given instruction, you can refer to the next or most recent temporary label n using nf and nb respectively. For example, if you have some code in a block labeled 1:, you can jump back to that block from further down by using the instruction jmp 1b. (But you cannot jump forward to that block from above without using jmp 1f instead.)\nThe most interesting thing about this first version of cat is that it contains two names we should recognize. There is a block of instructions labeled getc and a block of instructions labeled putc, demonstrating that these names are older than the C standard library. The first version of cat actually contained implementations of both functions. The implementations buffered input so that reads and writes were not done a character at a time.\nThe first version of cat did not last long. Ken Thompson and Dennis Ritchie were able to persuade Bell Labs to buy them a PDP 11 so that they could continue to expand and improve Unix. The PDP 11 had a different instruction set, so cat had to be rewritten. I’ve marked up this second version of cat with comments as well. It uses new assembler mnemonics for the new instruction set and takes advantage of the PDP 11’s various addressing modes. (If you are confused by the parentheses and dollar signs in the source code, those are used to indicate different addressing modes.) But it also leverages the  ; character and temporary labels just like the first version of cat, meaning that these features must have been retained when as was adapted for the PDP 11.\nThe second version of cat is significantly simpler than the first. It is also more “Unix-y” in that it doesn’t just expect a list of filename arguments—it will, when given no arguments, read from stdin, which is what cat still does today. You can also give this version of cat an argument of - to indicate that it should read from stdin.\nIn 1973, in preparation for the release of the Fourth Edition of Unix, much of Unix was rewritten in C. But cat does not seem to have been rewritten in C until a while after that. The first C implementation of cat only shows up in the Seventh Edition of Unix. This implementation is really fun to look through because it is so simple. Of all the implementations to follow, this one most resembles the idealized cat used as a pedagogic demonstration in K&amp;R C. The heart of the program is the classic two-liner:\n\n\nwhile ((c = getc(fi)) != EOF)\nputchar(c);\n\n\nThere is of course quite a bit more code than that, but the extra code is mostly there to ensure that you aren’t reading and writing to the same file. The other interesting thing to note is that this implementation of cat only recognized one flag, -u. The -u flag could be used to avoid buffering input and output, which cat would otherwise do in blocks of 512 bytes.\n\n\n\nBSD\n\n\n\nAfter the Seventh Edition, Unix spawned all sorts of derivatives and offshoots. MacOS is built on top of Darwin, which in turn is derived from the Berkeley Software Distribution (BSD), so BSD is the Unix offshoot we are most interested in. BSD was originally just a collection of useful programs and add-ons for Unix, but it eventually became a complete operating system. BSD seems to have relied on the original cat implementation up until the fourth BSD release, known as 4BSD, when support was added for a whole slew of new flags. The 4BSD implementation of cat is clearly derived from the original implementation, though it adds a new function to implement the behavior triggered by the new flags. The naming conventions already used in the file were adhered to—the fflg variable, used to mark whether input was being read from stdin or a file, was joined by nflg, bflg, vflg, sflg, eflg, and  tflg, all there to record whether or not each new flag was supplied in the invocation of the program. These were the last command-line flags added to  cat; the man page for cat today lists these flags and no others, at least on Mac OS. 4BSD was released in 1980, so this set of flags is 38 years old.\ncat would be entirely rewritten a final time for BSD Net/2, which was, among other things, an attempt to avoid licensing issues by replacing all AT&amp;T Unix-derived code with new code. BSD Net/2 was released in 1991. This final rewrite of cat was done by Kevin Fall, who graduated from Berkeley in 1988 and spent the next year working as a staff member at the Computer Systems Research Group (CSRG). Fall told me that a list of Unix utilities still implemented using AT&amp;T code was put up on a wall at CSRG and staff were told to pick the utilities they wanted to reimplement. Fall picked cat and  mknod. The cat implementation bundled with MacOS today is built from a source file that still bears his name at the very top. His version of cat, even though it is a relatively trivial program, is today used by millions.\nFall’s original implementation of cat is much longer than anything we have seen so far. Other than support for a -? help flag, it adds nothing in the way of new functionality. Conceptually, it is very similar to the 4BSD implementation. It is only longer because Fall separates the implementation into a “raw” mode and a “cooked” mode. The “raw” mode is cat classic; it prints a file character for character. The “cooked” mode is cat with all the 4BSD command-line options. The distinction makes sense but it also pads out the implementation so that it seems more complex at first glance than it actually is. There is also a fancy error handling function at the end of the file that further adds to its length.\n\n\n\nMacOS\n\n\n\nThe very first release of Mac OS X thus includes an implementation of cat pulled from the NetBSD project. So the first Mac OS X implementation of cat is Kevin Fall’s cat. The only thing that had changed over the intervening decade was that Fall’s error-handling function err() was removed and the err() function made available by err.h was used in its place. err.h is a BSD extension to the C standard library.\nThe NetBSD implementation of cat was later swapped out for FreeBSD’s implementation of cat. According to Wikipedia, Apple began using FreeBSD instead of NetBSD in Mac OS X 10.3 (Panther). But the Mac OS X implementation of cat, according to Apple’s own open source releases, was not replaced until Mac OS X 10.5 (Leopard) was released in 2007. The FreeBSD implementation that Apple swapped in for the Leopard release is the same implementation on Apple computers today. As of 2018, the implementation has not been updated or changed at all since 2007.\nSo the Mac OS cat is old. As it happens, it is actually two years older than its 2007 appearance in MacOS X would suggest. This 2005 change, which is visible in FreeBSD’s Github mirror, was the last change made to FreeBSD’s cat before Apple pulled it into Mac OS X. So the Mac OS X cat implementation, which has not been kept in sync with FreeBSD’s cat implementation, is officially 13 years old. There’s a larger debate to be had about how much software can change before it really counts as the same software; in this case, the source file has not changed at all since 2005.\nThe cat implementation used by Mac OS today is not that different from the implementation that Fall wrote for the 1991 BSD Net/2 release. The biggest difference is that a whole new function was added to provide Unix domain socket support. At some point, a FreeBSD developer also seems to have decided that Fall’s raw_args() function and cook_args() should be combined into a single function called scanfiles(). Otherwise, the heart of the program is still Fall’s code.\nI asked Fall how he felt about having written the cat implementation now used by millions of Apple users, either directly or indirectly through some program that relies on cat being present. Fall, who is now a consultant and a co-author of the most recent editions of TCP/IP Illustrated, says that he is surprised when people get such a thrill out of learning about his work on cat. Fall has had a long career in computing and has worked on many high-profile projects, but it seems that many people still get most excited about the six months of work he put into rewriting cat in 1989.\n\n\n\nThe Hundred-Year-Old Program\n\n\n\nIn the grand scheme of things, computers are not an old invention. We’re used to hundred-year-old photographs or even hundred-year-old camera footage. But computer programs are in a different category—they’re high-tech and new. At least, they are now. As the computing industry matures, will we someday find ourselves using programs that approach the hundred-year-old mark?\nComputer hardware will presumably change enough that we won’t be able to take an executable compiled today and run it on hardware a century from now. Perhaps advances in programming language design will also mean that nobody will understand C in the future and cat will have long since been rewritten in another language. (Though C has already been around for fifty years, and it doesn’t look like it is about to be replaced any time soon.) But barring all that, why not just keep using the cat we have forever?\nI think the history of cat shows that some ideas in computer science are in fact very durable. Indeed, with cat, both the idea and the program itself are old. It may not be accurate to say that the cat on my computer is from 1969. But I could make a case for saying that the cat on my computer is from 1989, when Fall wrote his implementation of cat. Lots of other software is just as ancient. So maybe we shouldn’t think of computer science and software development primarily as fields that disrupt the status quo and invent new things. Our computer systems are built out of historical artifacts. At some point, we may all spend more time trying to understand and maintain those historical artifacts than we spend writing new code.\n\n\n\n\n##News Roundup\n###Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems\n\n\nA vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using X.Org server, the open source implementation of the X Window System that offers the graphical environment.\nThe flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.\n\n\n\nPrivilege escalation and arbitrary file overwrite\n\n\n\nAn advisory on Thursday describes the problem as an “incorrect command-line parameter validation” that also allows an attacker to overwrite arbitrary files.\nPrivilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the X.org server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.\n\n\n\nBug could have been avoided in OpenBSD 6.4\n\n\n\nOpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.\nTheo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem since at least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.\n“As yet we don’t have answers about why our X maintainer (on the X security team) and his team provided information to other projects (some who don’t even ship with this new X server) but chose to not give us a heads-up which could have saved all the new 6.4 users a lot of grief,” Raadt says.\nHad OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.\nTo remedy the problem, the OpenBSD project provides a source code patch, which requires compiling and rebuilding the X server.\nAs a temporary solution, users can disable the Xorg binary by running the following command:\n\n\nchmod u-s /usr/X11R6/bin/Xorg\n\n\nTrivial exploitation\n\n\n\nCVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.\nLeveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.\nThree hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.\nApart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu, Fedora and its downstream distro  Red Hat Enterprise Linux along with its community-supported counterpart CentOS.\n\n\n\n\n###OpenBSD on the Desktop: some thoughts\n\n\nI’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.\nThe OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative.\nYou need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI.\nThat’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS.\nTheir development process is purely based on developers that love to contribute and hack around, just because it’s fun.\nEven the mailing list is a cool place to hang on!\nCode correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.\nI like the idea of a platform that continually evolves.\npledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.\nI like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.\nJust install a browser and you’re ready to go.\nManual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares.\nThey help you understand inner workings of the operating system, no internet connection needed.\nThere are some trade-offs, too.\nPerformance is not first-class, mostly because of all the security mitigations and checks done at runtime3.\nI write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference.\nBrowsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems.\nBut again, trade-offs.\nTo use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.\n\n\n\n\n###Review: NomadBSD 1.1\n\n\nOne of the most recent additions to the DistroWatch database is NomadBSD. According to the NomadBSD website: “NomadBSD is a 64-bit live system for USB flash drives, based on FreeBSD. Together with automatic hardware detection and setup, it is configured to be used as a desktop system that works out of the box, but can also be used for data recovery.”\nThe latest release of NomadBSD (or simply “Nomad”, as I will refer to the project in this review) is version 1.1. It is based on FreeBSD 11.2 and is offered in two builds, one for generic personal computers and one for Macbooks. The release announcement mentions version 1.1 offers improved video driver support for Intel and AMD cards. The operating system ships with Octopkg for graphical package management and the system should automatically detect, and work with, VirtualBox environments.\nNomad 1.1 is available as a 2GB download, which we then decompress to produce a 4GB file which can be written to a USB thumb drive. There is no optical media build of Nomad as it is designed to be run entirely from the USB drive, and write data persistently to the drive, rather than simply being installed from the USB media.\n\n\n\nInitial setup\n\n\n\nBooting from the USB drive brings up a series of text-based menus which ask us to configure key parts of the operating system. We are asked to select our time zone, keyboard layout, keyboard model, keyboard mapping and our preferred language. While we can select options from a list, the options tend to be short and cryptic. Rather than “English (US)”, for example, we might be given “en_US”. We are also asked to create a password for the root user account and another one for a regular user which is called “nomad”. We can then select which shell nomad will use. The default is zsh, but there are plenty of other options, including csh and bash. We have the option of encrypting our user’s home directory.\nI feel it is important to point out that these settings, and nomad’s home directory, are stored on the USB drive. The options and settings we select will not be saved to our local hard drive and our configuration choices will not affect other operating systems already installed on our computer. At the end, the configuration wizard asks if we want to run the BSDstats service. This option is not explained at all, but it contacts BSDstats to provide some basic statistics on BSD users.\nThe system then takes a few minutes to apply its changes to the USB drive and automatically reboots the computer. While running the initial setup wizard, I had nearly identical experiences when running Nomad on a physical computer and running the operating system in a VirtualBox virtual machine. However, after the initial setup process was over, I had quite different experiences depending on the environment so I want to divide my experiences into two different sections.\n\n\n\nPhysical desktop computer\n\n\n\nAt first, Nomad failed to boot on my desktop computer. From the operating system’s boot loader, I enabled Safe Mode which allowed Nomad to boot. At that point, Nomad was able to start up, but would only display a text console. The desktop environment failed to start when running in Safe Mode.\nNetworking was also disabled by default and I had to enable a network interface and DHCP address assignment to connect to the Internet. Instructions for enabling networking can be found in FreeBSD’s Handbook. Once we are on-line we can use the pkg command line package manager to install and update software. Had the desktop environment worked then the Octopkg graphical package manager would also be available to make browsing and installing software a point-n-click experience.\nHad I been able to run the desktop for prolonged amounts of time I could have made use of such pre-installed items as the Firefox web browser, the VLC media player, LibreOffice and Thunderbird. Nomad offers a fairly small collection of desktop applications, but what is there is mostly popular, capable software.\nWhen running the operating system I noted that, with one user logged in, Nomad only runs 15 processes with the default configuration. These processes require less than 100MB of RAM, and the whole system fits comfortably on a 4GB USB drive.\n\n\n\nConclusions\n\n\n\nUltimately using Nomad was not a practical option for me. The operating system did not work well with my hardware, or the virtual environment. In the virtual machine, Nomad crashed consistently after just a few minutes of uptime. On the desktop computer, I could not get a desktop environment to run. The command line tools worked well, and the system performed tasks very quickly, but a command line only environment is not well suited to my workflow.\nI like the idea of what NomadBSD is offering. There are not many live desktop flavours of FreeBSD, apart from GhostBSD. It was nice to see developers trying to make a FreeBSD-based, plug-and-go operating system that would offer a desktop and persistent storage. I suspect the system would work and perform its stated functions on different hardware, but in my case my experiment was necessarily short lived.\n\n\n\n\n##Beastie Bits\n\n\nFreeBSD lockless algorithm - seq\nHappy Bob’s Libtls tutorial\nLocking OpenBSD when it’s sleeping\niio - The OpenBSD Way\nInstalling Hugo and Hosting Website on OpenBSD Server\nFosdem 2019 reminder: BSD devroom CfP\nOpenBGPD, gotta go fast! - Claudio Jeker\nProject Trident RC3 available\nFreeBSD 10.4 EOL\nPlay “Crazy Train” through your APU2 speaker\n\n\n\n\n##Feedback/Questions\n\n\nTobias - Satisfying my storage hunger and wallet pains\nLasse - Question regarding FreeBSD backups\n\nhttps://twitter.com/dlangille\nhttps://dan.langille.org/\n\n\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://distrowatch.com/weekly.php?issue=20181119#netbsd\">Some thoughts on NetBSD 8.0</a></p>\n\n<blockquote>\n<p>NetBSD is a highly portable operating system which can be run on dozens of different hardware architectures. The operating system’s clean and minimal design allow it to be run in all sorts of environments, ranging from embedded devices, to servers, to workstations. While the base operating system is minimal, NetBSD users have access to a large repository of binary packages and a ports tree which I will touch upon later.<br>\nI last tried NetBSD 7.0 about three years ago and decided it was time to test drive the operating system again. In the past three years NetBSD has introduced a few new features, many of them security enhancements. For example, NetBSD now supports write exclusive-or execute (W^X) protection and address space layout randomization (ASLR) to protect programs against common attacks. NetBSD 8.0 also includes USB3 support and the ability to work with ZFS storage volumes.</p>\n</blockquote>\n\n<ul>\n<li>Early impressions</li>\n</ul>\n\n<blockquote>\n<p>Since I had set up NetBSD with a Full install and enabled xdm during the setup process, the operating system booted to a graphical login screen. From here we can sign into our account. The login screen does not provide options to shut down or restart the computer. Logging into our account brings up the twm window manager and provides a virtual terminal, courtesy of xterm. There is a panel that provides a method for logging out of the window manager. The twm environment is sparse, fast and devoid of distractions.</p>\n</blockquote>\n\n<ul>\n<li>Software management</li>\n</ul>\n\n<blockquote>\n<p>NetBSD ships with a fairly standard collection of command line tools and manual pages, but otherwise it is a fairly minimal platform. If we want to run network services, have access to a web browser, or use a word processor we are going to need to install more software. There are two main approaches to installing new packages. The first, and easier approach, is to use the pkgin package manager. The pkgin utility works much the same way APT or DNF work in the Linux world, or as pkg works on FreeBSD. We can search for software by name, install or remove items. I found pkgin worked well, though its output can be terse. My only complaint with pkgin is that it does not handle “close enough” package names. For example, if I tried to run “pkgin install vlc” or “pkgin install firefox” I would quickly be told these items did not exist. But a more forgiving package manager will realize items like vlc2 or firefox45 are available and offer to install those.<br>\nThe pkgin tool installs new programs in the /usr/pkg/bin directory. Depending on your configuration and shell, this location may not be in your user’s path, and it will be helpful to adjust your PATH variable accordingly.<br>\nThe other common approach to acquiring new software is to use the pkgsrc framework. I have talked about using pkgsrc before and I will skip the details. Basically, we can download a collection of recipes for building popular open source software and run a command to download and install these items from their source code. Using pkgsrc basically gives us the same software as using pkgin would, but with some added flexibility on the options we use.<br>\nOnce new software has been installed, it may need to be enabled and activated, particularly if it uses (or is) a background service. New items can be enabled in the /etc/rc.conf file and started or stopped using the service command. This works about the same as the service command on FreeBSD and most non-systemd Linux distributions.</p>\n</blockquote>\n\n<ul>\n<li>Hardware</li>\n</ul>\n\n<blockquote>\n<p>I found that, when logged into the twm environment, NetBSD used about 130MB of RAM. This included kernel memory and all active memory. A fresh, Full install used up 1.5GB of disk space. I generally found NetBSD ran well in both VirtualBox and on my desktop computer. The system was quick and stable. I did have trouble getting a higher screen resolution in both environments. NetBSD does not offer VirtualBox add-on modules. There are NetBSD patches for VirtualBox out there, but there is some manual work involved in getting them working. When running on my desktop computer I think the resolution issue was one of finding and dealing with the correct video driver. Screen resolution aside, NetBSD performed well and detected all my hardware.</p>\n</blockquote>\n\n<ul>\n<li>Personal projects</li>\n</ul>\n\n<blockquote>\n<p>Since NetBSD provides users with a small, core operating system without many utilities if we want to use NetBSD for something we need to have a project in mind. I had four mini projects in mind I wanted to try this week: install a desktop environment, enable file sharing for computers on the local network, test multimedia (video, audio and YouTube capabilities), and set up a ZFS volume for storage.<br>\nI began with the desktop. Specifically, I followed the same tutorial I used three years ago to try to set up the Xfce desktop. While Xfce and its supporting services installed, I was unable to get a working desktop out of the experience. I could get the Xfce window manager working, but not the entire session. This tutorial worked beautifully with NetBSD 7.0, but not with version 8.0. Undeterred, I switched gears and installed Fluxbox instead. This gave me a slightly more powerful graphical environment than what I had before with twm while maintaining performance. Fluxbox ran without any problems, though its application menu was automatically populated with many programs which were not actually installed.<br>\nNext, I tried installing a few multimedia applications to play audio and video files. Here I ran into a couple of interesting problems. I found the music players I installed would play audio files, but the audio was quite slow. It always sounded like a cassette tape dragging. When I tried to play a video, the entire graphical session would crash, taking me back to the login screen. When I installed Firefox, I found I could play YouTube videos, and the video played smoothly, but again the audio was unusually slow.<br>\nI set up two methods of sharing files on the local network: OpenSSH and FTP. NetBSD basically gives us OpenSSH for free at install time and I added an FTP server through the pkgin package manager which worked beautifully with its default configuration.<br>\nI experimented with ZFS support a little, just enough to confirm I could create and access ZFS volumes. ZFS seems to work on NetBSD just as well, and with the same basic features, as it does on FreeBSD and mainstream Linux distributions. I think this is a good feature for the portable operating system to have since it means we can stick NetBSD on nearly any networked computer and use it as a NAS.</p>\n</blockquote>\n\n<ul>\n<li>Conclusions</li>\n</ul>\n\n<blockquote>\n<p>NetBSD, like its close cousins (FreeBSD and OpenBSD) does not do a lot of hand holding or automation. It offers a foundation that will run on most CPUs and we can choose to build on that foundation. I mention this because, on its own, NetBSD does not do much. If we want to get something out of it, we need to be willing to build on its foundation - we need a project. This is important to keep in mind as I think going into NetBSD and thinking, “Oh I’ll just explore around and expand on this as I go,” will likely lead to disappointment. I recommend figuring out what you want to do before installing NetBSD and making sure the required tools are available in the operating system’s repositories.<br>\nSome of the projects I embarked on this week (using ZFS and setting up file sharing) worked well. Others, like getting multimedia support and a full-featured desktop, did not. Given more time, I’m sure I could find a suitable desktop to install (along with the required documentation to get it and its services running), or customize one based on one of the available window managers. However, any full featured desktop is going to require some manual work. Media support was not great. The right players and codecs were there, but I was not able to get audio to play smoothly.<br>\nMy main complaint with NetBSD relates to my struggle to get some features working to my satisfaction: the documentation is scattered. There are four different sections of the project’s website for documentation (FAQs, The Guide, manual pages and the wiki). Whatever we are looking for is likely to be in one of those, but which one? Or, just as likely, the tutorial we want is not there, but is on a forum or blog somewhere. I found that the documentation provided was often thin, more of a quick reference to remind people how something works rather than a full explanation.<br>\nAs an example, I found a couple of documents relating to setting up a firewall. One dealt with networking NetBSD on a LAN, another explored IPv6 support, but neither gave an overview on syntax or a basic guide to blocking all but one or two ports. It seemed like that information should already be known, or picked up elsewhere.<br>\nNewcomers are likely to be a bit confused by software management guides for the same reason. Some pages refer to using a tool called pkg_add, others use pkgsrc and its make utility, others mention pkgin. Ultimately, these tools each give approximately the same result, but work differently and yet are mentioned almost interchangeably. I have used NetBSD before a few times and could stumble through these guides, but new users are likely to come away confused.<br>\nOne quirk of NetBSD, which may be a security feature or an inconvenience, depending on one’s point of view, is super user programs are not included in regular users’ paths. This means we need to change our path if we want to be able to run programs typically used by root. For example, shutdown and mount are not in regular users’ paths by default. This made checking some things tricky for me.<br>\nUltimately though, NetBSD is not famous for its convenience or features so much as its flexibility. The operating system will run on virtually any processor and should work almost identically across multiple platforms. That gives NetBSD users a good deal of consistency across a range of hardware and the chance to experiment with a member of the Unix family on hardware that might not be compatible with Linux or the other BSDs.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://tech.mangot.com/blog/2018/11/08/showing-a-gigabit-openbsd-firewall-some-monitoring-love/\">Showing a Gigabit OpenBSD Firewall Some Monitoring Love</a></p>\n\n<blockquote>\n<p>I have a pretty long history of running my home servers or firewalls on “exotic” hardware. At first, it was Sun Microsystem hardware, then it moved to the excellent Soekris line, with some cool single board computers thrown in the mix. Recently I’ve been running OpenBSD Octeon on the Ubiquiti Edge Router Lite, an amazing little piece of kit at an amazing price point.</p>\n</blockquote>\n\n<ul>\n<li>Upgrade Time!</li>\n</ul>\n\n<blockquote>\n<p>This setup has served me for some time and I’ve been extremely happy with it. But, in the #firstworldproblems category, I recently upgraded the household to the amazing Gigabit fibre offering from Sonic. A great problem to have, but also too much of a problem for the little Edge Router Lite (ERL).<br>\nThe way the OpenBSD PF firewall works, it’s only able to process packets on a single core. Not a problem for the dual-core 500 MHz ERL when you’re pushing under ~200 Mbps, but more of a problem when you’re trying to push 1000 Mbps.<br>\nI needed something that was faster on a per core basis but still satisfied my usual firewall requirements. Loosely:</p>\n</blockquote>\n\n<ul>\n<li>small form factor</li>\n<li>fan-less</li>\n<li>multiple Intel Ethernet ports (good driver support)</li>\n<li>low power consumption</li>\n<li>not your regular off-the-shelf kit</li>\n<li>relatively inexpensive</li>\n</ul>\n\n<blockquote>\n<p>After evaluating a LOT of different options I settled on the Protectli Vault FW2B. With the specs required for the firewall (2 GB RAM and 8 GB drive) it comes in at a mere $239 USD! Installation of OpenBSD 6.4 was pretty straight forward, with the only problem I had was Etcher did not want to recognize the ‘.fs’ extension on the install image as bootable image. I quickly fixed this with good old Unix dd(1) on the Mac. Everything else was incredibly smooth.<br>\nAfter loading the same rulesets on my new install, the results were fantastic!</p>\n</blockquote>\n\n<ul>\n<li>Monitoring</li>\n</ul>\n\n<blockquote>\n<p>Now that the machine was up and running (and fast!), I wanted to know what it was doing. Over the years, I’ve always relied on the venerable pfstat software to give me an overview of my traffic, blocked packets, etc. It looks like this:<br>\nAs you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>\nI came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>\nA bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!<br>\nAs you can see it’s based on RRDtool, which was simply incredible in its time. Having worked on monitoring almost continuously for almost the past decade, I wanted to see if we could re-implement the same functionality using more modern tools as RRDtool and pfstat definitely have their limitations. This might be an opportunity to learn some new things as well.<br>\nI came across pf-graphite which seemed to be a great start! He had everything I needed and I added a few more stats from the detailed interface statistics and the ability for the code to exit for running from cron(8), which is a bit more OpenBSD style. I added code for sending to some SaaS metrics platforms but ultimately stuck with straight Graphite. One important thing to note was to use the Graphite pickle port (2004) instead of the default plaintext port for submission. Also you will need to set a loginterface in your ‘pf.conf’.<br>\nA bit of tweaking with Graphite and Grafana, and I had a pretty darn good recreation of my original PF stats dashboard!</p>\n</blockquote>\n\n<p>###<a href=\"https://twobithistory.org/2018/11/12/cat.html\">The Source History of Cat</a></p>\n\n<blockquote>\n<p>I once had a debate with members of my extended family about whether a computer science degree is a degree worth pursuing. I was in college at the time and trying to decide whether I should major in computer science. My aunt and a cousin of mine believed that I shouldn’t. They conceded that knowing how to program is of course a useful and lucrative thing, but they argued that the field of computer science advances so quickly that everything I learned would almost immediately be outdated. Better to pick up programming on the side and instead major in a field like economics or physics where the basic principles would be applicable throughout my lifetime.<br>\nI knew that my aunt and cousin were wrong and decided to major in computer science. (Sorry, aunt and cousin!) It is easy to see why the average person might believe that a field like computer science, or a profession like software engineering, completely reinvents itself every few years. We had personal computers, then the web, then phones, then machine learning… technology is always changing, so surely all the underlying principles and techniques change too. Of course, the amazing thing is how little actually changes. Most people, I’m sure, would be stunned to know just how old some of the important software on their computer really is. I’m not talking about flashy application software, admittedly—my copy of Firefox, the program I probably use the most on my computer, is not even two weeks old. But, if you pull up the manual page for something like grep, you will see that it has not been updated since 2010 (at least on MacOS). And the original version of grep was written in 1974, which in the computing world was back when dinosaurs roamed Silicon Valley. People (and programs) still depend on grep every day.<br>\nMy aunt and cousin thought of computer technology as a series of increasingly elaborate sand castles supplanting one another after each high tide clears the beach. The reality, at least in many areas, is that we steadily accumulate programs that have solved problems. We might have to occasionally modify these programs to avoid software rot, but otherwise they can be left alone.  grep is a simple program that solves a still-relevant problem, so it survives. Most application programming is done at a very high level, atop a pyramid of much older code solving much older problems. The ideas and concepts of 30 or 40 years ago, far from being obsolete today, have in many cases been embodied in software that you can still find installed on your laptop.<br>\nI thought it would be interesting to take a look at one such old program and see how much it had changed since it was first written. cat is maybe the simplest of all the Unix utilities, so I’m going to use it as my example. Ken Thompson wrote the original implementation of cat in 1969. If I were to tell somebody that I have a program on my computer from 1969, would that be accurate? How much has cat really evolved over the decades? How old is the software on our computers?<br>\nThanks to repositories like this one, we can see exactly how cat has evolved since 1969. I’m going to focus on implementations of cat that are ancestors of the implementation I have on my Macbook. You will see, as we trace cat from the first versions of Unix down to the cat in MacOS today, that the program has been rewritten more times than you might expect—but it ultimately works more or less the same way it did fifty years ago.</p>\n</blockquote>\n\n<ul>\n<li>Research Unix</li>\n</ul>\n\n<blockquote>\n<p>Ken Thompson and Dennis Ritchie began writing Unix on a PDP 7. This was in 1969, before C, so all of the early Unix software was written in PDP 7 assembly. The exact flavor of assembly they used was unique to Unix, since Ken Thompson wrote his own assembler that added some features on top of the assembler provided by DEC, the PDP 7’s manufacturer. Thompson’s changes are all documented in the original Unix Programmer’s Manual under the entry for as, the assembler.<br>\nThe first implementation of cat is thus in PDP 7 assembly. I’ve added comments that try to explain what each instruction is doing, but the program is still difficult to follow unless you understand some of the extensions Thompson made while writing his assembler. There are two important ones. First, the ; character can be used to separate multiple statements on the same line. It appears that this was used most often to put system call arguments on the same line as the sys instruction. Second, Thompson added support for “temporary labels” using the digits 0 through 9. These are labels that can be reused throughout a program, thus being, according to the Unix Programmer’s Manual, “less taxing both on the imagination of the programmer and on the symbol space of the assembler.” From any given instruction, you can refer to the next or most recent temporary label n using nf and nb respectively. For example, if you have some code in a block labeled 1:, you can jump back to that block from further down by using the instruction jmp 1b. (But you cannot jump forward to that block from above without using jmp 1f instead.)<br>\nThe most interesting thing about this first version of cat is that it contains two names we should recognize. There is a block of instructions labeled getc and a block of instructions labeled putc, demonstrating that these names are older than the C standard library. The first version of cat actually contained implementations of both functions. The implementations buffered input so that reads and writes were not done a character at a time.<br>\nThe first version of cat did not last long. Ken Thompson and Dennis Ritchie were able to persuade Bell Labs to buy them a PDP 11 so that they could continue to expand and improve Unix. The PDP 11 had a different instruction set, so cat had to be rewritten. I’ve marked up this second version of cat with comments as well. It uses new assembler mnemonics for the new instruction set and takes advantage of the PDP 11’s various addressing modes. (If you are confused by the parentheses and dollar signs in the source code, those are used to indicate different addressing modes.) But it also leverages the  ; character and temporary labels just like the first version of cat, meaning that these features must have been retained when as was adapted for the PDP 11.<br>\nThe second version of cat is significantly simpler than the first. It is also more “Unix-y” in that it doesn’t just expect a list of filename arguments—it will, when given no arguments, read from stdin, which is what cat still does today. You can also give this version of cat an argument of - to indicate that it should read from stdin.<br>\nIn 1973, in preparation for the release of the Fourth Edition of Unix, much of Unix was rewritten in C. But cat does not seem to have been rewritten in C until a while after that. The first C implementation of cat only shows up in the Seventh Edition of Unix. This implementation is really fun to look through because it is so simple. Of all the implementations to follow, this one most resembles the idealized cat used as a pedagogic demonstration in K&amp;R C. The heart of the program is the classic two-liner:</p>\n</blockquote>\n\n<p><code>while ((c = getc(fi)) != EOF)</code><br>\n<code>putchar(c);</code></p>\n\n<blockquote>\n<p>There is of course quite a bit more code than that, but the extra code is mostly there to ensure that you aren’t reading and writing to the same file. The other interesting thing to note is that this implementation of cat only recognized one flag, -u. The -u flag could be used to avoid buffering input and output, which cat would otherwise do in blocks of 512 bytes.</p>\n</blockquote>\n\n<ul>\n<li>BSD</li>\n</ul>\n\n<blockquote>\n<p>After the Seventh Edition, Unix spawned all sorts of derivatives and offshoots. MacOS is built on top of Darwin, which in turn is derived from the Berkeley Software Distribution (BSD), so BSD is the Unix offshoot we are most interested in. BSD was originally just a collection of useful programs and add-ons for Unix, but it eventually became a complete operating system. BSD seems to have relied on the original cat implementation up until the fourth BSD release, known as 4BSD, when support was added for a whole slew of new flags. The 4BSD implementation of cat is clearly derived from the original implementation, though it adds a new function to implement the behavior triggered by the new flags. The naming conventions already used in the file were adhered to—the fflg variable, used to mark whether input was being read from stdin or a file, was joined by nflg, bflg, vflg, sflg, eflg, and  tflg, all there to record whether or not each new flag was supplied in the invocation of the program. These were the last command-line flags added to  cat; the man page for cat today lists these flags and no others, at least on Mac OS. 4BSD was released in 1980, so this set of flags is 38 years old.<br>\ncat would be entirely rewritten a final time for BSD Net/2, which was, among other things, an attempt to avoid licensing issues by replacing all AT&amp;T Unix-derived code with new code. BSD Net/2 was released in 1991. This final rewrite of cat was done by Kevin Fall, who graduated from Berkeley in 1988 and spent the next year working as a staff member at the Computer Systems Research Group (CSRG). Fall told me that a list of Unix utilities still implemented using AT&amp;T code was put up on a wall at CSRG and staff were told to pick the utilities they wanted to reimplement. Fall picked cat and  mknod. The cat implementation bundled with MacOS today is built from a source file that still bears his name at the very top. His version of cat, even though it is a relatively trivial program, is today used by millions.<br>\nFall’s original implementation of cat is much longer than anything we have seen so far. Other than support for a -? help flag, it adds nothing in the way of new functionality. Conceptually, it is very similar to the 4BSD implementation. It is only longer because Fall separates the implementation into a “raw” mode and a “cooked” mode. The “raw” mode is cat classic; it prints a file character for character. The “cooked” mode is cat with all the 4BSD command-line options. The distinction makes sense but it also pads out the implementation so that it seems more complex at first glance than it actually is. There is also a fancy error handling function at the end of the file that further adds to its length.</p>\n</blockquote>\n\n<ul>\n<li>MacOS</li>\n</ul>\n\n<blockquote>\n<p>The very first release of Mac OS X thus includes an implementation of cat pulled from the NetBSD project. So the first Mac OS X implementation of cat is Kevin Fall’s cat. The only thing that had changed over the intervening decade was that Fall’s error-handling function err() was removed and the err() function made available by err.h was used in its place. err.h is a BSD extension to the C standard library.<br>\nThe NetBSD implementation of cat was later swapped out for FreeBSD’s implementation of cat. According to Wikipedia, Apple began using FreeBSD instead of NetBSD in Mac OS X 10.3 (Panther). But the Mac OS X implementation of cat, according to Apple’s own open source releases, was not replaced until Mac OS X 10.5 (Leopard) was released in 2007. The FreeBSD implementation that Apple swapped in for the Leopard release is the same implementation on Apple computers today. As of 2018, the implementation has not been updated or changed at all since 2007.<br>\nSo the Mac OS cat is old. As it happens, it is actually two years older than its 2007 appearance in MacOS X would suggest. This 2005 change, which is visible in FreeBSD’s Github mirror, was the last change made to FreeBSD’s cat before Apple pulled it into Mac OS X. So the Mac OS X cat implementation, which has not been kept in sync with FreeBSD’s cat implementation, is officially 13 years old. There’s a larger debate to be had about how much software can change before it really counts as the same software; in this case, the source file has not changed at all since 2005.<br>\nThe cat implementation used by Mac OS today is not that different from the implementation that Fall wrote for the 1991 BSD Net/2 release. The biggest difference is that a whole new function was added to provide Unix domain socket support. At some point, a FreeBSD developer also seems to have decided that Fall’s raw_args() function and cook_args() should be combined into a single function called scanfiles(). Otherwise, the heart of the program is still Fall’s code.<br>\nI asked Fall how he felt about having written the cat implementation now used by millions of Apple users, either directly or indirectly through some program that relies on cat being present. Fall, who is now a consultant and a co-author of the most recent editions of TCP/IP Illustrated, says that he is surprised when people get such a thrill out of learning about his work on cat. Fall has had a long career in computing and has worked on many high-profile projects, but it seems that many people still get most excited about the six months of work he put into rewriting cat in 1989.</p>\n</blockquote>\n\n<ul>\n<li>The Hundred-Year-Old Program</li>\n</ul>\n\n<blockquote>\n<p>In the grand scheme of things, computers are not an old invention. We’re used to hundred-year-old photographs or even hundred-year-old camera footage. But computer programs are in a different category—they’re high-tech and new. At least, they are now. As the computing industry matures, will we someday find ourselves using programs that approach the hundred-year-old mark?<br>\nComputer hardware will presumably change enough that we won’t be able to take an executable compiled today and run it on hardware a century from now. Perhaps advances in programming language design will also mean that nobody will understand C in the future and cat will have long since been rewritten in another language. (Though C has already been around for fifty years, and it doesn’t look like it is about to be replaced any time soon.) But barring all that, why not just keep using the cat we have forever?<br>\nI think the history of cat shows that some ideas in computer science are in fact very durable. Indeed, with cat, both the idea and the program itself are old. It may not be accurate to say that the cat on my computer is from 1969. But I could make a case for saying that the cat on my computer is from 1989, when Fall wrote his implementation of cat. Lots of other software is just as ancient. So maybe we shouldn’t think of computer science and software development primarily as fields that disrupt the status quo and invent new things. Our computer systems are built out of historical artifacts. At some point, we may all spend more time trying to understand and maintain those historical artifacts than we spend writing new code.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://www.bleepingcomputer.com/news/security/trivial-bug-in-xorg-gives-root-permission-on-linux-and-bsd-systems/\">Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems</a></p>\n\n<blockquote>\n<p>A vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using <a href=\"http://X.Org\">X.Org</a> server, the open source implementation of the X Window System that offers the graphical environment.<br>\nThe flaw is now identified as CVE-2018-14665 (credited to security researcher Narendra Shinde). It has been present in xorg-server for two years, since version 1.19.0 and is exploitable by a limited user as long as the X server runs with elevated permissions.</p>\n</blockquote>\n\n<ul>\n<li>Privilege escalation and arbitrary file overwrite</li>\n</ul>\n\n<blockquote>\n<p>An advisory on Thursday describes the problem as an “incorrect command-line parameter validation” that also allows an attacker to overwrite arbitrary files.<br>\nPrivilege escalation can be accomplished via the -modulepath argument by setting an insecure path to modules loaded by the <a href=\"http://X.org\">X.org</a> server. Arbitrary file overwrite is possible through the -logfile argument, because of improper verification when parsing the option.</p>\n</blockquote>\n\n<ul>\n<li>Bug could have been avoided in OpenBSD 6.4</li>\n</ul>\n\n<blockquote>\n<p>OpenBSD, the free and open-source operating system with a strong focus on security, uses xorg. On October 18, the project released version 6.4 of the OS, affected by CVE-2018-14665. This could have been avoided, though.<br>\nTheo de Raadt, founder and leader of the OpenBSD project, says that X maintainer knew about the problem since at least October 11. For some reason, the OpenBSD developers received the message one hour before the public announcement this Thursday, a week after their new OS release.<br>\n“As yet we don’t have answers about why our X maintainer (on the X security team) and his team provided information to other projects (some who don’t even ship with this new X server) but chose to not give us a heads-up which could have saved all the new 6.4 users a lot of grief,” Raadt says.<br>\nHad OpenBSD developers known about the bug before the release, they could have taken steps to mitigate the problem or delay the launch for a week or two.<br>\nTo remedy the problem, the OpenBSD project provides a source code patch, which requires compiling and rebuilding the X server.<br>\nAs a temporary solution, users can disable the Xorg binary by running the following command:</p>\n</blockquote>\n\n<p><code>chmod u-s /usr/X11R6/bin/Xorg</code></p>\n\n<ul>\n<li>Trivial exploitation</li>\n</ul>\n\n<blockquote>\n<p>CVE-2018-14665 does not help compromise systems, but it is useful in the following stages of an attack.<br>\nLeveraging it after gaining access to a vulnerable machine is fairly easy. Matthew Hickey, co-founder, and head of Hacker House security outfit created and published an exploit, saying that it can be triggered from a remote SSH session.<br>\nThree hours after the public announcement of the security gap, Daemon Security CEO Michael Shirk replied with one line that overwrote shadow files on the system. Hickey did one better and fit the entire local privilege escalation exploit in one line.<br>\nApart from OpenBSD, other operating systems affected by the bug include Debian and Ubuntu, Fedora and its downstream distro  Red Hat Enterprise Linux along with its community-supported counterpart CentOS.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/\">OpenBSD on the Desktop: some thoughts</a></p>\n\n<blockquote>\n<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>\nThe OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative.<br>\nYou need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI.<br>\nThat’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS.<br>\nTheir development process is purely based on developers that love to contribute and hack around, just because it’s fun.<br>\nEven the mailing list is a cool place to hang on!<br>\nCode correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>\nI like the idea of a platform that continually evolves.<br>\npledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>\nI like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>\nJust install a browser and you’re ready to go.<br>\nManual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares.<br>\nThey help you understand inner workings of the operating system, no internet connection needed.<br>\nThere are some trade-offs, too.<br>\nPerformance is not first-class, mostly because of all the security mitigations and checks done at runtime3.<br>\nI write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference.<br>\nBrowsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems.<br>\nBut again, trade-offs.<br>\nTo use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://distrowatch.com/weekly.php?issue=20180813#nomadbsd\">Review: NomadBSD 1.1</a></p>\n\n<blockquote>\n<p>One of the most recent additions to the DistroWatch database is NomadBSD. According to the NomadBSD website: “NomadBSD is a 64-bit live system for USB flash drives, based on FreeBSD. Together with automatic hardware detection and setup, it is configured to be used as a desktop system that works out of the box, but can also be used for data recovery.”<br>\nThe latest release of NomadBSD (or simply “Nomad”, as I will refer to the project in this review) is version 1.1. It is based on FreeBSD 11.2 and is offered in two builds, one for generic personal computers and one for Macbooks. The release announcement mentions version 1.1 offers improved video driver support for Intel and AMD cards. The operating system ships with Octopkg for graphical package management and the system should automatically detect, and work with, VirtualBox environments.<br>\nNomad 1.1 is available as a 2GB download, which we then decompress to produce a 4GB file which can be written to a USB thumb drive. There is no optical media build of Nomad as it is designed to be run entirely from the USB drive, and write data persistently to the drive, rather than simply being installed from the USB media.</p>\n</blockquote>\n\n<ul>\n<li>Initial setup</li>\n</ul>\n\n<blockquote>\n<p>Booting from the USB drive brings up a series of text-based menus which ask us to configure key parts of the operating system. We are asked to select our time zone, keyboard layout, keyboard model, keyboard mapping and our preferred language. While we can select options from a list, the options tend to be short and cryptic. Rather than “English (US)”, for example, we might be given “en_US”. We are also asked to create a password for the root user account and another one for a regular user which is called “nomad”. We can then select which shell nomad will use. The default is zsh, but there are plenty of other options, including csh and bash. We have the option of encrypting our user’s home directory.<br>\nI feel it is important to point out that these settings, and nomad’s home directory, are stored on the USB drive. The options and settings we select will not be saved to our local hard drive and our configuration choices will not affect other operating systems already installed on our computer. At the end, the configuration wizard asks if we want to run the BSDstats service. This option is not explained at all, but it contacts BSDstats to provide some basic statistics on BSD users.<br>\nThe system then takes a few minutes to apply its changes to the USB drive and automatically reboots the computer. While running the initial setup wizard, I had nearly identical experiences when running Nomad on a physical computer and running the operating system in a VirtualBox virtual machine. However, after the initial setup process was over, I had quite different experiences depending on the environment so I want to divide my experiences into two different sections.</p>\n</blockquote>\n\n<ul>\n<li>Physical desktop computer</li>\n</ul>\n\n<blockquote>\n<p>At first, Nomad failed to boot on my desktop computer. From the operating system’s boot loader, I enabled Safe Mode which allowed Nomad to boot. At that point, Nomad was able to start up, but would only display a text console. The desktop environment failed to start when running in Safe Mode.<br>\nNetworking was also disabled by default and I had to enable a network interface and DHCP address assignment to connect to the Internet. Instructions for enabling networking can be found in FreeBSD’s Handbook. Once we are on-line we can use the pkg command line package manager to install and update software. Had the desktop environment worked then the Octopkg graphical package manager would also be available to make browsing and installing software a point-n-click experience.<br>\nHad I been able to run the desktop for prolonged amounts of time I could have made use of such pre-installed items as the Firefox web browser, the VLC media player, LibreOffice and Thunderbird. Nomad offers a fairly small collection of desktop applications, but what is there is mostly popular, capable software.<br>\nWhen running the operating system I noted that, with one user logged in, Nomad only runs 15 processes with the default configuration. These processes require less than 100MB of RAM, and the whole system fits comfortably on a 4GB USB drive.</p>\n</blockquote>\n\n<ul>\n<li>Conclusions</li>\n</ul>\n\n<blockquote>\n<p>Ultimately using Nomad was not a practical option for me. The operating system did not work well with my hardware, or the virtual environment. In the virtual machine, Nomad crashed consistently after just a few minutes of uptime. On the desktop computer, I could not get a desktop environment to run. The command line tools worked well, and the system performed tasks very quickly, but a command line only environment is not well suited to my workflow.<br>\nI like the idea of what NomadBSD is offering. There are not many live desktop flavours of FreeBSD, apart from GhostBSD. It was nice to see developers trying to make a FreeBSD-based, plug-and-go operating system that would offer a desktop and persistent storage. I suspect the system would work and perform its stated functions on different hardware, but in my case my experiment was necessarily short lived.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://oshogbo.vexillium.org/blog/50/\">FreeBSD lockless algorithm - seq</a></li>\n<li><a href=\"https://github.com/bob-beck/libtls/blob/master/TUTORIAL.md\">Happy Bob’s Libtls tutorial</a></li>\n<li><a href=\"https://chown.me/blog/locking-openbsd-when-sleeping.html\">Locking OpenBSD when it’s sleeping</a></li>\n<li><a href=\"https://www.geoghegan.ca/serviio.html\">iio - The OpenBSD Way</a></li>\n<li><a href=\"https://bsdboy.ml/blog/installing-hugo-and-hosting-on-openbsd.html\">Installing Hugo and Hosting Website on OpenBSD Server</a></li>\n<li><a href=\"http://blog.osorio.me/post.php?idpost=1\">Fosdem 2019 reminder: BSD devroom CfP</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=4gOoPxGKKjA&amp;feature=youtu.be\">OpenBGPD, gotta go fast! - Claudio Jeker</a></li>\n<li><a href=\"http://project-trident.org/post/2018-11-10_rc3-available/\">Project Trident RC3 available</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2018-November/001849.html\">FreeBSD 10.4 EOL</a></li>\n<li><a href=\"https://bsd.network/@ephemeris/101073578346815313\">Play “Crazy Train” through your APU2 speaker</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Tobias - <a href=\"http://dpaste.com/174WGEY#wrap\">Satisfying my storage hunger and wallet pains</a></li>\n<li>Lasse - <a href=\"http://dpaste.com/1QBMH73\">Question regarding FreeBSD backups</a>\n<ul>\n<li><a href=\"https://twitter.com/dlangille\">https://twitter.com/dlangille</a></li>\n<li><a href=\"https://dan.langille.org/\">https://dan.langille.org/</a></li>\n</ul>\n\n<p></li><br>\n</ul><br>\n<hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Thoughts on NetBSD 8.0, Monitoring love for a GigaBit OpenBSD firewall, cat’s source history, X.org root permission bug, thoughts on OpenBSD as a desktop, and NomadBSD review.","date_published":"2018-11-23T02:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/19a116b3-098d-40a2-bf74-28c99f8023e1.mp3","mime_type":"audio/mp3","size_in_bytes":44912747,"duration_in_seconds":4472}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2899","title":"Episode 272: Detain the bhyve | BSD Now 272","url":"https://www.bsdnow.tv/272","content_text":"Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what 'dependency' means in Unix init systems, jailing bhyve, and more.\n##Headlines ###The byproducts of reading OpenBSD netcat code  When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process. (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff. (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future. (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it. (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part. Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself.   ###What I learned from porting my projects to FreeBSD  Introduction   I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there.    The Projects   https://github.com/shlomif/shlomif-computer-settings/ (my dotfiles).   https://web-cpan.shlomifish.org/latemp/   https://fc-solve.shlomifish.org/   https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/   https://better-scm.shlomifish.org/source/   http://perl-begin.org/source/   https://www.shlomifish.org/meta/site-source/   Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more.   Work fine on several Linux distributions and have https://en.wikipedia.org/wiki/Travis_CI using Ubuntu 14.04 hosts   Some pass builds and tests on AppVeyor/Win64   What I Learned:   FreeBSD on VBox has become very reliable   Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin   make on FreeBSD is not GNU make   m4 on FreeBSD is not compatible with GNU m4   Some CPAN Modules fail to install using local-lib there   DocBook/XSL Does Not Live Under /usr/share/sgml   FreeBSD’s grep does not have a “-P” flag by default   FreeBSD has no “nproc” command   Conclusion:   It is easier to port a shell than a shell script. — Larry Wall   I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them.    ##News Roundup ###OpenBSD’s unveil()  One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux. The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job. In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access. Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype:  int unveil(const char *path, const char *permissions);  A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path. Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply. Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile. unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source. One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms.   ###NetBSD Virtual Machine Monitor (NVVM)  NetBSD Virtual Machine Monitor   The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.   Download   The source code of NVMM, plus the associated tools, can be downloaded here.   Technical details   NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM. Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs. Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism. The host must always be x86_64, but the guest has no constraint on the mode, so it can be x86_32, PAE, real mode, and so on. The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs. When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch. The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state.   ###What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca)  I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc): I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description. Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem. This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.) In general, there are three different relationships between services that I tend to encounter:    a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place.   a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.)   an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.)    Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later? My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway.   (In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.)   ###Jailing The bhyve Hypervisor  As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve. You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD. The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD.   A Gentle History Lesson   At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict WX are all applied to bhyve, making it an extremely hardened hypervisor. So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAP_GUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed.   Initial Setup   We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail. I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail. By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail.    We will use the following in our jail, so we will need to set up devfs(8) rules for them:   A ZFS volume   A null-modem device (nmdm(4))   UEFI GOP (no devfs rule, but IP assigned to the jail)   A tap device   Conclusion    The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened:   PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement) PaX NOEXEC is fully applied (strict WX) (HardenedBSD enhancement) Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement) Full RELRO (RELRO + BIND_NOW) is fully applied (HardenedBSD enhancement) SafeStack is applied to the application (HardenedBSD enhancement) Jailed (FreeBSD feature written by HardenedBSD) Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD) Capsicum is fully applied (FreeBSD feature)   Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :)   ##Beastie Bits  GhostBSD 18.10 has been released Project Trident RC3 has been released The OpenBSD Foundation receives the first Silver contribution from a single individual Monitoring pf logs gource NetBSD on the RISC-V is alive The X hole Announcing the pkgsrc-2018Q3 release (2018-10-05) NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT UNIX (as we know it) might not have existed without Mrs. Thompson Free Pizza for your dev events Portland BSD Pizza Night: Nov 29th 7pm   ##Feedback/Questions  Dennis - Core developers leaving illumOS? Ben - Jumping from snapshot to snapshot Ias - Question about ZFS snapshots    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv  ","content_html":"<p>Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what &#39;dependency&#39; means in Unix init systems, jailing bhyve, and more.<br>\n<p>##Headlines<br> ###<a href=\"https://nanxiao.me/en/the-byproducts-of-reading-openbsd-netcat-code/\">The byproducts of reading OpenBSD netcat code</a></p> <blockquote> <p>When I took part in a training last year, I heard about netcat for the first time. During that class, the tutor showed some hacks and tricks of using netcat which appealed to me and motivated me to learn the guts of it. Fortunately, in the past 2 months, I was not so busy that I can spend my spare time to dive into OpenBSD‘s netcat source code, and got abundant byproducts during this process.<br> (1) Brush up socket programming. I wrote my first network application more than 10 years ago, and always think the socket APIs are marvelous. Just ~10 functions (socket, bind, listen, accept…) with some IO multiplexing buddies (select, poll, epoll…) connect the whole world, wonderful! From that time, I developed a habit that is when touching a new programming language, network programming is an essential exercise. Even though I don’t write socket related code now, reading netcat socket code indeed refresh my knowledge and teach me new stuff.<br> (2) Write a tutorial about netcat. I am mediocre programmer and will forget things when I don’t use it for a long time. So I just take notes of what I think is useful. IMHO, this “tutorial” doesn’t really mean teach others something, but just a journal which I can refer when I need in the future.<br> (3) Submit patches to netcat. During reading code, I also found bugs and some enhancements. Though trivial contributions to OpenBSD, I am still happy and enjoy it.<br> (4) Implement a C++ encapsulation of libtls. OpenBSD‘s netcat supports tls/ssl connection, but it needs you take full care of resource management (memory, socket, etc), otherwise a small mistake can lead to resource leak which is fatal for long-live applications (In fact, the two bugs I reported to OpenBSD are all related resource leak). Therefore I develop a simple C++ library which wraps the libtls and hope it can free developer from this troublesome problem and put more energy in application logic part.<br> Long story to short, reading classical source code is a rewarding process, and you can consider to try it yourself.</p> </blockquote> <hr> <p>###<a href=\"https://github.com/shlomif/what-i-learned-from-porting-to-freebsd#what-i-learned-from-porting-my-projects-to-freebsd\">What I learned from porting my projects to FreeBSD</a></p> <ul> <li>Introduction</li> </ul> <blockquote> <p>I set up a local FreeBSD VirtualBox VM to test something, and it seems to work very well. Due to the novelty factor, I decided to get my software projects to build and pass the tests there.</p> </blockquote> <ul> <li> <p>The Projects</p> </li> <li> <p><a href=\"https://github.com/shlomif/shlomif-computer-settings/\"><a href=\"https://github.com/shlomif/shlomif-computer-settings/\" rel=\"nofollow\">https://github.com/shlomif/shlomif-computer-settings/</a></a> (my dotfiles).</p> </li> <li> <p><a href=\"https://web-cpan.shlomifish.org/latemp/\"><a href=\"https://web-cpan.shlomifish.org/latemp/\" rel=\"nofollow\">https://web-cpan.shlomifish.org/latemp/</a></a></p> </li> <li> <p><a href=\"https://fc-solve.shlomifish.org/\"><a href=\"https://fc-solve.shlomifish.org/\" rel=\"nofollow\">https://fc-solve.shlomifish.org/</a></a></p> </li> <li> <p><a href=\"https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/\"><a href=\"https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/\" rel=\"nofollow\">https://www.shlomifish.org/open-source/projects/black-hole-solitaire-solver/</a></a></p> </li> <li> <p><a href=\"https://better-scm.shlomifish.org/source/\"><a href=\"https://better-scm.shlomifish.org/source/\" rel=\"nofollow\">https://better-scm.shlomifish.org/source/</a></a></p> </li> <li> <p><a href=\"http://perl-begin.org/source/\"><a href=\"http://perl-begin.org/source/\" rel=\"nofollow\">http://perl-begin.org/source/</a></a></p> </li> <li> <p><a href=\"https://www.shlomifish.org/meta/site-source/\"><a href=\"https://www.shlomifish.org/meta/site-source/\" rel=\"nofollow\">https://www.shlomifish.org/meta/site-source/</a></a></p> </li> <li> <p>Written using a mix of C, Perl 5, Python, Ruby, GNU Bash, XML, CMake, XSLT, XHTML5, XHTML1.1, Website META Language, JavaScript and more.</p> </li> <li> <p>Work fine on several Linux distributions and have <a href=\"https://en.wikipedia.org/wiki/Travis_CI\"><a href=\"https://en.wikipedia.org/wiki/Travis_CI\" rel=\"nofollow\">https://en.wikipedia.org/wiki/Travis_CI</a></a> using Ubuntu 14.04 hosts</p> </li> <li> <p>Some pass builds and tests on AppVeyor/Win64</p> </li> <li> <p>What I Learned:</p> </li> <li> <p>FreeBSD on VBox has become very reliable</p> </li> <li> <p>Some executables on FreeBSD are in /usr/local/bin instead of /usr/bin</p> </li> <li> <p>make on FreeBSD is not GNU make</p> </li> <li> <p>m4 on FreeBSD is not compatible with GNU m4</p> </li> <li> <p>Some CPAN Modules fail to install using local-lib there</p> </li> <li> <p>DocBook/XSL Does Not Live Under /usr/share/sgml</p> </li> <li> <p>FreeBSD’s grep does not have a “-P” flag by default</p> </li> <li> <p>FreeBSD has no “nproc” command</p> </li> <li> <p>Conclusion:</p> </li> <li> <p>It is easier to port a shell than a shell script. — Larry Wall</p> </li> <li> <p>I ran into some cases where my scriptology was lacking and suboptimal, even for my own personal use, and fixed them.</p> </li> </ul> <hr> <p>##News Roundup<br> ###<a href=\"https://lwn.net/Articles/767137/\">OpenBSD’s unveil()</a></p> <blockquote> <p>One of the key aspects of hardening the user-space side of an operating system is to provide mechanisms for restricting which parts of the filesystem hierarchy a given process can access. Linux has a number of mechanisms of varying capability and complexity for this purpose, but other kernels have taken a different approach. Over the last few months, OpenBSD has inaugurated a new system call named unveil() for this type of hardening that differs significantly from the mechanisms found in Linux.<br> The value of restricting access to the filesystem, from a security point of view, is fairly obvious. A compromised process cannot exfiltrate data that it cannot read, and it cannot corrupt files that it cannot write. Preventing unwanted access is, of course, the purpose of the permissions bits attached to every file, but permissions fall short in an important way: just because a particular user has access to a given file does not necessarily imply that every program run by that user should also have access to that file. There is no reason why your PDF viewer should be able to read your SSH keys, for example. Relying on just the permission bits makes it easy for a compromised process to access files that have nothing to do with that process’s actual job.<br> In a Linux system, there are many ways of trying to restrict that access; that is one of the purposes behind the Linux security module (LSM) architecture, for example. The SELinux LSM uses a complex matrix of labels and roles to make access-control decisions. The AppArmor LSM, instead, uses a relatively simple table of permissible pathnames associated with each application; that approach was highly controversial when AppArmor was first merged, and is still looked down upon by some security developers. Mount namespaces can be used to create a special view of the filesystem hierarchy for a set of processes, rendering much of that hierarchy invisible and, thus, inaccessible. The seccomp mechanism can be used to make decisions on attempts by a process to access files, but that approach is complex and error-prone. Yet another approach can be seen in the Qubes OS distribution, which runs applications in virtual machines to strictly control what they can access.<br> Compared to many of the options found in Linux, unveil() is an exercise in simplicity. This system call, introduced in July, has this prototype:</p> </blockquote> <p><code>int unveil(const char *path, const char *permissions);</code></p> <blockquote> <p>A process that has never called unveil() has full access to the filesystem hierarchy, modulo the usual file permissions and any restrictions that may have been applied by calling pledge(). Calling unveil() for the first time will “drop a veil” across the entire filesystem, rendering the whole thing invisible to the process, with one exception: the file or directory hierarchy starting at path will be accessible with the given permissions. The permissions string can contain any of “r” for read access, “w” for write, “x” for execute, and “c” for the ability to create or remove the path.<br> Subsequent calls to unveil() will make other parts of the filesystem hierarchy accessible; the unveil() system call itself still has access to the entire hierarchy, so there is no problem with unveiling distinct subtrees that are, until the call is made, invisible to the process. If one unveil() call applies to a subtree of a hierarchy unveiled by another call, the permissions associated with the more specific call apply.<br> Calling unveil() with both arguments as null will block any further calls, setting the current view of the filesystem in stone. Calls to unveil() can also be blocked using pledge(). Either way, once the view of the filesystem has been set up appropriately, it is possible to lock it so that the process cannot expand its access in the future should it be taken over and turn hostile.<br> unveil() thus looks a bit like AppArmor, in that it is a path-based mechanism for restricting access to files. In either case, one must first study the program in question to gain a solid understanding of which files it needs to access before closing things down, or the program is likely to break. One significant difference (beyond the other sorts of behavior that AppArmor can control) is that AppArmor’s permissions are stored in an external policy file, while unveil() calls are made by the application itself. That approach keeps the access rules tightly tied to the application and easy for the developers to modify, but it also makes it harder for system administrators to change them without having to rebuild the application from source.<br> One can certainly aim a number of criticisms at unveil() — all of the complaints that have been leveled at path-based access control and more. But the simplicity of unveil() brings a certain kind of utility, as can be seen in the large number of OpenBSD applications that are being modified to use it. OpenBSD is gaining a base level of protection against unintended program behavior; while it is arguably possible to protect a Linux system to a much greater extent, the complexity of the mechanisms involved keeps that from happening in a lot of real-world deployments. There is a certain kind of virtue to simplicity in security mechanisms.</p> </blockquote> <hr> <p>###<a href=\"http://m00nbsd.net/4e0798b7f2620c965d0dd9d6a7a2f296.html\">NetBSD Virtual Machine Monitor (NVVM)</a></p> <ul> <li>NetBSD Virtual Machine Monitor</li> </ul> <blockquote> <p>The NVMM driver provides hardware-accelerated virtualization support on NetBSD. It is made of an ~MI frontend, to which MD backends can be plugged. A virtualization API is provided in libnvmm, that allows to easily create and manage virtual machines via NVMM. Two additional components are shipped as demonstrators, toyvirt and smallkern: the former is a toy virtualizer, that executes in a VM the 64bit ELF binary given as argument, the latter is an example of such binary.</p> </blockquote> <ul> <li>Download</li> </ul> <blockquote> <p>The source code of NVMM, plus the associated tools, can be downloaded here.</p> </blockquote> <ul> <li>Technical details</li> </ul> <blockquote> <p>NVMM can support up to 128 virtual machines, each having a maximum of 256 VCPUs and 4GB of RAM.<br> Each virtual machine is granted access to most of the CPU registers: the GPRs (obviously), the Segment Registers, the Control Registers, the Debug Registers, the FPU (x87 and SSE), and several MSRs.<br> Events can be injected in the virtual machines, to emulate device interrupts. A delay mechanism is used, and allows VMM software to schedule the interrupt right when the VCPU can receive it. NMIs can be injected as well, and use a similar mechanism.<br> The host must always be x86_64, but the guest has no constraint on the mode, so it can be x86_32, PAE, real mode, and so on.<br> The TSC of each VCPU is always re-based on the host CPU it is executing on, and is therefore guaranteed to increase regardless of the host CPU. However, it may not increase monotonically, because it is not possible to fully hide the host effects on the guest during #VMEXITs.<br> When there are more VCPUs than the host TLB can deal with, NVMM uses a shared ASID, and flushes the shared-ASID VCPUs on each VM switch.<br> The different intercepts are configured in such a way that they cover everything that needs to be emulated. In particular, the LAPIC can be emulated by VMM software, by intercepting reads/writes to the LAPIC page in memory, and monitoring changes to CR8 in the exit state.</p> </blockquote> <hr> <p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/sysadmin/InitDependencyUnclear\">What ‘dependency’ means in Unix init systems is underspecified (utoronto.ca)</a></p> <blockquote> <p>I was reading Davin McCall’s On the vagaries of init systems (via) when I ran across the following, about the relationship between various daemons (services, etc):<br> I do not see any compelling reason for having ordering relationships without actual dependency, as both Nosh and Systemd provide for. In comparison, Dinit’s dependencies also imply an ordering, which obviates the need to list a dependency twice in the service description.<br> Well, this may be an easy one but it depends on what an init system means by ‘dependency’. Let’s consider ®syslog and the SSH daemon. I want the syslog daemon to be started before the SSH daemon is started, so that the SSH daemon can log things to it from the beginning. However, I very much do not want the SSH daemon to not be started (or to be shut down) if the syslog daemon fails to start or later fails. If syslog fails, I still want the SSH daemon to be there so that I can perhaps SSH in to the machine and fix the problem.<br> This is generally true of almost all daemons; I want them to start after syslog, so that they can syslog things, but I almost never want them to not be running if syslog failed. (And if for some reason syslog is not configured to start, I want enabling and starting, say, SSH, to also enable and start the syslog daemon.)<br> In general, there are three different relationships between services that I tend to encounter:</p> </blockquote> <ul> <li> <p>a hard requirement, where service B is useless or dangerous without service A. For instance, many NFS v2 and NFS v3 daemons basically don’t function without the RPC portmapper alive and active. On any number of systems, firewall rules being in place are a hard requirement to start most network services; you would rather your network services not start at all than that they start without your defenses in place.</p> </li> <li> <p>a want, where service B wants service A to be running before B starts up, and service A should be started even if it wouldn’t otherwise be, but the failure of A still leaves B functional. Many daemons want the syslog daemon to be started before they start but will run without it, and often you want them to do so so that at least some of the system works even if there is, say, a corrupt syslog configuration file that causes the daemon to error out on start. (But some environments want to hard-fail if they can’t collect security related logging information, so they might make rsyslogd a requirement instead of a want.)</p> </li> <li> <p>an ordering, where if service A is going to be started, B wants to start after it (or before it), but B isn’t otherwise calling for A to be started. We have some of these in our systems, where we need NFS mounts done before cron starts and runs people’s @reboot jobs but neither cron nor NFS mounts exactly or explicitly want each other. (The system as a whole wants both, but that’s a different thing.)</p> </li> </ul> <blockquote> <p>Given these different relationships and the implications for what the init system should do in different situations, talking about ‘dependency’ in it systems is kind of underspecified. What sort of dependency? What happens if one service doesn’t start or fails later?<br> My impression is that generally people pick a want relationship as the default meaning for init system ‘dependency’. Usually this is fine; most services aren’t actively dangerous if one of their declared dependencies fails to start, and it’s generally harmless on any particular system to force a want instead of an ordering relationship because you’re going to be starting everything anyway.</p> </blockquote> <ul> <li>(In my example, you might as well say that cron on the systems in question wants NFS mounts. There is no difference in practice; we already always want to do NFS mounts and start cron.)</li> </ul> <hr> <p>###<a href=\"https://github.com/lattera/articles/blob/master/freebsd/2018-10-27_jailed_bhyve/article.md\">Jailing The bhyve Hypervisor</a></p> <blockquote> <p>As FreeBSD nears the final 12.0-RELEASE release engineering cycles, I’d like to take a moment to document a cool new feature coming in 12: jailed bhyve.<br> You may notice that I use HardenedBSD instead of FreeBSD in this article. There is no functional difference in bhyve on HardenedBSD versus bhyve on FreeBSD. The only difference between HardenedBSD and FreeBSD is the aditional security offered by HardenedBSD.<br> The steps I outline here work for both FreeBSD and HardenedBSD. These are the bare minimum steps, no extra work needed for either FreeBSD or HardenedBSD.</p> </blockquote> <ul> <li>A Gentle History Lesson</li> </ul> <blockquote> <p>At work in my spare time, I’m helping develop a malware lab. Due to the nature of the beast, we would like to use bhyve on HardenedBSD. Starting with HardenedBSD 12, non-Cross-DSO CFI, SafeStack, Capsicum, ASLR, and strict W<sup>X</sup> are all applied to bhyve, making it an extremely hardened hypervisor.<br> So, the work to support jailed bhyve is sponsored by both HardenedBSD and my employer. We’ve also jointly worked on other bhyve hardening features, like protecting the VM’s address space using guard pages (mmap(…, MAP_GUARD, …)). Further work is being done in a project called “malhyve.” Only those modifications to bhyve/malhyve that make sense to upstream will be upstreamed.</p> </blockquote> <ul> <li>Initial Setup</li> </ul> <blockquote> <p>We will not go through the process of creating the jail’s filesystem. That process is documented in the FreeBSD Handbook. For UEFI guests, you will need to install the uefi-edk2-bhyve package inside the jail.<br> I network these jails with traditional jail networking. I have tested vnet jails with this setup, and that works fine, too. However, there is no real need to hook the jail up to any network so long as bhyve can access the tap device. In some cases, the VM might not need networking, in which case you can use a network-less VM in a network-less jail.<br> By default, access to the kernel side of bhyve is disabled within jails. We need to set allow.vmm in our jail.conf entry for the bhyve jail.</p> </blockquote> <ul> <li> <p>We will use the following in our jail, so we will need to set up devfs(8) rules for them:</p> </li> <li> <p>A ZFS volume</p> </li> <li> <p>A null-modem device (nmdm(4))</p> </li> <li> <p>UEFI GOP (no devfs rule, but IP assigned to the jail)</p> </li> <li> <p>A tap device</p> </li> <li> <p>Conclusion</p> </li> </ul> <blockquote> <p>The bhyve hypervisor works great within a jail. When combined with HardenedBSD, bhyve is extremely hardened:</p> </blockquote> <ul> <li>PaX ASLR is fully applied due to compilation as a Position-Independent Executable (HardenedBSD enhancement)</li> <li>PaX NOEXEC is fully applied (strict W<sup>X)</sup> (HardenedBSD enhancement)</li> <li>Non-Cross-DSO CFI is fully applied (HardenedBSD enhancement)</li> <li>Full RELRO (RELRO + BIND_NOW) is fully applied (HardenedBSD enhancement)</li> <li>SafeStack is applied to the application (HardenedBSD enhancement)</li> <li>Jailed (FreeBSD feature written by HardenedBSD)</li> <li>Virtual memory protected with guard pages (FreeBSD feature written by HardenedBSD)</li> <li>Capsicum is fully applied (FreeBSD feature)</li> </ul> <blockquote> <p>Bad guys are going to have a hard time breaking out of the userland components of bhyve on HardenedBSD. :)</p> </blockquote> <hr> <p>##Beastie Bits</p> <ul> <li><a href=\"https://www.ghostbsd.org/18.10_release_announcement\">GhostBSD 18.10 has been released</a></li> <li><a href=\"http://project-trident.org/post/2018-11-10_rc3-available/\">Project Trident RC3 has been released</a></li> <li><a href=\"https://undeadly.org/cgi?action=article;sid=20181022130631\">The OpenBSD Foundation receives the first Silver contribution from a single individual</a></li> <li><a href=\"http://www.echothrust.com/blogs/monitoring-pf-logs-gource\">Monitoring pf logs gource</a></li> <li><a href=\"https://twitter.com/zmcgrew/status/1055682596812730368\">NetBSD on the RISC-V is alive</a></li> <li><a href=\"https://marc.info/?l=openbsd-tech&amp;m=154050351216908&amp;w=2\">The X hole</a></li> <li><a href=\"http://mail-index.netbsd.org/pkgsrc-users/2018/10/05/msg027525.html\">Announcing the pkgsrc-2018Q3 release (2018-10-05)</a></li> <li><a href=\"https://an.undulating.space/post/180927-er_alternate_firmware_benchmarks/\">NAT performance on EdgeRouter X and Lite with EdgeOS, OpenBSD, and OpenWRT</a></li> <li><a href=\"https://www.princeton.edu/~hos/mike/transcripts/thompson.htm\">UNIX (as we know it) might not have existed without Mrs. Thompson</a></li> <li><a href=\"https://www.freepizza.io/\">Free Pizza for your dev events</a></li> <li><a href=\"https://calagator.org/events/1250474530\">Portland BSD Pizza Night: Nov 29th 7pm</a></li> </ul> <hr> <p>##Feedback/Questions</p> <ul> <li>Dennis - <a href=\"http://dpaste.com/36JB7EC#wrap\">Core developers leaving illumOS?</a></li> <li>Ben - <a href=\"http://dpaste.com/1R36Z32#wrap\">Jumping from snapshot to snapshot</a></li> <li>Ias - <a href=\"http://dpaste.com/1CC86MX\">Question about ZFS snapshots</a></li> </ul> <hr> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\"><a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></a></li> </ul> <hr></p>","summary":"Byproducts of reading OpenBSD’s netcat code, learnings from porting your own projects to FreeBSD, OpenBSD’s unveil(), NetBSD’s Virtual Machine Monitor, what 'dependency' means in Unix init systems, jailing bhyve, and more.","date_published":"2018-11-15T13:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/23422ca9-e188-4755-aaf1-295422643d21.mp3","mime_type":"audio/mp3","size_in_bytes":41375491,"duration_in_seconds":4119}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2867","title":"Episode 271: Automatic Drive Tests | BSD Now 271","url":"https://www.bsdnow.tv/271","content_text":"MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.\n\n##Headlines\n###MidnightBSD 1.0 now available\n\n\nI’m happy to announce the availability of MidnightBSD 1.0 for amd64 and i386. Over the years, many ambitious goals were set for our 1.0 release. As it approached, it was clear we wouldn’t be able to accomplish all of them. This release is more of a natural progression rather than a groundbreaking event. It includes many updates to the base system, improvements to the package manager, an updated compiler, and tools.\nOf particular note, you can now boot off of ZFS and use NVME SSDs and some AMD Radeon graphics cards support acceleration. AMD Ryzen support has greatly improved in this release. We also have added bhyve from FreeBSD.\nThe 1.0 release is finally available. Still building packages for i386 and plan to do an amd64 package build later in the week. The single largest issue with the release process has been the web server performance. The CPU is overloaded and has been at solid 100% for several days. The server has a core i7 7700 in it. I’m trying to figure out what to buy as an upgrade so that we don’t continue to have this issue going forward. As it’s actually blocked in multiple processes, a 6 or 8 core chip might be an improvement for the workload…\n\n\n\nDownload links: https://www.midnightbsd.org/download/\nhttps://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4\n\n\n\n\n###MeetBSD Review\n\n\nMeetBSD 2018 took place at the sprawling Intel Santa Clara campus. The venue itself felt more like an olive branch than a simple friendly gesture by Intel. In truth it felt like a bit of an apology. You get the subtle sense they feel bad about how the BSD’s were treated with the Meltdown and Specter flaws. In fact, you may be right to think they felt a bit sorry towards the entire open source community.\n\n\n\nMeetBSD 2018\n\n\n\nAt most massive venues the parking is the first concern, not so here - in fact that was rather straightforward. No, the real challenge is navigating the buildings. Luckily I had help from navigator extraordinaire, Hadea, who located the correct building, SC12 quickly. Finding the entrance took a moment or two though. The lobby itself was converted by iXsystems efficiently into the MeetBSD expo hall, clean, efficient and roomy with registration, some seating, and an extra conference room for on-on-one sessions. On day two sponsor booths were also setup. All who showed up on day one were warmly greeted with badges, lanyards and goodies by Denise and her friendly team.\nLike every great BSD event, plenty of food was made available. And as always they make it look effortless. These events showcase iXsystem’s inherent generosity toward its community; with breakfast items in the back of the main auditorium room in the morning, boxed lunches, fruit and cookies at lunch time, and snacks for the rest of the day. But just in case your still hungry, there is a pizza meetup in another Intel room after day one and two.\nMeetBSD leverages it’s realistically small crowd size on day one. The morning starts off with introductions of the entire group, the mic is passed around the room.\nThe group is a good mix of pros in the industry (such as Juniper, Intel, Ebay, Groupon, Cisco, etc), iX staff, and a few enthusiast. Lots of people with a focus or passion for networking. And, of course, some friendly Linux bashing went down for good measure, always followed by a good natured chuckle.\n\n\n\nMeetBSD Gives me The Feels\n\n\n\nI find that I am subtly unnerved at this venue, and at lunch I saw it clearly. I have always had a strong geek radar, allowing me to navigate a new area (like Berkeley for MeetBSD of 2016, or even SCALE earlier this year in Pasadena), and in a glance I can see who is from my conference and who isn’t. This means it is easy, nearly effortless to know who to greet with a smile and a wave. These are MY people. Here at the Intel campus though it is different. The drive in alone reveals behemoth complexes all with well known tech names prominently displayed. This is Silicon Valley, and all of these people look like MY people. So much for knowing who’s from my conference. Thank goodness for those infamous BSD horns. None-the-less I am struck by how massive these tech giants are. And Intel is one of the largest of those giants, and see the physical reminders of this fact brought home the significance that they had opened their doors, wifi, and bathrooms to the BSD community.\n\n\n\n\n###[EuroBSDcon 2018 Trip Reports]\nhttps://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/\nhttps://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/\nhttps://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/\n\n\n\n##News Roundup\n###DNS over TLS in FreeBSD 12\n\n\nWith the arrival of OpenSSL 1.1.1, an upgraded Unbound, and some changes to the setup and init scripts, FreeBSD 12.0, currently in beta, now supports DNS over TLS out of the box.\nDNS over TLS is just what it sounds like: DNS over TCP, but wrapped in a TLS session. It encrypts your requests and the server’s replies, and optionally allows you to verify the identity of the server. The advantages are protection against eavesdropping and manipulation of your DNS traffic; the drawbacks are a slight performance degradation and potential firewall traversal issues, as it runs over a non-standard port (TCP port 853) which may be blocked on some networks. Let’s take a look at how to set it up.\n\n\n\nConclusion\n\n\n\nWe’ve seen how to set up Unbound—specifically, the local_unbound service in FreeBSD 12.0—to use DNS over TLS instead of plain UDP or TCP, using Cloudflare’s public DNS service as an example. We’ve looked at the performance impact, and at how to ensure (and verify) that Unbound validates the server certificate to prevent man-in-the-middle attacks.\nThe question that remains is whether it is all worth it. There is undeniably a performance hit, though this may improve with TLS 1.3. More importantly, there are currently very few DNS-over-TLS providers—only one, really, since Quad9 filter their responses—and you have to weigh the advantage of encrypting your DNS traffic against the disadvantage of sending it all to a single organization. I can’t answer that question for you, but I can tell you that the parameters are evolving quickly, and if your answer is negative today, it may not remain so for long. More providers will appear. Performance will improve with TLS 1.3 and QUIC. Within a year or two, running DNS over TLS may very well become the rule rather than the experimental exception.\n\n\n\n\n###Upgrading OpenBSD with Ansible\n\n\nMy router runs OpenBSD -current\n\n\n\nA few months ago, I needed software that had just hit the ports tree. I didn’t want to wait for the next release, so I upgraded my router to use -current. Since then, I’ve continued running -current, which means upgrading to a newer snapshot every so often. Running -current is great, but the process of updating to a newer snapshot was cumbersome. Initially, I had to plug in a serial cable and then reboot into bsd.rd, hit enter ten times, then reboot, run sysmerge and update packages.\nI eventually switched to upobsd to be able to upgrade without the need for a serial connection. The process was better, but still tiresome. Usually, I would prepare the special version of bsd.rd, boot on bsd.rd, and do something like wash the dishes in the meantime. After about ten minutes, I would dry my hands and then go back to my workstation to see whether the bsd.rd part had finished so I could run sysmerge and pkg_add, and then return to the dishes while it upgraded packages.\nOut of laziness, I thought: “I should automate this,” but what happened instead is that I simply didn’t upgrade that machine very often. (Yes, laziness). With my router out of commission, life is very dull, because it is my gateway to the Internet. Even services hosted at my place (like my Mastodon instance) are not reachable when the router is down because I use multiple VLANs (so I need the router to jump across VLANs).\n\n\n\nAnsible Reboot Module\n\n\n\nI recently got a new job, and one of my first tasks was auditing the Ansible roles written by my predecessors. In one role, the machine rebooted and they used the wait_for_connection module to wait for it to come back up. That sounded quite hackish to me, so out of curiosity, I tried to determine whether there was a better way. I also thought I might be able to use something similar to further automate my OpenBSD upgrades, and wanted to assess the cleanliness of this method. ;-)\nI learned that with the then-upcoming 2.7 Ansible release, a proper reboot module would be included. I went to the docs, which stated that for a certain parameter:\nI took this to mean that there was no support for OpenBSD. I looked at the code and, indeed, there was not. However, I believed that it wouldn’t be too hard to add it. I added the missing pieces for OpenBSD, tested it on my poor Pine64 and then submitted it upstream. After a quick back and forth, the module’s author merged it into devel (having a friend working at Red Hat helped the process, merci Cyril !) A couple days later, the release engineer merged it into stable-2.7.\nI proceeded to actually write the playbook, and then I hit a bug. The parameter reboot_timeout was not recognized by Ansible. This feature would definitely be useful on a slow machine (such as the Pine64 and its dying SD card). Again, my fix was merged into master by the module’s author and then merged into stable-2.7. 2.7.1 will be the first release to feature these fixes, but if you use OpenBSD -current, you already have access to them. I backported the patches when I updated ansible.\nFun fact about Ansible and reboots: “The win_reboot module was […] included with Ansible 2.1,” while for unix systems it wasn’t added until 2.7. :D For more details, you can read the module’s author blog article.\n\n\n\nThe explanations\n\n\n\nAnsible runs my script on the remote host to fetch the sets. It creates an answer file from the template and then gives it to upobsd. Once upobsd has created the kernel, Ansible copies it in place of /bsd on the host. The router reboots and boots on /bsd, which is upobsd’s bsd.rd. The installer runs in auto_update mode. Once it comes back from bsd.rd land, it archives the kernel and finishes by upgrading all the packages.\nIt also supports upgrading without fetching the sets ahead of time. For instance, I upgrade this way on my Pine64 because if I cared about speed, I wouldn’t use this weak computer with its dying SD card. For this case, I just comment out the path_sets variable and Ansible instead creates an answer file that will instruct the installer to fetch the sets from the designated mirror.\nI’ve been archiving my kernels for a few years. It’s a nice way to fill up / keep a history of my upgrades. If I spot a regression, I can try a previous kernel … which may not work with the then-desynchronized userland, but that’s another story.\nsysmerge already runs with rc.sysmerge in batch mode and sends the result by email. I don’t think there’s merit to running it again in the playbook. The only perk would be discovering in the terminal whether any files need to be manually merged, rather than reading exactly the same output in the email.\nInitially, I used the openbsd_pkg module, but it doesn’t work on -current just before a release because pkg_add automatically looks for pub/OpenBSD/${release}/packages/${arch} (which is empty). I wrote and tested this playbook while 6.4 was around the corner, so I switched to command to be able to pass the -Dsnap parameter.\n\n\n\nThe result\n\n\n\nI’m very happy with the playbook! It performs the upgrade with as little intervention as possible and minimal downtime. \\o/\n\n\n\n\n###Using smartd to automatically run tests on your drives\n\n\nThose programs can “control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA/SATA, SCSI/SAS and NVMe disks. In many cases, these utilities will provide advanced warning of disk degradation and failure.” See the smartmontools website for more information.\n\n\n\nNOTE: “Due to OS-specific issues and also depending on the different state of smartmontools development on the platforms, device support is not the same for all OS platforms.” – use the documentation for your OS.\n\n\n\nI first started using smartd in March 2010 (according to that blog post, that’s when I still writing on both The FreeBSD Diary and this blog). Back then, and until recently, all I did was start smartd. As far as I can tell, all it did was send daily status messages via the FreeBSD periodic tools. I would set my drive devices via daily_status_smart_devices in /etc/periodic.conf and the daily status reports would include drive health information.\n\n\n\nTwo types of tests\nMy original abandoned attempt\nHow do you prove it works?\nLooking at the test results\nFailed drive to the rescue\nsmartd.conf I am using\nsupernews\n\n\n\n\n##Beastie Bits\n\n\nDecent Pics of “Relayd &amp; Httpd Mastery” signature\nA Unix Shell poster from 1983\nCambridge UNIX historians (Cambridge, United Kingdom)\nGoals for FreeBSD 13\nSeptember/October 2018 Issue of the FreeBSD Journal Now Available\nUsing acme.sh for Let’s Encrypt certificates on pkgsrc.org servers\nDeploying Anycast DNS Using OpenBSD and BGP\nHow to check your data integrity?\n\n\n\n\n##Feedback/Questions\n\n\nRaymond - MeetBSD California\n\nDev Summit Videos: https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI\nConference Videos: https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b\nConference videos are still being processed, the rest should appear over the next few weeks.\n\n\n\nGreg - Stable vs Release\nMjrodriguez - Open/FreeBSD support for Single Board computers\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.midnightbsd.org/news/\">MidnightBSD 1.0 now available</a></p>\n\n<blockquote>\n<p>I’m happy to announce the availability of MidnightBSD 1.0 for amd64 and i386. Over the years, many ambitious goals were set for our 1.0 release. As it approached, it was clear we wouldn’t be able to accomplish all of them. This release is more of a natural progression rather than a groundbreaking event. It includes many updates to the base system, improvements to the package manager, an updated compiler, and tools.<br>\nOf particular note, you can now boot off of ZFS and use NVME SSDs and some AMD Radeon graphics cards support acceleration. AMD Ryzen support has greatly improved in this release. We also have added bhyve from FreeBSD.<br>\nThe 1.0 release is finally available. Still building packages for i386 and plan to do an amd64 package build later in the week. The single largest issue with the release process has been the web server performance. The CPU is overloaded and has been at solid 100% for several days. The server has a core i7 7700 in it. I’m trying to figure out what to buy as an upgrade so that we don’t continue to have this issue going forward. As it’s actually blocked in multiple processes, a 6 or 8 core chip might be an improvement for the workload…</p>\n</blockquote>\n\n<ul>\n<li>Download links: <a href=\"https://www.midnightbsd.org/download/\">https://www.midnightbsd.org/download/</a></li>\n<li><a href=\"https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4\">https://www.youtube.com/watch?time_continue=33&amp;v=-rlk2wFsjJ4</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://linuxunplugged.com/articles/meetbsd2018\">MeetBSD Review</a></p>\n\n<blockquote>\n<p>MeetBSD 2018 took place at the sprawling Intel Santa Clara campus. The venue itself felt more like an olive branch than a simple friendly gesture by Intel. In truth it felt like a bit of an apology. You get the subtle sense they feel bad about how the BSD’s were treated with the Meltdown and Specter flaws. In fact, you may be right to think they felt a bit sorry towards the entire open source community.</p>\n</blockquote>\n\n<ul>\n<li>MeetBSD 2018</li>\n</ul>\n\n<blockquote>\n<p>At most massive venues the parking is the first concern, not so here - in fact that was rather straightforward. No, the real challenge is navigating the buildings. Luckily I had help from navigator extraordinaire, Hadea, who located the correct building, SC12 quickly. Finding the entrance took a moment or two though. The lobby itself was converted by iXsystems efficiently into the MeetBSD expo hall, clean, efficient and roomy with registration, some seating, and an extra conference room for on-on-one sessions. On day two sponsor booths were also setup. All who showed up on day one were warmly greeted with badges, lanyards and goodies by Denise and her friendly team.<br>\nLike every great BSD event, plenty of food was made available. And as always they make it look effortless. These events showcase iXsystem’s inherent generosity toward its community; with breakfast items in the back of the main auditorium room in the morning, boxed lunches, fruit and cookies at lunch time, and snacks for the rest of the day. But just in case your still hungry, there is a pizza meetup in another Intel room after day one and two.<br>\nMeetBSD leverages it’s realistically small crowd size on day one. The morning starts off with introductions of the entire group, the mic is passed around the room.<br>\nThe group is a good mix of pros in the industry (such as Juniper, Intel, Ebay, Groupon, Cisco, etc), iX staff, and a few enthusiast. Lots of people with a focus or passion for networking. And, of course, some friendly Linux bashing went down for good measure, always followed by a good natured chuckle.</p>\n</blockquote>\n\n<ul>\n<li>MeetBSD Gives me The Feels</li>\n</ul>\n\n<blockquote>\n<p>I find that I am subtly unnerved at this venue, and at lunch I saw it clearly. I have always had a strong geek radar, allowing me to navigate a new area (like Berkeley for MeetBSD of 2016, or even SCALE earlier this year in Pasadena), and in a glance I can see who is from my conference and who isn’t. This means it is easy, nearly effortless to know who to greet with a smile and a wave. These are MY people. Here at the Intel campus though it is different. The drive in alone reveals behemoth complexes all with well known tech names prominently displayed. This is Silicon Valley, and all of these people look like MY people. So much for knowing who’s from my conference. Thank goodness for those infamous BSD horns. None-the-less I am struck by how massive these tech giants are. And Intel is one of the largest of those giants, and see the physical reminders of this fact brought home the significance that they had opened their doors, wifi, and bathrooms to the BSD community.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###[EuroBSDcon 2018 Trip Reports]<br>\n<a href=\"https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/\">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-joseph-mingrone/</a><br>\n<a href=\"https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/\">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-vinicius-zavam/</a><br>\n<a href=\"https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/\">https://www.freebsdfoundation.org/blog/eurobsd-2018-trip-report-emmanuel-vadot/</a></p>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://blog.des.no/2018/10/dns-over-tls-in-freebsd-12/\">DNS over TLS in FreeBSD 12</a></p>\n\n<blockquote>\n<p>With the arrival of OpenSSL 1.1.1, an upgraded Unbound, and some changes to the setup and init scripts, FreeBSD 12.0, currently in beta, now supports DNS over TLS out of the box.<br>\nDNS over TLS is just what it sounds like: DNS over TCP, but wrapped in a TLS session. It encrypts your requests and the server’s replies, and optionally allows you to verify the identity of the server. The advantages are protection against eavesdropping and manipulation of your DNS traffic; the drawbacks are a slight performance degradation and potential firewall traversal issues, as it runs over a non-standard port (TCP port 853) which may be blocked on some networks. Let’s take a look at how to set it up.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>We’ve seen how to set up Unbound—specifically, the local_unbound service in FreeBSD 12.0—to use DNS over TLS instead of plain UDP or TCP, using Cloudflare’s public DNS service as an example. We’ve looked at the performance impact, and at how to ensure (and verify) that Unbound validates the server certificate to prevent man-in-the-middle attacks.<br>\nThe question that remains is whether it is all worth it. There is undeniably a performance hit, though this may improve with TLS 1.3. More importantly, there are currently very few DNS-over-TLS providers—only one, really, since Quad9 filter their responses—and you have to weigh the advantage of encrypting your DNS traffic against the disadvantage of sending it all to a single organization. I can’t answer that question for you, but I can tell you that the parameters are evolving quickly, and if your answer is negative today, it may not remain so for long. More providers will appear. Performance will improve with TLS 1.3 and QUIC. Within a year or two, running DNS over TLS may very well become the rule rather than the experimental exception.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://chown.me/blog/upgrading-openbsd-with-ansible.html\">Upgrading OpenBSD with Ansible</a></p>\n\n<ul>\n<li>My router runs OpenBSD -current</li>\n</ul>\n\n<blockquote>\n<p>A few months ago, I needed software that had just hit the ports tree. I didn’t want to wait for the next release, so I upgraded my router to use -current. Since then, I’ve continued running -current, which means upgrading to a newer snapshot every so often. Running -current is great, but the process of updating to a newer snapshot was cumbersome. Initially, I had to plug in a serial cable and then reboot into bsd.rd, hit enter ten times, then reboot, run sysmerge and update packages.<br>\nI eventually switched to upobsd to be able to upgrade without the need for a serial connection. The process was better, but still tiresome. Usually, I would prepare the special version of bsd.rd, boot on bsd.rd, and do something like wash the dishes in the meantime. After about ten minutes, I would dry my hands and then go back to my workstation to see whether the bsd.rd part had finished so I could run sysmerge and pkg_add, and then return to the dishes while it upgraded packages.<br>\nOut of laziness, I thought: “I should automate this,” but what happened instead is that I simply didn’t upgrade that machine very often. (Yes, laziness). With my router out of commission, life is very dull, because it is my gateway to the Internet. Even services hosted at my place (like my Mastodon instance) are not reachable when the router is down because I use multiple VLANs (so I need the router to jump across VLANs).</p>\n</blockquote>\n\n<ul>\n<li>Ansible Reboot Module</li>\n</ul>\n\n<blockquote>\n<p>I recently got a new job, and one of my first tasks was auditing the Ansible roles written by my predecessors. In one role, the machine rebooted and they used the wait_for_connection module to wait for it to come back up. That sounded quite hackish to me, so out of curiosity, I tried to determine whether there was a better way. I also thought I might be able to use something similar to further automate my OpenBSD upgrades, and wanted to assess the cleanliness of this method. ;-)<br>\nI learned that with the then-upcoming 2.7 Ansible release, a proper reboot module would be included. I went to the docs, which stated that for a certain parameter:<br>\nI took this to mean that there was no support for OpenBSD. I looked at the code and, indeed, there was not. However, I believed that it wouldn’t be too hard to add it. I added the missing pieces for OpenBSD, tested it on my poor Pine64 and then submitted it upstream. After a quick back and forth, the module’s author merged it into devel (having a friend working at Red Hat helped the process, merci Cyril !) A couple days later, the release engineer merged it into stable-2.7.<br>\nI proceeded to actually write the playbook, and then I hit a bug. The parameter reboot_timeout was not recognized by Ansible. This feature would definitely be useful on a slow machine (such as the Pine64 and its dying SD card). Again, my fix was merged into master by the module’s author and then merged into stable-2.7. 2.7.1 will be the first release to feature these fixes, but if you use OpenBSD -current, you already have access to them. I backported the patches when I updated ansible.<br>\nFun fact about Ansible and reboots: “The win_reboot module was […] included with Ansible 2.1,” while for unix systems it wasn’t added until 2.7. :D For more details, you can read the module’s author blog article.</p>\n</blockquote>\n\n<ul>\n<li>The explanations</li>\n</ul>\n\n<blockquote>\n<p>Ansible runs my script on the remote host to fetch the sets. It creates an answer file from the template and then gives it to upobsd. Once upobsd has created the kernel, Ansible copies it in place of /bsd on the host. The router reboots and boots on /bsd, which is upobsd’s bsd.rd. The installer runs in auto_update mode. Once it comes back from bsd.rd land, it archives the kernel and finishes by upgrading all the packages.<br>\nIt also supports upgrading without fetching the sets ahead of time. For instance, I upgrade this way on my Pine64 because if I cared about speed, I wouldn’t use this weak computer with its dying SD card. For this case, I just comment out the path_sets variable and Ansible instead creates an answer file that will instruct the installer to fetch the sets from the designated mirror.<br>\nI’ve been archiving my kernels for a few years. It’s a nice way to fill up / keep a history of my upgrades. If I spot a regression, I can try a previous kernel … which may not work with the then-desynchronized userland, but that’s another story.<br>\nsysmerge already runs with rc.sysmerge in batch mode and sends the result by email. I don’t think there’s merit to running it again in the playbook. The only perk would be discovering in the terminal whether any files need to be manually merged, rather than reading exactly the same output in the email.<br>\nInitially, I used the openbsd_pkg module, but it doesn’t work on -current just before a release because pkg_add automatically looks for pub/OpenBSD/${release}/packages/${arch} (which is empty). I wrote and tested this playbook while 6.4 was around the corner, so I switched to command to be able to pass the -Dsnap parameter.</p>\n</blockquote>\n\n<ul>\n<li>The result</li>\n</ul>\n\n<blockquote>\n<p>I’m very happy with the playbook! It performs the upgrade with as little intervention as possible and minimal downtime. \\o/</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://dan.langille.org/2018/11/04/using-smartd-to-automatically-run-tests-on-your-drives/\">Using smartd to automatically run tests on your drives</a></p>\n\n<blockquote>\n<p>Those programs can “control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA/SATA, SCSI/SAS and NVMe disks. In many cases, these utilities will provide advanced warning of disk degradation and failure.” See the smartmontools website for more information.</p>\n</blockquote>\n\n<blockquote>\n<p>NOTE: “Due to OS-specific issues and also depending on the different state of smartmontools development on the platforms, device support is not the same for all OS platforms.” – use the documentation for your OS.</p>\n</blockquote>\n\n<blockquote>\n<p>I first started using smartd in March 2010 (according to that blog post, that’s when I still writing on both The FreeBSD Diary and this blog). Back then, and until recently, all I did was start smartd. As far as I can tell, all it did was send daily status messages via the FreeBSD periodic tools. I would set my drive devices via daily_status_smart_devices in /etc/periodic.conf and the daily status reports would include drive health information.</p>\n</blockquote>\n\n<ul>\n<li>Two types of tests</li>\n<li>My original abandoned attempt</li>\n<li>How do you prove it works?</li>\n<li>Looking at the test results</li>\n<li>Failed drive to the rescue</li>\n<li>smartd.conf I am using</li>\n<li>supernews</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://mwl.io/archives/3833\">Decent Pics of “Relayd &amp; Httpd Mastery” signature</a></li>\n<li><a href=\"https://twitter.com/0xUID/status/1051208357850345472?s=20\">A Unix Shell poster from 1983</a></li>\n<li><a href=\"https://www.meetup.com/UNIX-historians/\">Cambridge UNIX historians (Cambridge, United Kingdom)</a></li>\n<li><a href=\"https://hackmd.io/Yv46aOjTS0eYk0m4YLXOTw#\">Goals for FreeBSD 13</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/september-october-2018-issue-of-the-freebsd-journal-now-available/\">September/October 2018 Issue of the FreeBSD Journal Now Available</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/using_acme_sh_for_let\">Using acme.sh for Let’s Encrypt certificates on pkgsrc.org servers</a></li>\n<li><a href=\"https://jonwillia.ms/2018/09/23/anycast-dns-openbsd\">Deploying Anycast DNS Using OpenBSD and BGP</a></li>\n<li><a href=\"https://dataswamp.org/~solene/2017-03-17-integrity.html\">How to check your data integrity?</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Raymond - <a href=\"http://dpaste.com/0KNXTJF\">MeetBSD California</a>\n<ul>\n<li>Dev Summit Videos: <a href=\"https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI\">https://www.youtube.com/playlist?list=PLb87fdKUIo8TNG6f94xo9_W-XXrEbqgWI</a></li>\n<li>Conference Videos: <a href=\"https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b\">https://www.youtube.com/playlist?list=PLb87fdKUIo8Q41aoPE6vssP-uF4dxk86b</a></li>\n<li>Conference videos are still being processed, the rest should appear over the next few weeks.</li>\n</ul>\n\n<p></li><br>\n<li>Greg - <a href=\"http://dpaste.com/1W29RSK\">Stable vs Release</a></li><br>\n<li>Mjrodriguez - <a href=\"http://dpaste.com/2XKMR6B#wrap\">Open/FreeBSD support for Single Board computers</a></li><br>\n</ul><br>\n<hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"MidnightBSD 1.0 released, MeetBSD review, EuroBSDcon trip reports, DNS over TLS in FreeBSD 12, Upgrading OpenBSD with Ansible, how to use smartd to run tests on your drives automatically, and more.","date_published":"2018-11-08T04:00:00.000-05:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/79038ba2-cb6e-4b71-8bcb-83141df434c3.mp3","mime_type":"audio/mp3","size_in_bytes":40996081,"duration_in_seconds":4081}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2822","title":"Episode 270: Ghostly Releases | BSD Now 270","url":"https://www.bsdnow.tv/270","content_text":"OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.\n\n##Headlines\n###OpenBSD 6.4 released\n\n\nSee a detailed log of changes between the 6.3 and 6.4 releases.\nSee the information on the FTP page for a list of mirror machines.\nHave a look at the 6.4 errata page for a list of bugs and workarounds.\nsignify(1) pubkeys for this release:\nbase: RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA\nfw:   RWRoBbjnosJ/39llpve1XaNIrrQND4knG+jSBeIUYU8x4WNkxz6a2K97\npkg:  RWRF5TTY+LoN/51QD5kM2hKDtMTzycQBBPmPYhyQEb1+4pff/H6fh/kA\n\n\n\n\n###GhostBSD 18.10 RC2 Announced\n\n\nThis second release candidate of GhostBSD 18.10 is the second official release of GhostBSD with TrueOS under the hood. The official desktop of GhostBSD is MATE. However, in the future, there might be an XFCE community release, but for now, there is no community release yet.\n\n\n\n\nWhat has changed since RC1\n\n\nRemoved drm-stable-kmod and we will let users installed the propper drm-*-kmod\n\n\nDouglas Joachin added libva-intel-driver libva-vdpau-driver  to supports accelerated some video driver for Intel\n\n\nIssues that got fixed\n\n\nBug #70 Cannot run Octopi, missing libgksu error.\n\n\nBug #71 LibreOffice doesn’t start because of missing libcurl.so.4\n\n\nBug #72 libarchive is a missing dependency\n\n\n\n\nAgain thanks to iXsystems, TrueOS, Joe Maloney, Kris Moore, Ken Moore, Martin Wilke, Neville Goddard, Vester “Vic” Thacker, Douglas Joachim, Alex Lyakhov, Yetkin Degirmenci and many more who helped to make the transition from FreeBSD to TrueOS smoother.\n\n\n\n\nUpdating from RC1 to RC2:\n\n\nsudo pkg update -f\n\n\nsudo pkg install -f libarchive curl libgksu\n\n\nsudo pkg upgrade\n\n\nWhere to download:\n\n\nAll images checksum, hybrid ISO(DVD, USB) and torrent are available here: https://www.ghostbsd.org/download\n\n\n[ScreenShots]\n\n\nhttps://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png\n\n\nhttps://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png\n\n\n\n\n\n###OpenSSH 7.9 has been released and it has support for OpenSSL 1.1\n\nChanges since OpenSSH 7.8\n=========================\n\nThis is primarily a bugfix release.\n\nNew Features\n------------\n * ssh(1), sshd(8): allow most port numbers to be specified using\n   service names from getservbyname(3) (typically /etc/services).\n * ssh(1): allow the IdentityAgent configuration directive to accept\n   environment variable names. This supports the use of multiple\n   agent sockets without needing to use fixed paths.\n * sshd(8): support signalling sessions via the SSH protocol.\n   A limited subset of signals is supported and only for login or\n   command sessions (i.e. not subsystems) that were not subject to\n   a forced command via authorized_keys or sshd_config. bz#1424\n * ssh(1): support \"ssh -Q sig\" to list supported signature options.\n   Also \"ssh -Q help\" to show the full set of supported queries.\n * ssh(1), sshd(8): add a CASignatureAlgorithms option for the\n   client and server configs to allow control over which signature\n   formats are allowed for CAs to sign certificates. For example,\n   this allows banning CAs that sign certificates using the RSA-SHA1\n   signature algorithm.\n * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to\n   revoke keys specified by SHA256 hash.\n * ssh-keygen(1): allow creation of key revocation lists directly\n   from base64-encoded SHA256 fingerprints. This supports revoking\n   keys using only the information contained in sshd(8)\n   authentication log messages.\n\nBugfixes\n--------\n\n * ssh(1), ssh-keygen(1): avoid spurious \"invalid format\" errors when\n   attempting to load PEM private keys while using an incorrect\n   passphrase. bz#2901\n * sshd(8): when a channel closed message is received from a client,\n   close the stderr file descriptor at the same time stdout is\n   closed. This avoids stuck processes if they were waiting for\n   stderr to close and were insensitive to stdin/out closing. bz#2863\n * ssh(1): allow ForwardX11Timeout=0 to disable the untrusted X11\n   forwarding timeout and support X11 forwarding indefinitely.\n   Previously the behaviour of ForwardX11Timeout=0 was undefined.\n * sshd(8): when compiled with GSSAPI support, cache supported method\n   OIDs regardless of whether GSSAPI authentication is enabled in the\n   main section of sshd_config. This avoids sandbox violations if\n   GSSAPI authentication was later enabled in a Match block. bz#2107\n * sshd(8): do not fail closed when configured with a text key\n   revocation list that contains a too-short key. bz#2897\n * ssh(1): treat connections with ProxyJump specified the same as\n   ones with a ProxyCommand set with regards to hostname\n   canonicalisation (i.e. don't try to canonicalise the hostname\n   unless CanonicalizeHostname is set to 'always'). bz#2896\n * ssh(1): fix regression in OpenSSH 7.8 that could prevent public-\n   key authentication using certificates hosted in a ssh-agent(1)\n   or against sshd(8) from OpenSSH &lt;7.8.\n\nPortability\n-----------\n\n * All: support building against the openssl-1.1 API (releases 1.1.0g\n   and later). The openssl-1.0 API will remain supported at least\n   until OpenSSL terminates security patch support for that API version.\n * sshd(8): allow the futex(2) syscall in the Linux seccomp sandbox;\n   apparently required by some glibc/OpenSSL combinations.\n * sshd(8): handle getgrouplist(3) returning more than\n   _SC_NGROUPS_MAX groups. Some platforms consider this limit more\n   as a guideline.\n\n\n\n\n##News Roundup\n\n###MeetBSD 2018: The Ultimate Hallway Track\n\n\nFounded in Poland in 2007 and first hosted in California in 2008, MeetBSD combines formal talks with UnConference activities to provide a level of interactivity not found at any other BSD conference. The character of each MeetBSD is determined largely by its venue, ranging from Hacker Dojo in 2010 to Intel’s Santa Clara headquarters this year. The Intel SC12 building provided a beautiful auditorium and sponsors’ room, plus a cafeteria for the Friday night social event and the Saturday night FreeBSD 25th Anniversary Celebration. The formal nature of the auditorium motivated the formation of MeetBSD’s first independent Program Committee and public Call for Participation. Together these resulted in a backbone of talks presented by speakers from the USA, Canada, and Poland, combined with UnConference activities tailored to the space.\n\n\n\nMeetBSD Day 0\n\n\n\nDay Zero of MeetBSD was a FreeBSD Developer/Vendor Summit hosted in the same auditorium where the talks would take place. Like the conference itself, this event featured a mix of scheduled talks and interactive sessions. The scheduled talks were LWPMFS: LightWeight Persistent Memory Filesystem by Ravi Pokala, Evaluating GIT for FreeBSD by Ed Maste, and NUMA by Mark Johnston. Ed’s overview of the advantages and disadvantages of using Git for FreeBSD development was of the most interest to users and developers, and the discussion continued into the following two days.\n\n\n\nMeetBSD Day 1\n\n\n\nThe first official day of MeetBSD 2018 was kicked off with introductions led by emcee JT Pennington and a keynote, “Using TrueOS to boot-strap your FreeBSD-based project” by Kris Moore. Kris described a new JSON-based release infrastructure that he has exercised with FreeBSD, TrueOS, and FreeNAS. Kris’ talk was followed by “Intel &amp; FreeBSD: Better Together” by Ben Widawsky, the FreeBSD program lead at Intel, who gave an overview of Intel’s past and current efforts supporting FreeBSD. Next came lunch, followed by Kamil Rytarowski’s “Bug detecting software in the NetBSD userland: MKSANITIZER”. This was followed by 5-Minute Lightning Talks, Andrew Fengler’s “FreeBSD: What to (Not) Monitor”, and an OpenZFS Panel Discussion featuring OpenZFS experts Michael W. Lucas, Allan Jude, Alexander Motin, Pawel Dawidek, and Dan Langille. Day one concluded with a social event at the Intel cafeteria where the discussions continued into the night.\n\n\n\nMeetBSD Day 2\n\n\n\nDay Two of MeetBSD 2018 kicked off with a keynote by Michael W. Lucas entitled “Why BSD?”, where Michael detailed what makes the BSD community different and why it attracts us all. This was followed by Dr. Kirk McKusick’s “The Early Days of BSD” talk, which was followed by “DTrace/dwatch in Production” by Devin Teske. After lunch, we enjoyed “A Curmudgeon’s Language Selection Criteria: Why I Don’t Write Everything in Go, Rust, Elixir, etc” by G. Clifford Williams and, “Best practices of sandboxing applications with Capsicum” by Mariusz Zaborski. I then hosted a Virtualization Panel Discussion that featured eight developers from FreeBSD, OpenBSD, and NetBSD. We then split up for Breakout Sessions and the one on Bloomberg’s controversial article on backdoored Supermicro systems was fascinating given the experts present, all of whom were skeptical of the feasibility of the attack. The day wrapped up with a final talk, “Tales of a Daemontown Performance Peddler: Why ‘it depends’ and what you can do about it” by Nick Principe, followed by the FreeBSD 25th Anniversary Celebration.\n\n\n\nPutting the “meet” in MeetBSD\n\n\n\nI confess the other organizers and I were nervous about how well one large auditorium would suit a BSD event but the flexible personal space it gave everyone allowed for countless meetings and heated hacking that often brought about immediate results. I watched people take ideas through several iterations with the help and input of obvious and unexpected experts, all of whom were within reach. Not having to pick up and leave for a talk in another room organically resulted in essentially a series of mini hackathons that none of us anticipated but were delighted to witness, taking the “hallway track” to a whole new level. The mix of formal and UnConference activities at MeetBSD is certain to evolve. Thank you to everyone who participated with questions, Lightning Talks, and Panel participation. A huge thanks to our sponsors, including Intel for both hosting and sponsoring MeetBSD California 2018, Western Digital, Supermicro, Verisign, Jupiter Broadcasting, the FreeBSD Foundation, Bank of America Merrill Lynch, the NetBSD Foundation, and the team at iXsystems.\n\n\n\nSee you at MeetBSD 2020!\n\n\n\n\n###Setup DragonflyBSD with a desktop on real hardware ThinkPad T410\n+Video Demo\n\n\nLinux has become too mainstream and standard BSD is a common thing now? How about DragonflyBSD which was created as a fork of FreeBSD 4.8 in conflict over system internals. This tutorial will show how to install it and set up a user-oriented desktop. It should work with DragonflyBSD, FreeBSD and probably all BSDs.\nSome background: BSD was is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install!\nI did try two BSD distros before called GhostBSD and TrueOS and you can check out my short reviews. DragonflyBSD comes like FreeBSD bare bones and requires some work to get a desktop running.\n\n\n\n\nDownload image file and burn to USB drive or DVD\n\n\nFirst installation\n\n\nSetting up the system and installing a desktop\n\n\nInside the desktop\n\n\nInstall some more programs\n\n\nHow to enable sound?\n\n\nLet’s play some free games\n\n\nSetup WiFi\n\n\nPower mode settings\n\n\nMore to do?\n\n\n\n\nYou can check out this blog post if you want a much more detailed tutorial. If you don’t mind standard BSD, get the GhostBSD distro instead which comes with a ready-made desktop xcfe or mate and many functional presets.\n\n\n\n\nA small summary of what we got on the upside:\n\nFree and open source operating system with a long history\nDrivers worked fine including Ethernet, WiFi, video 2D &amp; 3D, audio, etc\nHammer2 advanced file system\nYou are very unique if you use this OS fork\n\n\n\n\n\nSome downsides:\n\n\n\n\nLess driver and direct app support than Linux\n\n\n\n\nInstaller and desktop have some traps and quirks and require work\n\n\n\n\n\n###Porting Keybase to NetBSD\n\n\nKeybase significantly simplifies the whole keypair/PGP thing and makes what is usually a confusing, difficult experience actually rather pleasant. At its heart is an open-source command line utility that does all of the heavy cryptographic lifting. But it’s also hooked up to the network of all other Keybase users, so you don’t have to work very hard to maintain big keychains. Pretty cool!\nSo, this evening, I tried to get it to all work on NetBSD.\nThe Keybase client code base is, in my opinion, not very well architected… there exist many different Keybase clients (command line apps, desktop apps, mobile apps) and for some reason the code for all of them are seemingly in this single repository, without even using Git submodules. Not sure what that’s about.\nAnyway, “go build”-ing the command line program (it’s written in Go) failed immediately because there’s some platform-specific code that just does not seem to recognize that NetBSD exists (but they do for FreeBSD and OpenBSD). Looks like the Keybase developers maintain a Golang wrapper around struct proc, which of course is different from OS to OS. So I literally just copypasted the OpenBSD wrapper, renamed it to “NetBSD”, and the build basically succeeded from there! This is of course super janky and untrustworthy, but it seems to Mostly Just Work…\nI forked the GitHub repo, you can see the diff on top of keybase 2.7.3 here: bccaaf3096a\nEventually I ended up with a ~/go/bin/keybase which launches just fine. Meaning, I can main() okay. But the moment you try to do anything interesting, it looks super scary:\n\n\ncharlotte@sakuracity:~/go/bin ./keybase login\n▶ WARNING Running in devel mode\n▶ INFO Forking background server with pid=12932\n▶ ERROR unexpected error in Login: API network error: doRetry failed,\nattempts: 1, timeout 5s, last err: Get\nhttp://localhost:3000/_/api/1.0/merkle/path.json?last=3784314&amp;load_deleted=1&amp;load_reset_chain=1&amp;poll=10&amp;sig_hints_low=3&amp;uid=38ae1dfa49cd6831ea2fdade5c5d0519:\ndial tcp [::1]:3000: connect: connection refused\n\n\n\nThere’s a few things about this error message that stuck out to me:\n\n\n\nForking a background server? What?\nIt’s trying to connect to localhost? That must be the server that doesn’t work …\n\n\n\nUnfortunately, this nonfunctional “background server” sticks around even when a command as simple as ‘login’ command just failed:\n\n\ncharlotte@sakuracity:~/go/bin ps 12932\n  PID TTY STAT    TIME COMMAND\n  12932 ?   Ssl  0:00.21 ./keybase --debug --log-file\n  /home/charlotte/.cache/keybase.devel/keybase.service.log service --chdir\n  /home/charlotte/.config/keybase.devel --auto-forked \n\n\n\nI’m not exactly sure what the intended purpose of the “background server” even is, but fortunately we can kill it and even tell the keybase command to not even spawn one:\n\n\ncharlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --standalone\n   --standalone                         Use the client without any daemon support.\n\n\n\nAnd then we can fix wanting to connect to localhost by specifying an expected Keybase API server – how about the one hosted at https://keybase.io?\n\n\ncharlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --server\n   --server, -s                         Specify server API.\n\n\n\nBasically, what I’m trying to say is that if you specify both of these options, the keybase command does what I expect on NetBSD:\n\n\ncharlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io login\n▶ WARNING Running in devel mode\nPlease enter the Keybase passphrase for dressupgeekout (6+ characters): \n\ncharlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io id dressupgeekout\n▶ WARNING Running in devel mode\n▶ INFO Identifying dressupgeekout\n✔ public key fingerprint: 7873 DA50 A786 9A3F 1662 3A17 20BD 8739 E82C 7F2F\n✔ \"dressupgeekout\" on github:\nhttps://gist.github.com/0471c7918d254425835bf5e1b4bcda00 [cached 2018-10-11\n20:55:21 PDT]\n✔ \"dressupgeekout\" on reddit:\nhttps://www.reddit.com/r/KeybaseProofs/comments/9ng5qm/my_keybase_proof_redditdressupgeekout/\n[cached 2018-10-11 20:55:21 PDT]\n\n\n\n\n###Initial implementation of draft-ietf-6man-ipv6only-flag\n\nThis change defines the RA \"6\" (IPv6-Only) flag which routers\nmay advertise, kernel logic to check if all routers on a link\nhave the flag set and accordingly update a per-interface flag.\n\nIf all routers agree that it is an IPv6-only link, ether_output_frame(),\nbased on the interface flag, will filter out all ETHERTYPE_IP/ARP\nframes, drop them, and return EAFNOSUPPORT to upper layers.\n\nThe change also updates ndp to show the \"6\" flag, ifconfig to\ndisplay the IPV6_ONLY nd6 flag if set, and rtadvd to allow\nannouncing the flag.\n\nFurther changes to tcpdump (contrib code) are availble and will\nbe upstreamed.\n\nTested the code (slightly earlier version) with 2 FreeBSD\nIPv6 routers, a FreeBSD laptop on ethernet as well as wifi,\nand with Win10 and OSX clients (which did not fall over with\nthe \"6\" flag set but not understood).\n\nWe may also want to (a) implement and RX filter, and (b) over\ntime enahnce user space to, say, stop dhclient from running\nwhen the interface flag is set.  Also we might want to start\nIPv6 before IPv4 in the future.\n\nAll the code is hidden under the EXPERIMENTAL option and not\ncompiled by default as the draft is a work-in-progress and\nwe cannot rely on the fact that IANA will assign the bits\nas requested by the draft and hence they may change.\n\nDear 6man, you have running code.\n\nDiscussed with: Bob Hinden, Brian E Carpenter\n\n\n##Beastie Bits\n\n\nRunning FreeBSD on macOS via xhyve\nAuction Winners\nOpenSSH Principals\nOpenBSD Foundation gets a second Iridium donation from Handshake\nNetBSD machines at Open Source Conference 2018 Kagawa\nAbsolute FreeBSD now shipping!\nNextCloud on OpenBSD\nFreeBSD 12.0-BETA2 Available\nDTrace on Windows ported from FreeBSD\nHELBUG fall 2018 meeting scheduled - Thursday the 15th of November\n35C3 pre-sale has started\nStockholm BSD User Meeting: Tuesday Nov 13, 18:00 - 21:30  \nPolish BSD User Group: Thursday Nov 15, 18:30 - 21:00 \n\n\n\n\n##Feedback/Questions\n\n\nGreg - Interview suggestion for the show\nNelson - Ghostscript vulnerabilities\nAllison - Ports and GCC\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.openbsd.org/64.html\">OpenBSD 6.4 released</a></p>\n\n<ul>\n<li><a href=\"https://www.openbsd.org/plus64.html\">See a detailed log of changes between the 6.3 and 6.4 releases.</a></li>\n<li><a href=\"https://www.openbsd.org/ftp.html\">See the information on the FTP page for a list of mirror machines.</a></li>\n<li><a href=\"https://www.openbsd.org/errata64.html\">Have a look at the 6.4 errata page for a list of bugs and workarounds.</a></li>\n<li>signify(1) pubkeys for this release:</li>\n<li>base: RWQq6XmS4eDAcQW4KsT5Ka0KwTQp2JMOP9V/DR4HTVOL5Bc0D7LeuPwA</li>\n<li>fw:   RWRoBbjnosJ/39llpve1XaNIrrQND4knG+jSBeIUYU8x4WNkxz6a2K97</li>\n<li>pkg:  RWRF5TTY+LoN/51QD5kM2hKDtMTzycQBBPmPYhyQEb1+4pff/H6fh/kA</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.ghostbsd.org/18.10_RC2_release_announcement\">GhostBSD 18.10 RC2 Announced</a></p>\n\n<blockquote>\n<p>This second release candidate of GhostBSD 18.10 is the second official release of GhostBSD with TrueOS under the hood. The official desktop of GhostBSD is MATE. However, in the future, there might be an XFCE community release, but for now, there is no community release yet.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>What has changed since RC1</p>\n</li>\n<li>\n<p>Removed drm-stable-kmod and we will let users installed the propper drm-*-kmod</p>\n</li>\n<li>\n<p>Douglas Joachin added libva-intel-driver libva-vdpau-driver  to supports accelerated some video driver for Intel</p>\n</li>\n<li>\n<p>Issues that got fixed</p>\n</li>\n<li>\n<p>Bug #70 Cannot run Octopi, missing libgksu error.</p>\n</li>\n<li>\n<p>Bug #71 LibreOffice doesn’t start because of missing libcurl.so.4</p>\n</li>\n<li>\n<p>Bug #72 libarchive is a missing dependency</p>\n</li>\n</ul>\n\n<blockquote>\n<p>Again thanks to iXsystems, TrueOS, Joe Maloney, Kris Moore, Ken Moore, Martin Wilke, Neville Goddard, Vester “Vic” Thacker, Douglas Joachim, Alex Lyakhov, Yetkin Degirmenci and many more who helped to make the transition from FreeBSD to TrueOS smoother.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Updating from RC1 to RC2:</p>\n</li>\n<li>\n<p>sudo pkg update -f</p>\n</li>\n<li>\n<p>sudo pkg install -f libarchive curl libgksu</p>\n</li>\n<li>\n<p>sudo pkg upgrade</p>\n</li>\n<li>\n<p>Where to download:</p>\n</li>\n<li>\n<p>All images checksum, hybrid ISO(DVD, USB) and torrent are available here: <a href=\"https://www.ghostbsd.org/download\">https://www.ghostbsd.org/download</a></p>\n</li>\n<li>\n<p>[ScreenShots]</p>\n</li>\n<li>\n<p><a href=\"https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png\">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-22-41.png</a></p>\n</li>\n<li>\n<p><a href=\"https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png\">https://www.ghostbsd.org/sites/default/files/Screenshot_at_2018-10-20_13-27-26.png</a></p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.openssh.com/txt/release-7.9\">OpenSSH 7.9 has been released and it has support for OpenSSL 1.1</a></p>\n\n<pre><code>Changes since OpenSSH 7.8\n=========================\n\nThis is primarily a bugfix release.\n\nNew Features\n------------\n * ssh(1), sshd(8): allow most port numbers to be specified using\n   service names from getservbyname(3) (typically /etc/services).\n * ssh(1): allow the IdentityAgent configuration directive to accept\n   environment variable names. This supports the use of multiple\n   agent sockets without needing to use fixed paths.\n * sshd(8): support signalling sessions via the SSH protocol.\n   A limited subset of signals is supported and only for login or\n   command sessions (i.e. not subsystems) that were not subject to\n   a forced command via authorized_keys or sshd_config. bz#1424\n * ssh(1): support &quot;ssh -Q sig&quot; to list supported signature options.\n   Also &quot;ssh -Q help&quot; to show the full set of supported queries.\n * ssh(1), sshd(8): add a CASignatureAlgorithms option for the\n   client and server configs to allow control over which signature\n   formats are allowed for CAs to sign certificates. For example,\n   this allows banning CAs that sign certificates using the RSA-SHA1\n   signature algorithm.\n * sshd(8), ssh-keygen(1): allow key revocation lists (KRLs) to\n   revoke keys specified by SHA256 hash.\n * ssh-keygen(1): allow creation of key revocation lists directly\n   from base64-encoded SHA256 fingerprints. This supports revoking\n   keys using only the information contained in sshd(8)\n   authentication log messages.\n\nBugfixes\n--------\n\n * ssh(1), ssh-keygen(1): avoid spurious &quot;invalid format&quot; errors when\n   attempting to load PEM private keys while using an incorrect\n   passphrase. bz#2901\n * sshd(8): when a channel closed message is received from a client,\n   close the stderr file descriptor at the same time stdout is\n   closed. This avoids stuck processes if they were waiting for\n   stderr to close and were insensitive to stdin/out closing. bz#2863\n * ssh(1): allow ForwardX11Timeout=0 to disable the untrusted X11\n   forwarding timeout and support X11 forwarding indefinitely.\n   Previously the behaviour of ForwardX11Timeout=0 was undefined.\n * sshd(8): when compiled with GSSAPI support, cache supported method\n   OIDs regardless of whether GSSAPI authentication is enabled in the\n   main section of sshd_config. This avoids sandbox violations if\n   GSSAPI authentication was later enabled in a Match block. bz#2107\n * sshd(8): do not fail closed when configured with a text key\n   revocation list that contains a too-short key. bz#2897\n * ssh(1): treat connections with ProxyJump specified the same as\n   ones with a ProxyCommand set with regards to hostname\n   canonicalisation (i.e. don't try to canonicalise the hostname\n   unless CanonicalizeHostname is set to 'always'). bz#2896\n * ssh(1): fix regression in OpenSSH 7.8 that could prevent public-\n   key authentication using certificates hosted in a ssh-agent(1)\n   or against sshd(8) from OpenSSH &lt;7.8.\n\nPortability\n-----------\n\n * All: support building against the openssl-1.1 API (releases 1.1.0g\n   and later). The openssl-1.0 API will remain supported at least\n   until OpenSSL terminates security patch support for that API version.\n * sshd(8): allow the futex(2) syscall in the Linux seccomp sandbox;\n   apparently required by some glibc/OpenSSL combinations.\n * sshd(8): handle getgrouplist(3) returning more than\n   _SC_NGROUPS_MAX groups. Some platforms consider this limit more\n   as a guideline.\n</code></pre>\n\n<p><hr></p>\n\n<p>##News Roundup</p>\n\n<p>###<a href=\"https://www.ixsystems.com/blog/meetbsd-2018/\">MeetBSD 2018: The Ultimate Hallway Track</a></p>\n\n<blockquote>\n<p>Founded in Poland in 2007 and first hosted in California in 2008, MeetBSD combines formal talks with UnConference activities to provide a level of interactivity not found at any other BSD conference. The character of each MeetBSD is determined largely by its venue, ranging from Hacker Dojo in 2010 to Intel’s Santa Clara headquarters this year. The Intel SC12 building provided a beautiful auditorium and sponsors’ room, plus a cafeteria for the Friday night social event and the Saturday night FreeBSD 25th Anniversary Celebration. The formal nature of the auditorium motivated the formation of MeetBSD’s first independent Program Committee and public Call for Participation. Together these resulted in a backbone of talks presented by speakers from the USA, Canada, and Poland, combined with UnConference activities tailored to the space.</p>\n</blockquote>\n\n<ul>\n<li>MeetBSD Day 0</li>\n</ul>\n\n<blockquote>\n<p>Day Zero of MeetBSD was a FreeBSD Developer/Vendor Summit hosted in the same auditorium where the talks would take place. Like the conference itself, this event featured a mix of scheduled talks and interactive sessions. The scheduled talks were LWPMFS: LightWeight Persistent Memory Filesystem by Ravi Pokala, Evaluating GIT for FreeBSD by Ed Maste, and NUMA by Mark Johnston. Ed’s overview of the advantages and disadvantages of using Git for FreeBSD development was of the most interest to users and developers, and the discussion continued into the following two days.</p>\n</blockquote>\n\n<ul>\n<li>MeetBSD Day 1</li>\n</ul>\n\n<blockquote>\n<p>The first official day of MeetBSD 2018 was kicked off with introductions led by emcee JT Pennington and a keynote, “Using TrueOS to boot-strap your FreeBSD-based project” by Kris Moore. Kris described a new JSON-based release infrastructure that he has exercised with FreeBSD, TrueOS, and FreeNAS. Kris’ talk was followed by “Intel &amp; FreeBSD: Better Together” by Ben Widawsky, the FreeBSD program lead at Intel, who gave an overview of Intel’s past and current efforts supporting FreeBSD. Next came lunch, followed by Kamil Rytarowski’s “Bug detecting software in the NetBSD userland: MKSANITIZER”. This was followed by 5-Minute Lightning Talks, Andrew Fengler’s “FreeBSD: What to (Not) Monitor”, and an OpenZFS Panel Discussion featuring OpenZFS experts Michael W. Lucas, Allan Jude, Alexander Motin, Pawel Dawidek, and Dan Langille. Day one concluded with a social event at the Intel cafeteria where the discussions continued into the night.</p>\n</blockquote>\n\n<ul>\n<li>MeetBSD Day 2</li>\n</ul>\n\n<blockquote>\n<p>Day Two of MeetBSD 2018 kicked off with a keynote by Michael W. Lucas entitled “Why BSD?”, where Michael detailed what makes the BSD community different and why it attracts us all. This was followed by Dr. Kirk McKusick’s “The Early Days of BSD” talk, which was followed by “DTrace/dwatch in Production” by Devin Teske. After lunch, we enjoyed “A Curmudgeon’s Language Selection Criteria: Why I Don’t Write Everything in Go, Rust, Elixir, etc” by G. Clifford Williams and, “Best practices of sandboxing applications with Capsicum” by Mariusz Zaborski. I then hosted a Virtualization Panel Discussion that featured eight developers from FreeBSD, OpenBSD, and NetBSD. We then split up for Breakout Sessions and the one on Bloomberg’s controversial article on backdoored Supermicro systems was fascinating given the experts present, all of whom were skeptical of the feasibility of the attack. The day wrapped up with a final talk, “Tales of a Daemontown Performance Peddler: Why ‘it depends’ and what you can do about it” by Nick Principe, followed by the FreeBSD 25th Anniversary Celebration.</p>\n</blockquote>\n\n<ul>\n<li>Putting the “meet” in MeetBSD</li>\n</ul>\n\n<blockquote>\n<p>I confess the other organizers and I were nervous about how well one large auditorium would suit a BSD event but the flexible personal space it gave everyone allowed for countless meetings and heated hacking that often brought about immediate results. I watched people take ideas through several iterations with the help and input of obvious and unexpected experts, all of whom were within reach. Not having to pick up and leave for a talk in another room organically resulted in essentially a series of mini hackathons that none of us anticipated but were delighted to witness, taking the “hallway track” to a whole new level. The mix of formal and UnConference activities at MeetBSD is certain to evolve. Thank you to everyone who participated with questions, Lightning Talks, and Panel participation. A huge thanks to our sponsors, including Intel for both hosting and sponsoring MeetBSD California 2018, Western Digital, Supermicro, Verisign, Jupiter Broadcasting, the FreeBSD Foundation, Bank of America Merrill Lynch, the NetBSD Foundation, and the team at iXsystems.</p>\n</blockquote>\n\n<blockquote>\n<p>See you at MeetBSD 2020!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://panoramacircle.com/2018/10/07/setup-dragonflybsd-with-a-desktop-on-real-hardware-thinkpad-t410/\">Setup DragonflyBSD with a desktop on real hardware ThinkPad T410</a><br>\n+<a href=\"https://youtu.be/p4KwssNY82Q\">Video Demo</a></p>\n\n<blockquote>\n<p>Linux has become too mainstream and standard BSD is a common thing now? How about DragonflyBSD which was created as a fork of FreeBSD 4.8 in conflict over system internals. This tutorial will show how to install it and set up a user-oriented desktop. It should work with DragonflyBSD, FreeBSD and probably all BSDs.<br>\nSome background: BSD was is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install!<br>\nI did try two BSD distros before called GhostBSD and TrueOS and you can check out my short reviews. DragonflyBSD comes like FreeBSD bare bones and requires some work to get a desktop running.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Download image file and burn to USB drive or DVD</p>\n</li>\n<li>\n<p>First installation</p>\n</li>\n<li>\n<p>Setting up the system and installing a desktop</p>\n</li>\n<li>\n<p>Inside the desktop</p>\n</li>\n<li>\n<p>Install some more programs</p>\n</li>\n<li>\n<p>How to enable sound?</p>\n</li>\n<li>\n<p>Let’s play some free games</p>\n</li>\n<li>\n<p>Setup WiFi</p>\n</li>\n<li>\n<p>Power mode settings</p>\n</li>\n<li>\n<p>More to do?</p>\n</li>\n</ul>\n\n<blockquote>\n<p>You can check out this blog post if you want a much more detailed tutorial. If you don’t mind standard BSD, get the GhostBSD distro instead which comes with a ready-made desktop xcfe or mate and many functional presets.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>A small summary of what we got on the upside:</p>\n<ul>\n<li>Free and open source operating system with a long history</li>\n<li>Drivers worked fine including Ethernet, WiFi, video 2D &amp; 3D, audio, etc</li>\n<li>Hammer2 advanced file system</li>\n<li>You are very unique if you use this OS fork</li>\n</ul>\n\n<p></li><br>\n<li></p>\n\n<p>Some downsides:</p>\n\n<p></li><br>\n<li></p>\n\n<p>Less driver and direct app support than Linux</p>\n\n<p></li><br>\n<li></p>\n\n<p>Installer and desktop have some traps and quirks and require work</p>\n\n<p></li><br>\n</ul><br>\n<hr></p>\n\n<p>###<a href=\"https://dressupgeekout.blogspot.com/2018/10/porting-keybase-to-netbsd.html\">Porting Keybase to NetBSD</a></p>\n\n<blockquote>\n<p>Keybase significantly simplifies the whole keypair/PGP thing and makes what is usually a confusing, difficult experience actually rather pleasant. At its heart is an open-source command line utility that does all of the heavy cryptographic lifting. But it’s also hooked up to the network of all other Keybase users, so you don’t have to work very hard to maintain big keychains. Pretty cool!<br>\nSo, this evening, I tried to get it to all work on NetBSD.<br>\nThe Keybase client code base is, in my opinion, not very well architected… there exist many different Keybase clients (command line apps, desktop apps, mobile apps) and for some reason the code for all of them are seemingly in this single repository, without even using Git submodules. Not sure what that’s about.<br>\nAnyway, “go build”-ing the command line program (it’s written in Go) failed immediately because there’s some platform-specific code that just does not seem to recognize that NetBSD exists (but they do for FreeBSD and OpenBSD). Looks like the Keybase developers maintain a Golang wrapper around struct proc, which of course is different from OS to OS. So I literally just copypasted the OpenBSD wrapper, renamed it to “NetBSD”, and the build basically succeeded from there! This is of course super janky and untrustworthy, but it seems to Mostly Just Work…<br>\nI forked the GitHub repo, you can see the diff on top of keybase 2.7.3 here: bccaaf3096a<br>\nEventually I ended up with a ~/go/bin/keybase which launches just fine. Meaning, I can main() okay. But the moment you try to do anything interesting, it looks super scary:</p>\n</blockquote>\n\n<pre><code>charlotte@sakuracity:~/go/bin ./keybase login\n▶ WARNING Running in devel mode\n▶ INFO Forking background server with pid=12932\n▶ ERROR unexpected error in Login: API network error: doRetry failed,\nattempts: 1, timeout 5s, last err: Get\nhttp://localhost:3000/_/api/1.0/merkle/path.json?last=3784314&amp;load_deleted=1&amp;load_reset_chain=1&amp;poll=10&amp;sig_hints_low=3&amp;uid=38ae1dfa49cd6831ea2fdade5c5d0519:\ndial tcp [::1]:3000: connect: connection refused\n</code></pre>\n\n<blockquote>\n<p>There’s a few things about this error message that stuck out to me:</p>\n</blockquote>\n\n<ul>\n<li>Forking a background server? What?</li>\n<li>It’s trying to connect to localhost? That must be the server that doesn’t work …</li>\n</ul>\n\n<blockquote>\n<p>Unfortunately, this nonfunctional “background server” sticks around even when a command as simple as ‘login’ command just failed:</p>\n</blockquote>\n\n<pre><code>charlotte@sakuracity:~/go/bin ps 12932\n  PID TTY STAT    TIME COMMAND\n  12932 ?   Ssl  0:00.21 ./keybase --debug --log-file\n  /home/charlotte/.cache/keybase.devel/keybase.service.log service --chdir\n  /home/charlotte/.config/keybase.devel --auto-forked \n</code></pre>\n\n<blockquote>\n<p>I’m not exactly sure what the intended purpose of the “background server” even is, but fortunately we can kill it and even tell the keybase command to not even spawn one:</p>\n</blockquote>\n\n<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --standalone\n   --standalone                         Use the client without any daemon support.\n</code></pre>\n\n<blockquote>\n<p>And then we can fix wanting to connect to localhost by specifying an expected Keybase API server – how about the one hosted at <a href=\"https://keybase.io\">https://keybase.io</a>?</p>\n</blockquote>\n\n<pre><code>charlotte@sakuracity:~/go/bin ./keybase help advanced | grep -- --server\n   --server, -s                         Specify server API.\n</code></pre>\n\n<blockquote>\n<p>Basically, what I’m trying to say is that if you specify both of these options, the keybase command does what I expect on NetBSD:</p>\n</blockquote>\n\n<pre><code>charlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io login\n▶ WARNING Running in devel mode\nPlease enter the Keybase passphrase for dressupgeekout (6+ characters): \n\ncharlotte@sakuracity:~/go/bin ./keybase --standalone -s https://keybase.io id dressupgeekout\n▶ WARNING Running in devel mode\n▶ INFO Identifying dressupgeekout\n✔ public key fingerprint: 7873 DA50 A786 9A3F 1662 3A17 20BD 8739 E82C 7F2F\n✔ &quot;dressupgeekout&quot; on github:\nhttps://gist.github.com/0471c7918d254425835bf5e1b4bcda00 [cached 2018-10-11\n20:55:21 PDT]\n✔ &quot;dressupgeekout&quot; on reddit:\nhttps://www.reddit.com/r/KeybaseProofs/comments/9ng5qm/my_keybase_proof_redditdressupgeekout/\n[cached 2018-10-11 20:55:21 PDT]\n</code></pre>\n\n<p><hr></p>\n\n<p>###<a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=339929\">Initial implementation of draft-ietf-6man-ipv6only-flag</a></p>\n\n<pre><code>This change defines the RA &quot;6&quot; (IPv6-Only) flag which routers\nmay advertise, kernel logic to check if all routers on a link\nhave the flag set and accordingly update a per-interface flag.\n\nIf all routers agree that it is an IPv6-only link, ether_output_frame(),\nbased on the interface flag, will filter out all ETHERTYPE_IP/ARP\nframes, drop them, and return EAFNOSUPPORT to upper layers.\n\nThe change also updates ndp to show the &quot;6&quot; flag, ifconfig to\ndisplay the IPV6_ONLY nd6 flag if set, and rtadvd to allow\nannouncing the flag.\n\nFurther changes to tcpdump (contrib code) are availble and will\nbe upstreamed.\n\nTested the code (slightly earlier version) with 2 FreeBSD\nIPv6 routers, a FreeBSD laptop on ethernet as well as wifi,\nand with Win10 and OSX clients (which did not fall over with\nthe &quot;6&quot; flag set but not understood).\n\nWe may also want to (a) implement and RX filter, and (b) over\ntime enahnce user space to, say, stop dhclient from running\nwhen the interface flag is set.  Also we might want to start\nIPv6 before IPv4 in the future.\n\nAll the code is hidden under the EXPERIMENTAL option and not\ncompiled by default as the draft is a work-in-progress and\nwe cannot rely on the fact that IANA will assign the bits\nas requested by the draft and hence they may change.\n\nDear 6man, you have running code.\n\nDiscussed with: Bob Hinden, Brian E Carpenter\n</code></pre>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://dan.langille.org/2018/10/02/running-freebsd-on-osx-using-xhyve-a-port-of-bhyve/\">Running FreeBSD on macOS via xhyve</a></li>\n<li><a href=\"https://mwl.io/archives/3841\">Auction Winners</a></li>\n<li><a href=\"https://github.com/vedetta-com/vedetta/blob/master/src/usr/local/share/doc/vedetta/OpenSSH_Principals.md\">OpenSSH Principals</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20181018160645\">OpenBSD Foundation gets a second Iridium donation from Handshake</a></li>\n<li><a href=\"https://mail-index.netbsd.org/netbsd-advocacy/2018/10/10/msg000786.html\">NetBSD machines at Open Source Conference 2018 Kagawa</a></li>\n<li><a href=\"https://mwl.io/archives/3818\">Absolute FreeBSD now shipping!</a></li>\n<li><a href=\"https://h3artbl33d.nl/blog/nextcloud-on-openbsd\">NextCloud on OpenBSD</a></li>\n<li><a href=\"https://www.freebsd.org/news/newsflash.html#event20181027:01\">FreeBSD 12.0-BETA2 Available</a></li>\n<li><a href=\"https://twitter.com/gvnn3/status/1049347862541344771\">DTrace on Windows ported from FreeBSD</a></li>\n<li><a href=\"http://dpaste.com/36DFQ1S\">HELBUG fall 2018 meeting scheduled - Thursday the 15th of November</a></li>\n<li><a href=\"https://translate.google.com/translate?hl=de&amp;sl=de&amp;tl=en&amp;u=https%3A%2F%2Ftickets.events.ccc.de%2F35c3%2Fintro%2F\">35C3 pre-sale has started</a></li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/254235663/\">Stockholm BSD User Meeting: Tuesday Nov 13, 18:00 - 21:30  </a></li>\n<li><a href=\"https://bsd-pl.org/en\">Polish BSD User Group: Thursday Nov 15, 18:30 - 21:00 </a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Greg - <a href=\"http://dpaste.com/1WA54CC\">Interview suggestion for the show</a></li>\n<li>Nelson - <a href=\"http://dpaste.com/21KKF7Q#wrap\">Ghostscript vulnerabilities</a></li>\n<li>Allison - <a href=\"http://dpaste.com/3K6D7ST\">Ports and GCC</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"OpenBSD 6.4 released, GhostBSD RC2 released, MeetBSD - the ultimate hallway track, DragonflyBSD desktop on a Thinkpad, Porting keybase to NetBSD, OpenSSH 7.9, and draft-ietf-6man-ipv6only-flag in FreeBSD.","date_published":"2018-11-01T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/83e21562-2f8c-4810-b4c6-0e8f3e36f95b.mp3","mime_type":"audio/mp3","size_in_bytes":41653876,"duration_in_seconds":4147}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2747","title":"Episode 269: Tiny Daemon Lib | BSD Now 269","url":"https://www.bsdnow.tv/269","content_text":"FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.\n\n##Headlines\n###FreeBSD Foundation Update, September 2018\n\n\nMESSAGE FROM THE EXECUTIVE DIRECTOR\n\n\n\nDear FreeBSD Community Member, It is hard to believe that September is over. The Foundation team had a busy month promoting FreeBSD all over the globe, bug fixing in preparation for 12.0, and setting plans in motion to kick off our 4th quarter fundraising and advocacy efforts. Take a minute to see what we’ve been up to and please consider making a donation to help us continue our efforts supporting FreeBSD!\n\n\n\nSeptember 2018 Development Projects Update\n\n\n\nIn preparation for the release of FreeBSD 12.0, I have been working on investigating and fixing a backlog of kernel bug reports.  Of course, this kind of work is never finished, and we will continue to make progress after the release.  In the past couple of months I have fixed a combination of long-standing issues and recent regressions.  Of note are a pair of UNIX domain socket bugs which had been affecting various applications for years.  In particular, Chromium tabs would frequently hang unless a workaround was manually applied to the system, and the bug had started affecting recent versions of Firefox as well.  Fixing these issues gave me an opportunity to revisit and extend our regression testing for UNIX sockets, which, in turn, resulted in some related bugs being identified and fixed.\nOf late I have also been investigating reports of issues with ZFS, particularly, those reported on FreeBSD 11.2.  A number of regressions, including a kernel memory leak and issues with ARC reclamation, have already been fixed for 12.0; investigation of other reports is ongoing. Those who closely follow FreeBSD-CURRENT know that some exciting work to improve memory usage on NUMA systems is now enabled by default.  As is usually the case when new code is deployed in a diverse array of systems and workloads, a number of problems since have been identified. We are working on resolving them as soon as possible to ensure the quality of the release.\nI’m passionate about maintaining FreeBSD’s stability and dependability as it continues to expand and grow new features, and I’m grateful to the FreeBSD Foundation for sponsoring this work.  We depend on users to report problems to the mailing lists and via the bug tracker, so please try running the 12.0 candidate builds and help us make 12.0 a great release.\n\n\n\nFundraising Update: Supporting the Project\n\n\n\nIt’s officially Fall here at Foundation headquarters and we’re heading full-steam into our final fundraising campaign of the year. We couldn’t even have begun to reach our funding goal of $1.25 million dollars without the support from the companies who have partnered with us this year. Thank you to Verisign for becoming a Silver Partner. They now join a growing list of companies like Xiplink, NetApp, Microsoft, Tarsnap, VMware, and NeoSmart Technologies that are stepping up and showing their commitment to FreeBSD!\nFunding from commercial users like these and individual users like yourself, help us continue our efforts of supporting critical areas of FreeBSD such as:\n\n\n\nOperating System Improvements: Providing staff to immediately respond to urgent problems and implement new features and functionality allowing for the innovation and stability you’ve come to rely on.\nSecurity: Providing engineering resources to bolster the capacity and responsiveness of the Security team providing your users with piece of mind when security issues arise.\nRelease Engineering: Continue providing a full-time release engineer, resulting in timely and reliable releases you can plan around.\nQuality Assurance: Improving and increasing test coverage, continuous integration, and automated testing with a full-time software engineer to ensure you receive the highest quality, secure, and reliable operating system.\nNew User Experience: Improving the process and documentation for getting new people involved with FreeBSD, and supporting those people as they become integrated into the FreeBSD Community providing the resources you may need to get new folks up to speed.\nTraining: Supporting more FreeBSD training for undergraduates, graduates, and postgraduates. Growing the community means reaching people and catching their interest in systems software as early as possible and providing you with a bigger pool of candidates with the FreeBSD skills you’re looking for.\nFace-to-Face Opportunities: Facilitating collaboration among members of the community, and building connections throughout the industry to support a healthy and growing ecosystem and make it easier for you to find resources when questions emerge .\n\n\n\nWe can continue the above work, if we meet our goal this year!\nIf your company uses FreeBSD, please consider joining our growing list of 2018 partners. If you haven’t made your donation yet, please consider donating today. We are indebted to the individual donors, and companies listed above who have already shown their commitment to open source.\nThank you for supporting FreeBSD and the Foundation!\n\n\n\nSeptember 2018 Release Engineering Update\n\n\n\nThe FreeBSD Release Engineering team continued working on the upcoming 12.0 RELEASE.  At present, the 12.0 schedule had been adjusted by one week to allow for necessary works-in-progress to be completed.\nOf note, one of the works-in-progress includes updating OpenSSL from 1.0.2 to 1.1.1, in order to avoid breaking the application binary interface (ABI) on an established stable branch.\nDue to the level of non-trivial intrusiveness that had already been discovered and addressed in a project branch of the repository, it is possible (but not yet definite) that the schedule will need to be adjusted by another week to allow more time for larger and related updates for this particular update.\nShould the 12.0-RELEASE schedule need to be adjusted at any time during the release cycle, the schedule on the FreeBSD project website will be updated accordingly.  The current schedule is available at:\nhttps://www.freebsd.org/releases/12.0R/schedule.html\n\n\n\nBSDCam 2018 Trip Report: Marie Helene Kvello-Aune\n\n\n\nI’d like to start by thanking the FreeBSD Foundation for sponsoring my trip to BSDCam(bridge) 2018. I wouldn’t have managed to attend otherwise. I’ve used FreeBSD in both personal and professional deployments since the year 2000, and over the last few years I have become more involved with development and documentation.\nI arrived in Gatwick, London at midnight. On Monday, August 13,  I took the train to Cambridge, and decided to do some touristy activities as I walked from the train station to Churchill College. I ran into Allan outside the hotel right before the sky decided it was time for a heavy rainfall. Monday was mostly spent settling in, recouping after travel, and hanging out with Allan, Brad, Will and Andy later in the afternoon/evening. Read more…\n\n\n\nContinuous Integration Update\n\n\n\nThe FreeBSD Foundation has sponsored the development of the Project’s continuous integration system, available at https://ci.FreeBSD.org, since June. Over the summer, we improved both the software and hardware infrastructure, and also added some new jobs for extending test coverage of the -CURRENT and -STABLE branches. Following are some highlights.\n\n\n\nNew Hardware\n\n\n\nThe Foundation purchased 4 new build machines for scaling up the computation power for the various test jobs. These newer, faster machines substantially speed up the time it takes to test amd64 builds, so that failing changes can be identified more quickly. Also, in August, we received a donation of 2 PINE A64-LTS boards from PINE64.org, which will be put in the hardware test lab as one part of the continuous tests.\n\n\n\nCI Staging Environment\n\n\n\nWe used hardware from a previous generation CI system to build a staging environment for the CI infrastructure, which is available at\nhttps://ci-dev.freebsd.org. It executes the configurations and scripts from the “staging” branch of the FreeBSD-CI repository, and the development feature branches. We also use it to experiment with the new version of the jenkins server and plugins. Having a staging environment avoids affecting the production CI environment, reducing downtime.\n\n\n\nMail Notification\n\n\n\nIn July, we turned on failure notification for all the kernel and world build jobs. Committers will receive email containing the build information and failure log to inform them of possible problems with their modification on certain architectures. For amd64 of the -CURRENT branch, we also enabled the notification on failing regression test cases. Currently mail is sent only to the individual committers, but with help from postmaster team, we have created a dev-ci mailing list and will soon be also sending notifications there.\n\n\n\nNew Test Job\n\n\n\nIn August, we updated the embedded script of the virtual machine image. Originally it only executed pre-defined tests, but now this behavior can be modified by the data on the attached disk. This mechanism is used for adding new ZFS tests jobs. We are also working on analyzing and fixing the failing and skipped test cases.\n\n\n\nWork in Progress\n\n\n\nIn August and September, we had two developer summits, one in Cambridge, UK and one in Bucharest, Romania. In these meetings, we discussed running special tests, such as ztest,  which need a longer run time. We also planned the network testing for TCP/IP stack\n\n\n\n\n###Daemonize - a Tiny C Library for Programming the UNIX Daemons\n\n\nWhatever they say, writing System-V style UNIX daemons is hard. One has to follow many rules to make a daemon process behave correctly on diverse UNIX flavours. Moreover, debugging such a code might be somewhat tricky. On the other hand, the process of daemon initialisation is rigid and well defined so the corresponding code has to be written and debugged once and later can be reused countless number of times.\nDevelopers of BSD UNIX were very aware of this, as there a C library function daemon() was available starting from version 4.4. The function, although non-standard, is present on many UNIXes. Unfortunately, it does not follow all the required steps to reliably run a process in the background on systems which follow System-V semantics (e.g. Linux). The details are available at the corresponding Linux man page. The main problem here, as I understand it, is that daemon() does not use the double-forking technique to avoid the situation when zombie processes appear.\nWhenever I encounter a problem like this one, I know it is time to write a tiny C library which solves it. This is exactly how ‘daemonize’ was born (GitHub mirror). The library consists of only two files which are meant to be integrated into the source tree of your project. Recently I have updated the library and realised that it would be good to describe how to use it on this site.\nIf for some reason you want to make a Windows service, I have a battle tested template code for you as well.\n\n\n\nSystem-V Daemon Initialisation Procedure\n\n\n\nTo make discussion clear we shall quote the steps which have to be performed during a daemon initialisation (according to daemon(7) manual page on Linux). I do it to demonstrate that this task is more tricky than one might expect.\n\n\n\n\nSo, here we go:\n\n\nClose all open file descriptors except standard input, output, and error (i.e. the first three file descriptors 0, 1, 2). This ensures that no accidentally passed file descriptor stays around in the daemon process. On Linux, this is best implemented by iterating through /proc/self/fd, with a fallback of iterating from file descriptor 3 to the value returned by getrlimit() for RLIMIT_NOFILE.\n\n\nReset all signal handlers to their default. This is best done by iterating through the available signals up to the limit of _NSIG and resetting them to SIG_DFL.\n\n\nReset the signal mask using sigprocmask().\n\n\nSanitize the environment block, removing or resetting environment variables that might negatively impact daemon runtime.\n\n\nCall fork(), to create a background process.\n\n\nIn the child, call setsid() to detach from any terminal and create an independent session.\n\n\nIn the child, call fork() again, to ensure that the daemon can never re-acquire a terminal again.\n\n\nCall exit() in the first child, so that only the second child (the actual daemon process) stays around. This ensures that the daemon process is re-parented to init/PID 1, as all daemons should be.\n\n\nIn the daemon process, connect /dev/null to standard input, output, and error.\n\n\nIn the daemon process, reset the umask to 0, so that the file modes passed to open(), mkdir() and suchlike directly control the access mode of the created files and directories.\n\n\nIn the daemon process, change the current directory to the root directory (/), in order to avoid that the daemon involuntarily blocks mount points from being unmounted.\n\n\nIn the daemon process, write the daemon PID (as returned by getpid()) to a PID file, for example /run/foobar.pid (for a hypothetical daemon “foobar”) to ensure that the daemon cannot be started more than once. This must be implemented in race-free fashion so that the PID file is only updated when it is verified at the same time that the PID previously stored in the PID file no longer exists or belongs to a foreign process.\n\n\nIn the daemon process, drop privileges, if possible and applicable.\n\n\nFrom the daemon process, notify the original process started that initialization is complete. This can be implemented via an unnamed pipe or similar communication channel that is created before the first fork() and hence available in both the original and the daemon process.\n\n\nCall exit() in the original process. The process that invoked the daemon must be able to rely on that this exit() happens after initialization is complete and all external communication channels are established and accessible.\n\n\n\n\nThe discussed library does most of the above-mentioned initialisation steps as it becomes immediately evident that implementation details for some of them heavily dependent on the internal logic of an application itself, so it is not possible to implement them in a universal library. I believe it is not a flaw, though, as the missed parts are safe to implement in an application code.\n\n\n\nThe Library’s Application Programming Interface\n\n\n\nThe generic programming interface was loosely modelled after above-mentioned BSD’s daemon() function. The library provides two user available functions (one is, in fact, implemented on top of the other) as well as a set of flags to control a daemon creation behaviour.\n\n\n\nConclusion\n\n\n\nThe objective of the library is to hide all the trickery of programming a daemon so you could concentrate on the more creative parts of your application. I hope it does this well.\nIf you are not only interested in writing a daemon, but also want to make yourself familiar with the techniques which are used to accomplish that, the source code is available. Moreover, I would advise anyone, who starts developing for a UNIX environment to do that, as it shows many intricacies of programming for these platforms.\n\n\n\n\n##News Roundup\n###EuroBSDCon 2018 travel report and obligatory pics\n\n\nThis was my first big BSD conference. We also planned - planned might be a big word - thought about doing a devsummit on Friday. Since the people who were in charge of that had a change of plans, I was sure it’d go horribly wrong.\nThe day before the devsummit and still in the wrong country, I mentioned the hours and venue on the wiki, and booked a reservation for a restaurant.\nIt turns out that everything was totally fine, and since the devsummit was at the conference venue (that was having tutorials that day), they even had signs pointing at the room we were given. Thanks EuroBSDCon conference organizers!\nAt the devsummit, we spent some time hacking. A few people came with “travel laptops” without access to anything, like Riastradh, so I gave him access to my own laptop. This didn’t hold very long and I kinda forgot about it, but for a few moments he had access to a NetBSD source tree and an 8 thread, 16GB RAM machine with which to build things.\nWe had a short introduction and I suggested we take some pictures, so here’s the ones we got. A few people were concerned about privacy, so they’re not pictured. We had small team to hold the camera :-)\nAt the actual conference days, I stayed at the speaker hotel with the other speakers. I’ve attempted to make conversation with some visibly FreeBSD/OpenBSD people, but didn’t have plans to talk about anything, so there was a lot of just following people silently.\nPerhaps for the next conference I’ll prepare a list of questions to random BSD people and then very obviously grab a piece of paper and ask, “what was…”, read a bit from it, and say, “your latest kernel panic?”, I’m sure it’ll be a great conversation starter.\nAt the conference itself, was pretty cool to have folks like Kirk McKusick give first person accounts of some past events (Kirk gave a talk about governance at FreeBSD), or the second keynote by Ron Broersma.\nMy own talk was hastily prepared, it was difficult to bring the topic together into a coherent talk. Nevertheless, I managed to talk about stuff for a while 40 minutes, though usually I skip over so many details that I have trouble putting together a sufficiently long talk.\nI mentioned some of my coolest bugs to solve (I should probably make a separate article about some!). A few people asked for the slides after the talk, so I guess it wasn’t totally incoherent.\nIt was really fun to meet some of my favourite NetBSD people. I got to show off my now fairly well working laptop (it took a lot of work by all of us!).\nAfter the conference I came back with a conference cold, and it took a few days to recover from it. Hopefully I didn’t infect too many people on the way back.\n\n\n\n\n###GhostBSD tested on real hardware T410 – better than TrueOS?\n\n\nYou might have heard about FreeBSD which is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install and some apps as well!\n\n\n\nNowadays if you want some of that BSD on your personal desktop how to go about? Well there is a full package or distro called GhostBSD which is based on FreeBSD current with a Mate or XFCE desktop preconfigured. I did try another package called TrueOS before and you can check out my blog post as well.\n\n\n\nLet’s give it a try on my Lenovo ThinkPad T410. You can download the latest version from ghostbsd.org. Creating a bootable USB drive was surprisingly difficult as rufus did not work and created a corrupted drive. You have to follow this procedure under Windows: download the 2.5GB .iso file and rename the extension to .img. Download Win32 Disk imager and burn the img file to an USB drive and boot from it. You will be able to start a live session and use the onboard setup to install GhostBSD unto a disk.\n\n\n\nI did encounter some bugs or quirks along the way. The installer failed the first time for some unknown reason but worked on the second attempt. The first boot stopped upon initialization of the USB3 ports (the T410 does not have USB3) but I could use some ‘exit’ command line magic to continue. The second boot worked fine. Audio was only available through headphones, not speakers but that could partially be fixed using the command line again. Lot’s of installed apps did not show up in the start menu and on goes the quirks list.\n\n\n\nOverall it is still better than TrueOS for me because drivers did work very well and I could address most of the existing bugs.\n\n\n\n\nOn the upside:\n\n\nFree and open source FreeBSD package ready to go\n\n\nMate or XFCE desktop (Mate is the only option for daily builds)\n\n\nDrivers work fine including LAN, WiFi, video 2D &amp; 3D, audio, etc\n\n\nUFS or ZFS advanced file systems available\n\n\nSome downsides:\n\n\nLess driver and direct app support than Linux\n\n\nInstaller and desktop have some quirks and bugs\n\n\nApp-store is cumbersome, inferior to TrueOS\n\n\n\n\n\n##Beastie Bits\n\n\nEuroBSDCon 2018 and NetBSD sanitizers\nNew mandoc feature: -T html -O toc\nEuroBSDcon 2018\nPolish BSD User Group\ngarbage[43]: What year is it?\nThe Demo @ 50\nMicrosoft ports DTrace from FreeBSD to Windows 10\nOpenBSD joins Twitter\nNetBSD curses ripoffline improvements\nFCP-0101: Deprecating most 10/100 Ethernet drivers\nAnnouncing the pkgsrc-2018Q3 release\nDebian on OpenBSD vmd (without qemu or another debian system)\nA BSD authentication module for duress passwords (Joshua Stein)\nDisk Price/Performance Analysis\n\n\n\n\n##Feedback/Questions\n\n\nDJ - Zombie ZFS\nJosua - arm tier 1? how to approach it\n-Gamah - 5ghz\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-september-2018/\">FreeBSD Foundation Update, September 2018</a></p>\n\n<ul>\n<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>\n</ul>\n\n<blockquote>\n<p>Dear FreeBSD Community Member, It is hard to believe that September is over. The Foundation team had a busy month promoting FreeBSD all over the globe, bug fixing in preparation for 12.0, and setting plans in motion to kick off our 4th quarter fundraising and advocacy efforts. Take a minute to see what we’ve been up to and please consider making a donation to help us continue our efforts supporting FreeBSD!</p>\n</blockquote>\n\n<ul>\n<li>September 2018 Development Projects Update</li>\n</ul>\n\n<blockquote>\n<p>In preparation for the release of FreeBSD 12.0, I have been working on investigating and fixing a backlog of kernel bug reports.  Of course, this kind of work is never finished, and we will continue to make progress after the release.  In the past couple of months I have fixed a combination of long-standing issues and recent regressions.  Of note are a pair of UNIX domain socket bugs which had been affecting various applications for years.  In particular, Chromium tabs would frequently hang unless a workaround was manually applied to the system, and the bug had started affecting recent versions of Firefox as well.  Fixing these issues gave me an opportunity to revisit and extend our regression testing for UNIX sockets, which, in turn, resulted in some related bugs being identified and fixed.<br>\nOf late I have also been investigating reports of issues with ZFS, particularly, those reported on FreeBSD 11.2.  A number of regressions, including a kernel memory leak and issues with ARC reclamation, have already been fixed for 12.0; investigation of other reports is ongoing. Those who closely follow FreeBSD-CURRENT know that some exciting work to improve memory usage on NUMA systems is now enabled by default.  As is usually the case when new code is deployed in a diverse array of systems and workloads, a number of problems since have been identified. We are working on resolving them as soon as possible to ensure the quality of the release.<br>\nI’m passionate about maintaining FreeBSD’s stability and dependability as it continues to expand and grow new features, and I’m grateful to the FreeBSD Foundation for sponsoring this work.  We depend on users to report problems to the mailing lists and via the bug tracker, so please try running the 12.0 candidate builds and help us make 12.0 a great release.</p>\n</blockquote>\n\n<ul>\n<li>Fundraising Update: Supporting the Project</li>\n</ul>\n\n<blockquote>\n<p>It’s officially Fall here at Foundation headquarters and we’re heading full-steam into our final fundraising campaign of the year. We couldn’t even have begun to reach our funding goal of $1.25 million dollars without the support from the companies who have partnered with us this year. Thank you to Verisign for becoming a Silver Partner. They now join a growing list of companies like Xiplink, NetApp, Microsoft, Tarsnap, VMware, and NeoSmart Technologies that are stepping up and showing their commitment to FreeBSD!<br>\nFunding from commercial users like these and individual users like yourself, help us continue our efforts of supporting critical areas of FreeBSD such as:</p>\n</blockquote>\n\n<ul>\n<li>Operating System Improvements: Providing staff to immediately respond to urgent problems and implement new features and functionality allowing for the innovation and stability you’ve come to rely on.</li>\n<li>Security: Providing engineering resources to bolster the capacity and responsiveness of the Security team providing your users with piece of mind when security issues arise.</li>\n<li>Release Engineering: Continue providing a full-time release engineer, resulting in timely and reliable releases you can plan around.</li>\n<li>Quality Assurance: Improving and increasing test coverage, continuous integration, and automated testing with a full-time software engineer to ensure you receive the highest quality, secure, and reliable operating system.</li>\n<li>New User Experience: Improving the process and documentation for getting new people involved with FreeBSD, and supporting those people as they become integrated into the FreeBSD Community providing the resources you may need to get new folks up to speed.</li>\n<li>Training: Supporting more FreeBSD training for undergraduates, graduates, and postgraduates. Growing the community means reaching people and catching their interest in systems software as early as possible and providing you with a bigger pool of candidates with the FreeBSD skills you’re looking for.</li>\n<li>Face-to-Face Opportunities: Facilitating collaboration among members of the community, and building connections throughout the industry to support a healthy and growing ecosystem and make it easier for you to find resources when questions emerge .</li>\n</ul>\n\n<blockquote>\n<p>We can continue the above work, if we meet our goal this year!<br>\nIf your company uses FreeBSD, please consider joining our growing list of 2018 partners. If you haven’t made your donation yet, please consider donating today. We are indebted to the individual donors, and companies listed above who have already shown their commitment to open source.<br>\nThank you for supporting FreeBSD and the Foundation!</p>\n</blockquote>\n\n<ul>\n<li>September 2018 Release Engineering Update</li>\n</ul>\n\n<blockquote>\n<p>The FreeBSD Release Engineering team continued working on the upcoming 12.0 RELEASE.  At present, the 12.0 schedule had been adjusted by one week to allow for necessary works-in-progress to be completed.<br>\nOf note, one of the works-in-progress includes updating OpenSSL from 1.0.2 to 1.1.1, in order to avoid breaking the application binary interface (ABI) on an established stable branch.<br>\nDue to the level of non-trivial intrusiveness that had already been discovered and addressed in a project branch of the repository, it is possible (but not yet definite) that the schedule will need to be adjusted by another week to allow more time for larger and related updates for this particular update.<br>\nShould the 12.0-RELEASE schedule need to be adjusted at any time during the release cycle, the schedule on the FreeBSD project website will be updated accordingly.  The current schedule is available at:<br>\n<a href=\"https://www.freebsd.org/releases/12.0R/schedule.html\">https://www.freebsd.org/releases/12.0R/schedule.html</a></p>\n</blockquote>\n\n<ul>\n<li>BSDCam 2018 Trip Report: Marie Helene Kvello-Aune</li>\n</ul>\n\n<blockquote>\n<p>I’d like to start by thanking the FreeBSD Foundation for sponsoring my trip to BSDCam(bridge) 2018. I wouldn’t have managed to attend otherwise. I’ve used FreeBSD in both personal and professional deployments since the year 2000, and over the last few years I have become more involved with development and documentation.<br>\nI arrived in Gatwick, London at midnight. On Monday, August 13,  I took the train to Cambridge, and decided to do some touristy activities as I walked from the train station to Churchill College. I ran into Allan outside the hotel right before the sky decided it was time for a heavy rainfall. Monday was mostly spent settling in, recouping after travel, and hanging out with Allan, Brad, Will and Andy later in the afternoon/evening. Read more…</p>\n</blockquote>\n\n<ul>\n<li>Continuous Integration Update</li>\n</ul>\n\n<blockquote>\n<p>The FreeBSD Foundation has sponsored the development of the Project’s continuous integration system, available at <a href=\"https://ci.FreeBSD.org\">https://ci.FreeBSD.org</a>, since June. Over the summer, we improved both the software and hardware infrastructure, and also added some new jobs for extending test coverage of the -CURRENT and -STABLE branches. Following are some highlights.</p>\n</blockquote>\n\n<ul>\n<li>New Hardware</li>\n</ul>\n\n<blockquote>\n<p>The Foundation purchased 4 new build machines for scaling up the computation power for the various test jobs. These newer, faster machines substantially speed up the time it takes to test amd64 builds, so that failing changes can be identified more quickly. Also, in August, we received a donation of 2 PINE A64-LTS boards from <a href=\"http://PINE64.org\">PINE64.org</a>, which will be put in the hardware test lab as one part of the continuous tests.</p>\n</blockquote>\n\n<ul>\n<li>CI Staging Environment</li>\n</ul>\n\n<blockquote>\n<p>We used hardware from a previous generation CI system to build a staging environment for the CI infrastructure, which is available at<br>\n<a href=\"https://ci-dev.freebsd.org\">https://ci-dev.freebsd.org</a>. It executes the configurations and scripts from the “staging” branch of the FreeBSD-CI repository, and the development feature branches. We also use it to experiment with the new version of the jenkins server and plugins. Having a staging environment avoids affecting the production CI environment, reducing downtime.</p>\n</blockquote>\n\n<ul>\n<li>Mail Notification</li>\n</ul>\n\n<blockquote>\n<p>In July, we turned on failure notification for all the kernel and world build jobs. Committers will receive email containing the build information and failure log to inform them of possible problems with their modification on certain architectures. For amd64 of the -CURRENT branch, we also enabled the notification on failing regression test cases. Currently mail is sent only to the individual committers, but with help from postmaster team, we have created a dev-ci mailing list and will soon be also sending notifications there.</p>\n</blockquote>\n\n<ul>\n<li>New Test Job</li>\n</ul>\n\n<blockquote>\n<p>In August, we updated the embedded script of the virtual machine image. Originally it only executed pre-defined tests, but now this behavior can be modified by the data on the attached disk. This mechanism is used for adding new ZFS tests jobs. We are also working on analyzing and fixing the failing and skipped test cases.</p>\n</blockquote>\n\n<ul>\n<li>Work in Progress</li>\n</ul>\n\n<blockquote>\n<p>In August and September, we had two developer summits, one in Cambridge, UK and one in Bucharest, Romania. In these meetings, we discussed running special tests, such as ztest,  which need a longer run time. We also planned the network testing for TCP/IP stack</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://chaoticlab.io/c/c++/unix/2018/10/01/daemonize.html\">Daemonize - a Tiny C Library for Programming the UNIX Daemons</a></p>\n\n<blockquote>\n<p>Whatever they say, writing System-V style UNIX daemons is hard. One has to follow many rules to make a daemon process behave correctly on diverse UNIX flavours. Moreover, debugging such a code might be somewhat tricky. On the other hand, the process of daemon initialisation is rigid and well defined so the corresponding code has to be written and debugged once and later can be reused countless number of times.<br>\nDevelopers of BSD UNIX were very aware of this, as there a C library function daemon() was available starting from version 4.4. The function, although non-standard, is present on many UNIXes. Unfortunately, it does not follow all the required steps to reliably run a process in the background on systems which follow System-V semantics (e.g. Linux). The details are available at the corresponding Linux man page. The main problem here, as I understand it, is that daemon() does not use the double-forking technique to avoid the situation when zombie processes appear.<br>\nWhenever I encounter a problem like this one, I know it is time to write a tiny C library which solves it. This is exactly how ‘daemonize’ was born (GitHub mirror). The library consists of only two files which are meant to be integrated into the source tree of your project. Recently I have updated the library and realised that it would be good to describe how to use it on this site.<br>\nIf for some reason you want to make a Windows service, I have a battle tested template code for you as well.</p>\n</blockquote>\n\n<ul>\n<li>System-V Daemon Initialisation Procedure</li>\n</ul>\n\n<blockquote>\n<p>To make discussion clear we shall quote the steps which have to be performed during a daemon initialisation (according to daemon(7) manual page on Linux). I do it to demonstrate that this task is more tricky than one might expect.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>So, here we go:</p>\n</li>\n<li>\n<p>Close all open file descriptors except standard input, output, and error (i.e. the first three file descriptors 0, 1, 2). This ensures that no accidentally passed file descriptor stays around in the daemon process. On Linux, this is best implemented by iterating through /proc/self/fd, with a fallback of iterating from file descriptor 3 to the value returned by getrlimit() for RLIMIT_NOFILE.</p>\n</li>\n<li>\n<p>Reset all signal handlers to their default. This is best done by iterating through the available signals up to the limit of _NSIG and resetting them to SIG_DFL.</p>\n</li>\n<li>\n<p>Reset the signal mask using sigprocmask().</p>\n</li>\n<li>\n<p>Sanitize the environment block, removing or resetting environment variables that might negatively impact daemon runtime.</p>\n</li>\n<li>\n<p>Call fork(), to create a background process.</p>\n</li>\n<li>\n<p>In the child, call setsid() to detach from any terminal and create an independent session.</p>\n</li>\n<li>\n<p>In the child, call fork() again, to ensure that the daemon can never re-acquire a terminal again.</p>\n</li>\n<li>\n<p>Call exit() in the first child, so that only the second child (the actual daemon process) stays around. This ensures that the daemon process is re-parented to init/PID 1, as all daemons should be.</p>\n</li>\n<li>\n<p>In the daemon process, connect /dev/null to standard input, output, and error.</p>\n</li>\n<li>\n<p>In the daemon process, reset the umask to 0, so that the file modes passed to open(), mkdir() and suchlike directly control the access mode of the created files and directories.</p>\n</li>\n<li>\n<p>In the daemon process, change the current directory to the root directory (/), in order to avoid that the daemon involuntarily blocks mount points from being unmounted.</p>\n</li>\n<li>\n<p>In the daemon process, write the daemon PID (as returned by getpid()) to a PID file, for example /run/foobar.pid (for a hypothetical daemon “foobar”) to ensure that the daemon cannot be started more than once. This must be implemented in race-free fashion so that the PID file is only updated when it is verified at the same time that the PID previously stored in the PID file no longer exists or belongs to a foreign process.</p>\n</li>\n<li>\n<p>In the daemon process, drop privileges, if possible and applicable.</p>\n</li>\n<li>\n<p>From the daemon process, notify the original process started that initialization is complete. This can be implemented via an unnamed pipe or similar communication channel that is created before the first fork() and hence available in both the original and the daemon process.</p>\n</li>\n<li>\n<p>Call exit() in the original process. The process that invoked the daemon must be able to rely on that this exit() happens after initialization is complete and all external communication channels are established and accessible.</p>\n</li>\n</ul>\n\n<blockquote>\n<p>The discussed library does most of the above-mentioned initialisation steps as it becomes immediately evident that implementation details for some of them heavily dependent on the internal logic of an application itself, so it is not possible to implement them in a universal library. I believe it is not a flaw, though, as the missed parts are safe to implement in an application code.</p>\n</blockquote>\n\n<ul>\n<li>The Library’s Application Programming Interface</li>\n</ul>\n\n<blockquote>\n<p>The generic programming interface was loosely modelled after above-mentioned BSD’s daemon() function. The library provides two user available functions (one is, in fact, implemented on top of the other) as well as a set of flags to control a daemon creation behaviour.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>The objective of the library is to hide all the trickery of programming a daemon so you could concentrate on the more creative parts of your application. I hope it does this well.<br>\nIf you are not only interested in writing a daemon, but also want to make yourself familiar with the techniques which are used to accomplish that, the source code is available. Moreover, I would advise anyone, who starts developing for a UNIX environment to do that, as it shows many intricacies of programming for these platforms.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://blog.netbsd.org/tnf/entry/eurobsdcon_2018\">EuroBSDCon 2018 travel report and obligatory pics</a></p>\n\n<blockquote>\n<p>This was my first big BSD conference. We also planned - planned might be a big word - thought about doing a devsummit on Friday. Since the people who were in charge of that had a change of plans, I was sure it’d go horribly wrong.<br>\nThe day before the devsummit and still in the wrong country, I mentioned the hours and venue on the wiki, and booked a reservation for a restaurant.<br>\nIt turns out that everything was totally fine, and since the devsummit was at the conference venue (that was having tutorials that day), they even had signs pointing at the room we were given. Thanks EuroBSDCon conference organizers!<br>\nAt the devsummit, we spent some time hacking. A few people came with “travel laptops” without access to anything, like Riastradh, so I gave him access to my own laptop. This didn’t hold very long and I kinda forgot about it, but for a few moments he had access to a NetBSD source tree and an 8 thread, 16GB RAM machine with which to build things.<br>\nWe had a short introduction and I suggested we take some pictures, so here’s the ones we got. A few people were concerned about privacy, so they’re not pictured. We had small team to hold the camera :-)<br>\nAt the actual conference days, I stayed at the speaker hotel with the other speakers. I’ve attempted to make conversation with some visibly FreeBSD/OpenBSD people, but didn’t have plans to talk about anything, so there was a lot of just following people silently.<br>\nPerhaps for the next conference I’ll prepare a list of questions to random BSD people and then very obviously grab a piece of paper and ask, “what was…”, read a bit from it, and say, “your latest kernel panic?”, I’m sure it’ll be a great conversation starter.<br>\nAt the conference itself, was pretty cool to have folks like Kirk McKusick give first person accounts of some past events (Kirk gave a talk about governance at FreeBSD), or the second keynote by Ron Broersma.<br>\nMy own talk was hastily prepared, it was difficult to bring the topic together into a coherent talk. Nevertheless, I managed to talk about stuff for a while 40 minutes, though usually I skip over so many details that I have trouble putting together a sufficiently long talk.<br>\nI mentioned some of my coolest bugs to solve (I should probably make a separate article about some!). A few people asked for the slides after the talk, so I guess it wasn’t totally incoherent.<br>\nIt was really fun to meet some of my favourite NetBSD people. I got to show off my now fairly well working laptop (it took a lot of work by all of us!).<br>\nAfter the conference I came back with a conference cold, and it took a few days to recover from it. Hopefully I didn’t infect too many people on the way back.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://panoramacircle.com/2018/09/23/ghostbsd-tested-on-real-hardware-t410-better-than-trueos/\">GhostBSD tested on real hardware T410 – better than TrueOS?</a></p>\n\n<blockquote>\n<p>You might have heard about FreeBSD which is ultimately derived from UNIX back in the days. It is not Linux even though it is similar in many ways because Linux was designed to follow UNIX principles. Seeing is believing, so check out the video of the install and some apps as well!</p>\n</blockquote>\n\n<blockquote>\n<p>Nowadays if you want some of that BSD on your personal desktop how to go about? Well there is a full package or distro called GhostBSD which is based on FreeBSD current with a Mate or XFCE desktop preconfigured. I did try another package called TrueOS before and you can check out my blog post as well.</p>\n</blockquote>\n\n<blockquote>\n<p>Let’s give it a try on my Lenovo ThinkPad T410. You can download the latest version from <a href=\"http://ghostbsd.org\">ghostbsd.org</a>. Creating a bootable USB drive was surprisingly difficult as rufus did not work and created a corrupted drive. You have to follow this procedure under Windows: download the 2.5GB .iso file and rename the extension to .img. Download Win32 Disk imager and burn the img file to an USB drive and boot from it. You will be able to start a live session and use the onboard setup to install GhostBSD unto a disk.</p>\n</blockquote>\n\n<blockquote>\n<p>I did encounter some bugs or quirks along the way. The installer failed the first time for some unknown reason but worked on the second attempt. The first boot stopped upon initialization of the USB3 ports (the T410 does not have USB3) but I could use some ‘exit’ command line magic to continue. The second boot worked fine. Audio was only available through headphones, not speakers but that could partially be fixed using the command line again. Lot’s of installed apps did not show up in the start menu and on goes the quirks list.</p>\n</blockquote>\n\n<blockquote>\n<p>Overall it is still better than TrueOS for me because drivers did work very well and I could address most of the existing bugs.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>On the upside:</p>\n</li>\n<li>\n<p>Free and open source FreeBSD package ready to go</p>\n</li>\n<li>\n<p>Mate or XFCE desktop (Mate is the only option for daily builds)</p>\n</li>\n<li>\n<p>Drivers work fine including LAN, WiFi, video 2D &amp; 3D, audio, etc</p>\n</li>\n<li>\n<p>UFS or ZFS advanced file systems available</p>\n</li>\n<li>\n<p>Some downsides:</p>\n</li>\n<li>\n<p>Less driver and direct app support than Linux</p>\n</li>\n<li>\n<p>Installer and desktop have some quirks and bugs</p>\n</li>\n<li>\n<p>App-store is cumbersome, inferior to TrueOS</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/eurobsdcon_2018_and_netbsd_sanitizers\">EuroBSDCon 2018 and NetBSD sanitizers</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20181002175838\">New mandoc feature: -T html -O toc</a></li>\n<li><a href=\"https://www.geeklan.co.uk/?p=2307\">EuroBSDcon 2018</a></li>\n<li><a href=\"https://oshogbo.vexillium.org/blog/55/\">Polish BSD User Group</a></li>\n<li><a href=\"https://garbage.fm/episodes/43\">garbage[43]: What year is it?</a></li>\n<li><a href=\"https://thedemoat50.org/\">The Demo @ 50</a></li>\n<li><a href=\"https://youtu.be/tG8R5SQGPck?t=660\">Microsoft ports DTrace from FreeBSD to Windows 10</a></li>\n<li><a href=\"https://twitter.com/openbsd\">OpenBSD joins Twitter</a></li>\n<li><a href=\"https://roy.marples.name/blog/netbsd-curses-ripoffline-improvements\">NetBSD curses ripoffline improvements</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2018-October/089717.html\">FCP-0101: Deprecating most 10/100 Ethernet drivers</a></li>\n<li><a href=\"https://mail-index.netbsd.org/tech-pkg/2018/10/05/msg020326.html\">Announcing the pkgsrc-2018Q3 release</a></li>\n<li><a href=\"http://www.netzbasis.de/openbsd/vmd-debian/index.html\">Debian on OpenBSD vmd (without qemu or another debian system)</a></li>\n<li><a href=\"https://github.com/jcs/login_duress\">A BSD authentication module for duress passwords (Joshua Stein)</a></li>\n<li><a href=\"https://twitter.com/oshogbovx/status/1019334534935007232?s=03\">Disk Price/Performance Analysis</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>DJ - <a href=\"http://dpaste.com/0YV8WC6#wrap\">Zombie ZFS</a></li>\n<li>Josua - <a href=\"http://dpaste.com/25B1EA8\">arm tier 1? how to approach it</a></li>\n<li>-Gamah - <a href=\"http://dpaste.com/2SMSGPB\">5ghz</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"FreeBSD Foundation September Update, tiny C lib for programming Unix daemons, EuroBSDcon trip reports, GhostBSD tested on real hardware, and a BSD auth module for duress.","date_published":"2018-10-24T05:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/5cd889a3-fdea-4394-a3e4-69aaa37d9ee0.mp3","mime_type":"audio/mp3","size_in_bytes":53176544,"duration_in_seconds":5299}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2721","title":"Episode 268: Netcat Demystified | BSD Now 268","url":"https://www.bsdnow.tv/268","content_text":"6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.\n\n##Headlines\n###Six Metrics for Measuring ZFS Pool Performance Part 1\n\n\nThe layout of a ZFS storage pool has a significant impact on system performance under various workloads. Given the importance of picking the right configuration for your workload and the fact that making changes to an in-use ZFS pool is far from trivial, it is important for an administrator to understand the mechanics of pool performance when designing a storage system.\n\n\n\nTo quantify pool performance, we will consider six primary metrics:\nRead I/O operations per second (IOPS)\nWrite IOPS\nStreaming read speed\nStreaming write speed\nStorage space efficiency (usable capacity after parity versus total raw capacity)\nFault tolerance (maximum number of drives that can fail before data loss)\nFor the sake of comparison, we’ll use an example system with 12 drives, each one sized at 6TB, and say that each drive does 100MB/s streaming reads and writes and can do 250 read and write IOPS. We will visualize how the data is spread across the drives by writing 12 multi-colored blocks, shown below. The blocks are written to the pool starting with the brown block on the left (number one), and working our way to the pink block on the right (number 12).\n\n\n\nNote that when we calculate data rates and IOPS values for the example system, they are only approximations. Many other factors can impact pool access speeds for better (compression, caching) or worse (poor CPU performance, not enough memory).\nThere is no single configuration that maximizes all six metrics. Like so many things in life, our objective is to find an appropriate balance of the metrics to match a target workload. For example, a cold-storage backup system will likely want a pool configuration that emphasizes usable storage space and fault tolerance over the other data-rate focused metrics.\nLet’s start with a quick review of ZFS storage pools before diving into specific configuration options. ZFS storage pools are comprised of one or more virtual devices, or vdevs. Each vdev is comprised of one or more storage providers, typically physical hard disks. All disk-level redundancy is configured at the vdev level. That is, the RAID layout is set on each vdev as opposed to on the storage pool. Data written to the storage pool is then striped across all the vdevs. Because pool data is striped across the vdevs, the loss of any one vdev means total pool failure. This is perhaps the single most important fact to keep in mind when designing a ZFS storage system. We will circle back to this point in the next post, but keep it in mind as we go through the vdev configuration options.\nBecause storage pools are made up of one or more vdevs with the pool data striped over the top, we’ll take a look at pool configuration in terms of various vdev configurations. There are three basic vdev configurations: striping, mirroring, and RAIDZ (which itself has three different varieties). The first section will cover striped and mirrored vdevs in this post; the second post will cover RAIDZ and some example scenarios.\nA striped vdev is the simplest configuration. Each vdev consists of a single disk with no redundancy. When several of these single-disk, striped vdevs are combined into a single storage pool, the total usable storage space would be the sum of all the drives. When you write data to a pool made of striped vdevs, the data is broken into small chunks called “blocks” and distributed across all the disks in the pool. The blocks are written in “round-robin” sequence, meaning after all the disks receive one row of blocks, called a stripe, it loops back around and writes another stripe under the first. A striped pool has excellent performance and storage space efficiency, but absolutely zero fault tolerance. If even a single drive in the pool fails, the entire pool will fail and all data stored on that pool will be lost.\nThe excellent performance of a striped pool comes from the fact that all of the disks can work independently for all read and write operations. If you have a bunch of small read or write operations (IOPS), each disk can work independently to fetch the next block. For streaming reads and writes, each disk can fetch the next block in line synchronized with its neighbors. For example, if a given disk is fetching block n, its neighbor to the left can be fetching block n-1, and its neighbor to the right can be fetching block n+1. Therefore, the speed of all read and write operations as well as the quantity of read and write operations (IOPS) on a striped pool will scale with the number of vdevs. Note here that I said the speeds and IOPS scale with the number of vdevs rather than the number of drives; there’s a reason for this and we’ll cover it in the next post when we discuss RAID-Z.\nHere’s a summary of the total pool performance (where N is the number of disks in the pool):\n\n\n\nN-wide striped:\nRead IOPS: N * Read IOPS of a single drive\nWrite IOPS: N * Write IOPS of a single drive\nStreaming read speed: N * Streaming read speed of a single drive\nStreaming write speed: N * Streaming write speed of a single drive\nStorage space efficiency: 100%\nFault tolerance: None!\n\n\n\nLet’s apply this to our example system, configured with a 12-wide striped pool:\n\n\n\n12-wide striped:\nRead IOPS: 3000\nWrite IOPS: 3000\nStreaming read speed: 1200 MB/s\nStreaming write speed: 1200 MB/s\nStorage space efficiency: 72 TB\nFault tolerance: None!\nBelow is a visual depiction of our 12 rainbow blocks written to this pool configuration:\n\n\n\nThe blocks are simply striped across the 12 disks in the pool. The LBA column on the left stands for “Logical Block Address”. If we treat each disk as a column in an array, each LBA would be a row. It’s also easy to see that if any single disk fails, we would be missing a color in the rainbow and our data would be incomplete. While this configuration has fantastic read and write speeds and can handle a ton of IOPS, the data stored on the pool is very vulnerable. This configuration is not recommended unless you’re comfortable losing all of your pool’s data whenever any single drive fails.\nA mirrored vdev consists of two or more disks. A mirrored vdev stores an exact copy of all the data written to it on each one of its drives. Traditional RAID-1 mirrors usually only support two drive mirrors, but ZFS allows for more drives per mirror to increase redundancy and fault tolerance. All disks in a mirrored vdev have to fail for the vdev, and thus the whole pool, to fail. Total storage space will be equal to the size of a single drive in the vdev. If you’re using mismatched drive sizes in your mirrors, the total size will be that of the smallest drive in the mirror.\nStreaming read speeds and read IOPS on a mirrored vdev will be faster than write speeds and IOPS. When reading from a mirrored vdev, the drives can “divide and conquer” the operations, similar to what we saw above in the striped pool. This is because each drive in the mirror has an identical copy of the data. For write operations, all of the drives need to write a copy of the data, so the mirrored vdev will be limited to the streaming write speed and IOPS of a single disk.\n\n\n\nHere’s a summary:\n\n\n\n\nN-way mirror:\n\n\nRead IOPS: N * Read IOPS of a single drive\n\n\nWrite IOPS: Write IOPS of a single drive\n\n\nStreaming read speed: N * Streaming read speed of a single drive\n\n\nStreaming write speed: Streaming write speed of a single drive\n\n\nStorage space efficiency: 50% for 2-way, 33% for 3-way, 25% for 4-way, etc. [(N-1)/N]\n\n\nFault tolerance: 1 disk per vdev for 2-way, 2 for 3-way, 3 for 4-way, etc. [N-1]\n\n\nFor our first example configuration, let’s do something ridiculous and create a 12-way mirror. ZFS supports this kind of thing, but your management probably will not.\n\n\n1x 12-way mirror:\n\n\nRead IOPS: 3000\n\n\nWrite IOPS: 250\n\n\nStreaming read speed: 1200 MB/s\n\n\nStreaming write speed: 100 MB/s\n\n\nStorage space efficiency: 8.3% (6 TB)\n\n\nFault tolerance: 11\n\n\n\n\nAs we can clearly see from the diagram, every single disk in the vdev gets a full copy of our rainbow data. The chainlink icons between the disk labels in the column headers indicate the disks are part of a single vdev. We can lose up to 11 disks in this vdev and still have a complete rainbow. Of course, the data takes up far too much room on the pool, occupying a full 12 LBAs in the data array.\n\n\n\nObviously, this is far from the best use of 12 drives. Let’s do something a little more practical and configure the pool with the ZFS equivalent of RAID-10. We’ll configure six 2-way mirror vdevs. ZFS will stripe the data across all 6 of the vdevs. We can use the work we did in the striped vdev section to determine how the pool as a whole will behave. Let’s first calculate the performance per vdev, then we can work on the full pool:\n\n\n\n\n1x 2-way mirror:\n\n\nRead IOPS: 500\n\n\nWrite IOPS: 250\n\n\nStreaming read speed: 200 MB/s\n\n\nStreaming write speed: 100 MB/s\n\n\nStorage space efficiency: 50% (6 TB)\n\n\nFault tolerance: 1\n\n\nNow we can pretend we have 6 drives with the performance statistics listed above and run them through our striped vdev performance calculator to get the total pool’s performance:\n\n\n6x 2-way mirror:\n\n\nRead IOPS: 3000\n\n\nWrite IOPS: 1500\n\n\nStreaming read speed: 3000 MB/s\n\n\nStreaming write speed: 1500 MB/s\n\n\nStorage space efficiency: 50% (36 TB)\n\n\nFault tolerance: 1 per vdev, 6 total\n\n\nAgain, we will examine the configuration from a visual perspective:\n\n\n\n\nEach vdev gets a block of data and ZFS writes that data to all of (or in this case, both of) the disks in the mirror. As long as we have at least one functional disk in each vdev, we can retrieve our rainbow. As before, the chain link icons denote the disks are part of a single vdev. This configuration emphasizes performance over raw capacity but doesn’t totally disregard fault tolerance as our striped pool did. It’s a very popular configuration for systems that need a lot of fast I/O. Let’s look at one more example configuration using four 3-way mirrors. We’ll skip the individual vdev performance calculation and go straight to the full pool:\n\n\n\n4x 3-way mirror:\nRead IOPS: 3000\nWrite IOPS: 1000\nStreaming read speed: 3000 MB/s\nStreaming write speed: 400 MB/s\nStorage space efficiency: 33% (24 TB)\nFault tolerance: 2 per vdev, 8 total\n\n\n\nWhile we have sacrificed some write performance and capacity, the pool is now extremely fault tolerant. This configuration is probably not practical for most applications and it would make more sense to use lower fault tolerance and set up an offsite backup system.\nStriped and mirrored vdevs are fantastic for access speed performance, but they either leave you with no redundancy whatsoever or impose at least a 50% penalty on the total usable space of your pool. In the next post, we will cover RAIDZ, which lets you keep data redundancy without sacrificing as much storage space efficiency. We’ll also look at some example workload scenarios and decide which layout would be the best fit for each.\n\n\n\n\n###2FA with ssh on OpenBSD\n\n\nFive years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there’s no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don’t want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines with which you’d like to use it. You could use a bastion—and use only one yubikey—but I don’t like the SPOF aspect of a bastion. YMMV.\nAfter I played with TOTP, I wanted to use them as a 2FA for ssh. At the time of writing, we can’t do that using only the tools in base. This article focuses on OpenBSD; if you use another operating system, here are two handy links.\n\n\n\nSEED CONFIGURATION\n\n\n\nThe first thing we need to do is to install the software which will be used to verify the OTPs we submit.\n\n\n# pkg_add login_oath\n\n\nWe need to create a secret - aka, the seed - that will be used to calculate the Time-based One-Time Passwords. We should make sure no one can read or change it.\n\n\n$ openssl rand -hex 20 &gt; ~/.totp-key\n$ chmod 400 ~/.totp-key\n\n\nNow we have a hexadecimal key, but apps usually want a base32 secret. I initially wrote a small script to do the conversion.\nWhile writing this article, I took the opportunity to improve it. When I initially wrote this utility for my use, python-qrcode hadn’t yet been imported to the OpenBSD ports/packages system. It’s easy to install now, so let’s use it.\nHere’s the improved version. It will ask for the hex key and output the secret as a base32-encoded string, both with and without spacing so you can copy-paste it into your password manager or easily retype it. It will then ask for the information needed to generate a QR code. Adding our new OTP secret to any mobile app using the QR code will be super easy!\n\n\n\nSYSTEM CONFIGURATION\n\n\n\nWe can now move to the configuration of the system to put our new TOTP to use. As you might guess, it’s going to be quite close to what we did with the yubikey.\nWe need to tweak login.conf. Be careful and keep a root shell open at all times. The few times I broke my OpenBSD were because I messed with login.conf without showing enough care.\n\n\n\nSSHD CONFIGURATION\n\n\n\nAgain, keeping a root shell around decreases the risk of losing access to the system and being locked outside.\nA good standard is to use PasswordAuthentication no and to use public key only. Except… have a guess what the P stands for in TOTP. Yes, congrats, you guessed it!\nWe need to switch to PasswordAuthentication yes. However, if we made this change alone, sshd would then accept a public key OR a password (which are TOTP because of our login.conf). 2FA uses both at the same time.\nTo inform sshd we intend to use both, we need to set AuthenticationMethods publickey,password. This way, the user trying to login will first need to perform the traditional publickey authentication. Once that’s done, ssh will prompt for a password and the user will need to submit a valid TOTP for the system.\nWe could do this the other way around, but I think bots could try passwords, wasting resources. Evaluated in this order, failing to provide a public key leads to sshd immediately declining your attempt.\n\n\n\nIMPROVING SECURITY WITHOUT IMPACTING UX\n\n\n\nMy phone has a long enough password that most of the time, I fail to type it correctly on the first try. Of course, if I had to unlock my phone, launch my TOTP app and use my keyboard to enter what I see on my phone’s screen, I would quickly disable 2FA.\nTo find a balance, I have whitelisted certain IP addresses and users. If I connect from a particular IP address or as a specific user, I don’t want to go through 2FA. For some users, I might not even enable 2FA.\nTo sum up, we covered how to create a seed, how to perform a hexadecimal to base32 conversion and how to create a QR code for mobile applications. We configured the login system with login.conf so that ssh authentication uses the TOTP login system, and we told sshd to ask for both the public key and the Time-based One-Time Password. Now you should be all set to use two-factor ssh authentication on OpenBSD!\n\n\n\n\n##News Roundup\n###How ZFS maintains file type information in directories\n\n\nAs an aside in yesterday’s history of file type information being available in Unix directories, I mentioned that it was possible for a filesystem to support this even though its Unix didn’t. By supporting it, I mean that the filesystem maintains this information in its on disk format for directories, even though the rest of the kernel will never ask for it. This is what ZFS does.\nThe easiest way to see that ZFS does this is to use zdb to dump a directory. I’m going to do this on an OmniOS machine, to make it more convincing, and it turns out that this has some interesting results. Since this is OmniOS, we don’t have the convenience of just naming a directory in zdb, so let’s find the root directory of a filesystem, starting from dnode 1 (as seen before).\n\n\n# zdb -dddd fs3-corestaff-01/h/281 1\nDataset [....]\n[...]\nmicrozap: 512 bytes, 4 entries\n[...]\nROOT = 3\n\n# zdb -dddd fs3-corestaff-01/h/281 3\nObject lvl iblk dblk dsize lsize %full type\n3 1 16K 1K 8K 1K 100.00 ZFS directory\n[...]\nmicrozap: 1024 bytes, 8 entries\n\nRESTORED = 4396504 (type: Directory)\nckstst = 12017 (type: not specified)\nckstst3 = 25069 (type: Directory)\n.demo-file = 5832188 (type: Regular File)\n.peergroup = 12590 (type: not specified)\ncks = 5 (type: not specified)\ncksimap1 = 5247832 (type: Directory)\n.diskuse = 12016 (type: not specified)\nckstst2 = 12535 (type: not specified)\n\n\nThis is actually an old filesystem (it dates from Solaris 10 and has been transferred around with ‘zfs send | zfs recv’ since then), but various home directories for real and test users have been created in it over time (you can probably guess which one is the oldest one). Sufficiently old directories and files have no file type information, but more recent ones have this information, including .demo-file, which I made just now so this would have an entry that was a regular file with type information.\nOnce I dug into it, this turned out to be a change introduced (or activated) in ZFS filesystem version 2, which is described in ‘zfs upgrade -v’ as ‘enhanced directory entries’. As an actual change in (Open)Solaris, it dates from mid 2007, although I’m not sure what Solaris release it made it into. The upshot is that if you made your ZFS filesystem any time in the last decade, you’ll have this file type information in your directories.\nHow ZFS stores this file type information is interesting and clever, especially when it comes to backwards compatibility. I’ll start by quoting the comment from zfs_znode.h:\n\n\n/*\n* The directory entry has the type (currently unused on\n* Solaris) in the top 4 bits, and the object number in\n* the low 48 bits. The \"middle\" 12 bits are unused.\n*/\n\n\nIn yesterday’s entry I said that Unix directory entries need to store at least the filename and the inode number of the file. What ZFS is doing here is reusing the 64 bit field used for the ‘inode’ (the ZFS dnode number) to also store the file type, because it knows that object numbers have only a limited range. This also makes old directory entries compatible, by making type 0 (all 4 bits 0) mean ‘not specified’. Since old directory entries only stored the object number and the object number is 48 bits or less, the higher bits are guaranteed to be all zero.\nThe reason this needed a new ZFS filesystem version is now clear. If you tried to read directory entries with file type information on a version of ZFS that didn’t know about them, the old version would likely see crazy (and non-existent) object numbers and nothing would work. In order to even read a ‘file type in directory entries’ filesystem, you need to know to only look at the low 48 bits of the object number field in directory entries.\n\n\n\n\n###Everything old is new again\n\n\nJust because KDE4-era software has been deprecated by the KDE-FreeBSD team in the official ports-repository, doesn’t mean we don’t care for it while we still need to. KDE4 was released on January 11th, 2008 — I still have the T-shirt — which was a very different C++ world than what we now live in. Much of the code pre-dates the availability of C11 — certainly the availability of compilers with C11 support. The language has changed a great deal in those ten years since the original release.\nThe platforms we run KDE code on have, too — FreeBSD 12 is a long way from the FreeBSD 6 or 7 that were current at release (although at the time, I was more into OpenSolaris). In particular, since then the FreeBSD world has switched over to Clang, and FreeBSD current is experimenting with Clang 7. So we’re seeing KDE4-era code being built, and running, on FreeBSD 12 with Clang 7. That’s a platform with a very different idea of what constitutes correct code, than what the code was originally written for. (Not quite as big a difference as Helio’s KDE1 efforts, though)\nSo, while we’re counting down to removing KDE4 from the FreeBSD ports tree, we’re also going through and fixing it to work with Clang 7, which defaults to a newer C++ standard and which is quite picky about some things. Some time in the distant past, when pointers were integers and NULL was zero, there was some confusion about booleans. So there’s lots of code that does list.contains(element) &gt; 0 … this must have been a trick before booleans were a supported type in all our compilers. In any case it breaks with Clang 7, since contains() returns a QBool which converts to a nullptr (when false) which isn’t comparable to the integer 0. Suffice to say I’ve spent more time reading KDE4-era code this month, than in the past two years.\nHowever, work is proceeding apace, so if you really really want to, you can still get your old-school kicks on a new platform. Because we care about packaging things right, even when we want to get rid of it.\n\n\n\n\n###OpenBSD netcat demystified\n\n\nOwing to its versatile functionalities, netcat earns the reputation as “TCP/IP Swiss army knife”. For example, you can create a simple chat app using netcat:\n\n\n\n(1) Open a terminal and input following command:\n\n\n# nc -l 3003\n\n\nThis means a netcat process will listen on 3003 port in this machine (the IP address of current machine is 192.168.35.176).\n\n\n\n(2) Connect aforemontioned netcat process in another machine, and send a greeting:\n\n\n# nc 192.168.35.176 3003\nhello\n\n\nThen in the first machine’s terminal, you will see the “hello” text:\n\n\n# nc -l 3003\nhello\n\n\nA primitive chatroom is built successfully. Very cool! Isn’t it? I think many people can’t wait to explore more features of netcatnow. If you are among them, congratulations! This tutorial may be the correct place for you.\nIn the following parts, I will delve into OpenBSD’s netcatcode to give a detailed anatomy of it. The reason of picking OpenBSD’s netcat rather than others’ is because its code repository is small (~2000 lines of code) and neat. Furthermore, I also hope this little book can assist you learn more socket programming knowledge not just grasping usage of netcat.\nWe’re all set. Let’s go!\n\n\n\n\n##Beastie Bits\n\n\nWhat’s in store for NetBSD 9.0\nNetBSD machines at Open Source Conference 2018 Hiroshima\nnmctl adapted with limited privileges: nmctl-0.6.0\nSubmit Your Work: Check out SCALE 17x and FOSDEM ’19 CFPs\nOpenBSD 6.4 site is up! (with a partial list of new features)\nUsing Alpine to Read Your Email on OpenBSD\n\n\n\n\n##Feedback/Questions\n\n\nMorgan - Send/Receive to Manage Fragmentation?\nRyan - ZFS and mmap\nMarcus - Linux Compat\nBen - Multiple Pools\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.ixsystems.com/blog/zfs-pool-performance-1/\">Six Metrics for Measuring ZFS Pool Performance Part 1</a></p>\n\n<blockquote>\n<p>The layout of a ZFS storage pool has a significant impact on system performance under various workloads. Given the importance of picking the right configuration for your workload and the fact that making changes to an in-use ZFS pool is far from trivial, it is important for an administrator to understand the mechanics of pool performance when designing a storage system.</p>\n</blockquote>\n\n<ul>\n<li>To quantify pool performance, we will consider six primary metrics:</li>\n<li>Read I/O operations per second (IOPS)</li>\n<li>Write IOPS</li>\n<li>Streaming read speed</li>\n<li>Streaming write speed</li>\n<li>Storage space efficiency (usable capacity after parity versus total raw capacity)</li>\n<li>Fault tolerance (maximum number of drives that can fail before data loss)</li>\n<li>For the sake of comparison, we’ll use an example system with 12 drives, each one sized at 6TB, and say that each drive does 100MB/s streaming reads and writes and can do 250 read and write IOPS. We will visualize how the data is spread across the drives by writing 12 multi-colored blocks, shown below. The blocks are written to the pool starting with the brown block on the left (number one), and working our way to the pink block on the right (number 12).</li>\n</ul>\n\n<blockquote>\n<p>Note that when we calculate data rates and IOPS values for the example system, they are only approximations. Many other factors can impact pool access speeds for better (compression, caching) or worse (poor CPU performance, not enough memory).<br>\nThere is no single configuration that maximizes all six metrics. Like so many things in life, our objective is to find an appropriate balance of the metrics to match a target workload. For example, a cold-storage backup system will likely want a pool configuration that emphasizes usable storage space and fault tolerance over the other data-rate focused metrics.<br>\nLet’s start with a quick review of ZFS storage pools before diving into specific configuration options. ZFS storage pools are comprised of one or more virtual devices, or vdevs. Each vdev is comprised of one or more storage providers, typically physical hard disks. All disk-level redundancy is configured at the vdev level. That is, the RAID layout is set on each vdev as opposed to on the storage pool. Data written to the storage pool is then striped across all the vdevs. Because pool data is striped across the vdevs, the loss of any one vdev means total pool failure. This is perhaps the single most important fact to keep in mind when designing a ZFS storage system. We will circle back to this point in the next post, but keep it in mind as we go through the vdev configuration options.<br>\nBecause storage pools are made up of one or more vdevs with the pool data striped over the top, we’ll take a look at pool configuration in terms of various vdev configurations. There are three basic vdev configurations: striping, mirroring, and RAIDZ (which itself has three different varieties). The first section will cover striped and mirrored vdevs in this post; the second post will cover RAIDZ and some example scenarios.<br>\nA striped vdev is the simplest configuration. Each vdev consists of a single disk with no redundancy. When several of these single-disk, striped vdevs are combined into a single storage pool, the total usable storage space would be the sum of all the drives. When you write data to a pool made of striped vdevs, the data is broken into small chunks called “blocks” and distributed across all the disks in the pool. The blocks are written in “round-robin” sequence, meaning after all the disks receive one row of blocks, called a stripe, it loops back around and writes another stripe under the first. A striped pool has excellent performance and storage space efficiency, but absolutely zero fault tolerance. If even a single drive in the pool fails, the entire pool will fail and all data stored on that pool will be lost.<br>\nThe excellent performance of a striped pool comes from the fact that all of the disks can work independently for all read and write operations. If you have a bunch of small read or write operations (IOPS), each disk can work independently to fetch the next block. For streaming reads and writes, each disk can fetch the next block in line synchronized with its neighbors. For example, if a given disk is fetching block n, its neighbor to the left can be fetching block n-1, and its neighbor to the right can be fetching block n+1. Therefore, the speed of all read and write operations as well as the quantity of read and write operations (IOPS) on a striped pool will scale with the number of vdevs. Note here that I said the speeds and IOPS scale with the number of vdevs rather than the number of drives; there’s a reason for this and we’ll cover it in the next post when we discuss RAID-Z.<br>\nHere’s a summary of the total pool performance (where N is the number of disks in the pool):</p>\n</blockquote>\n\n<ul>\n<li>N-wide striped:</li>\n<li>Read IOPS: N * Read IOPS of a single drive</li>\n<li>Write IOPS: N * Write IOPS of a single drive</li>\n<li>Streaming read speed: N * Streaming read speed of a single drive</li>\n<li>Streaming write speed: N * Streaming write speed of a single drive</li>\n<li>Storage space efficiency: 100%</li>\n<li>Fault tolerance: None!</li>\n</ul>\n\n<blockquote>\n<p>Let’s apply this to our example system, configured with a 12-wide striped pool:</p>\n</blockquote>\n\n<ul>\n<li>12-wide striped:</li>\n<li>Read IOPS: 3000</li>\n<li>Write IOPS: 3000</li>\n<li>Streaming read speed: 1200 MB/s</li>\n<li>Streaming write speed: 1200 MB/s</li>\n<li>Storage space efficiency: 72 TB</li>\n<li>Fault tolerance: None!</li>\n<li>Below is a visual depiction of our 12 rainbow blocks written to this pool configuration:</li>\n</ul>\n\n<blockquote>\n<p>The blocks are simply striped across the 12 disks in the pool. The LBA column on the left stands for “Logical Block Address”. If we treat each disk as a column in an array, each LBA would be a row. It’s also easy to see that if any single disk fails, we would be missing a color in the rainbow and our data would be incomplete. While this configuration has fantastic read and write speeds and can handle a ton of IOPS, the data stored on the pool is very vulnerable. This configuration is not recommended unless you’re comfortable losing all of your pool’s data whenever any single drive fails.<br>\nA mirrored vdev consists of two or more disks. A mirrored vdev stores an exact copy of all the data written to it on each one of its drives. Traditional RAID-1 mirrors usually only support two drive mirrors, but ZFS allows for more drives per mirror to increase redundancy and fault tolerance. All disks in a mirrored vdev have to fail for the vdev, and thus the whole pool, to fail. Total storage space will be equal to the size of a single drive in the vdev. If you’re using mismatched drive sizes in your mirrors, the total size will be that of the smallest drive in the mirror.<br>\nStreaming read speeds and read IOPS on a mirrored vdev will be faster than write speeds and IOPS. When reading from a mirrored vdev, the drives can “divide and conquer” the operations, similar to what we saw above in the striped pool. This is because each drive in the mirror has an identical copy of the data. For write operations, all of the drives need to write a copy of the data, so the mirrored vdev will be limited to the streaming write speed and IOPS of a single disk.</p>\n</blockquote>\n\n<blockquote>\n<p>Here’s a summary:</p>\n</blockquote>\n\n<ul>\n<li>\n<p>N-way mirror:</p>\n</li>\n<li>\n<p>Read IOPS: N * Read IOPS of a single drive</p>\n</li>\n<li>\n<p>Write IOPS: Write IOPS of a single drive</p>\n</li>\n<li>\n<p>Streaming read speed: N * Streaming read speed of a single drive</p>\n</li>\n<li>\n<p>Streaming write speed: Streaming write speed of a single drive</p>\n</li>\n<li>\n<p>Storage space efficiency: 50% for 2-way, 33% for 3-way, 25% for 4-way, etc. [(N-1)/N]</p>\n</li>\n<li>\n<p>Fault tolerance: 1 disk per vdev for 2-way, 2 for 3-way, 3 for 4-way, etc. [N-1]</p>\n</li>\n<li>\n<p>For our first example configuration, let’s do something ridiculous and create a 12-way mirror. ZFS supports this kind of thing, but your management probably will not.</p>\n</li>\n<li>\n<p>1x 12-way mirror:</p>\n</li>\n<li>\n<p>Read IOPS: 3000</p>\n</li>\n<li>\n<p>Write IOPS: 250</p>\n</li>\n<li>\n<p>Streaming read speed: 1200 MB/s</p>\n</li>\n<li>\n<p>Streaming write speed: 100 MB/s</p>\n</li>\n<li>\n<p>Storage space efficiency: 8.3% (6 TB)</p>\n</li>\n<li>\n<p>Fault tolerance: 11</p>\n</li>\n</ul>\n\n<blockquote>\n<p>As we can clearly see from the diagram, every single disk in the vdev gets a full copy of our rainbow data. The chainlink icons between the disk labels in the column headers indicate the disks are part of a single vdev. We can lose up to 11 disks in this vdev and still have a complete rainbow. Of course, the data takes up far too much room on the pool, occupying a full 12 LBAs in the data array.</p>\n</blockquote>\n\n<blockquote>\n<p>Obviously, this is far from the best use of 12 drives. Let’s do something a little more practical and configure the pool with the ZFS equivalent of RAID-10. We’ll configure six 2-way mirror vdevs. ZFS will stripe the data across all 6 of the vdevs. We can use the work we did in the striped vdev section to determine how the pool as a whole will behave. Let’s first calculate the performance per vdev, then we can work on the full pool:</p>\n</blockquote>\n\n<ul>\n<li>\n<p>1x 2-way mirror:</p>\n</li>\n<li>\n<p>Read IOPS: 500</p>\n</li>\n<li>\n<p>Write IOPS: 250</p>\n</li>\n<li>\n<p>Streaming read speed: 200 MB/s</p>\n</li>\n<li>\n<p>Streaming write speed: 100 MB/s</p>\n</li>\n<li>\n<p>Storage space efficiency: 50% (6 TB)</p>\n</li>\n<li>\n<p>Fault tolerance: 1</p>\n</li>\n<li>\n<p>Now we can pretend we have 6 drives with the performance statistics listed above and run them through our striped vdev performance calculator to get the total pool’s performance:</p>\n</li>\n<li>\n<p>6x 2-way mirror:</p>\n</li>\n<li>\n<p>Read IOPS: 3000</p>\n</li>\n<li>\n<p>Write IOPS: 1500</p>\n</li>\n<li>\n<p>Streaming read speed: 3000 MB/s</p>\n</li>\n<li>\n<p>Streaming write speed: 1500 MB/s</p>\n</li>\n<li>\n<p>Storage space efficiency: 50% (36 TB)</p>\n</li>\n<li>\n<p>Fault tolerance: 1 per vdev, 6 total</p>\n</li>\n<li>\n<p>Again, we will examine the configuration from a visual perspective:</p>\n</li>\n</ul>\n\n<blockquote>\n<p>Each vdev gets a block of data and ZFS writes that data to all of (or in this case, both of) the disks in the mirror. As long as we have at least one functional disk in each vdev, we can retrieve our rainbow. As before, the chain link icons denote the disks are part of a single vdev. This configuration emphasizes performance over raw capacity but doesn’t totally disregard fault tolerance as our striped pool did. It’s a very popular configuration for systems that need a lot of fast I/O. Let’s look at one more example configuration using four 3-way mirrors. We’ll skip the individual vdev performance calculation and go straight to the full pool:</p>\n</blockquote>\n\n<ul>\n<li>4x 3-way mirror:</li>\n<li>Read IOPS: 3000</li>\n<li>Write IOPS: 1000</li>\n<li>Streaming read speed: 3000 MB/s</li>\n<li>Streaming write speed: 400 MB/s</li>\n<li>Storage space efficiency: 33% (24 TB)</li>\n<li>Fault tolerance: 2 per vdev, 8 total</li>\n</ul>\n\n<blockquote>\n<p>While we have sacrificed some write performance and capacity, the pool is now extremely fault tolerant. This configuration is probably not practical for most applications and it would make more sense to use lower fault tolerance and set up an offsite backup system.<br>\nStriped and mirrored vdevs are fantastic for access speed performance, but they either leave you with no redundancy whatsoever or impose at least a 50% penalty on the total usable space of your pool. In the next post, we will cover RAIDZ, which lets you keep data redundancy without sacrificing as much storage space efficiency. We’ll also look at some example workload scenarios and decide which layout would be the best fit for each.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://chown.me/blog/2FA-with-ssh-on-OpenBSD.html\">2FA with ssh on OpenBSD</a></p>\n\n<blockquote>\n<p>Five years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there’s no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don’t want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines with which you’d like to use it. You could use a bastion—and use only one yubikey—but I don’t like the SPOF aspect of a bastion. YMMV.<br>\nAfter I played with TOTP, I wanted to use them as a 2FA for ssh. At the time of writing, we can’t do that using only the tools in base. This article focuses on OpenBSD; if you use another operating system, here are two handy links.</p>\n</blockquote>\n\n<ul>\n<li>SEED CONFIGURATION</li>\n</ul>\n\n<blockquote>\n<p>The first thing we need to do is to install the software which will be used to verify the OTPs we submit.</p>\n</blockquote>\n\n<p><code># pkg_add login_oath</code></p>\n\n<blockquote>\n<p>We need to create a secret - aka, the seed - that will be used to calculate the Time-based One-Time Passwords. We should make sure no one can read or change it.</p>\n</blockquote>\n\n<p><code>$ openssl rand -hex 20 &gt; ~/.totp-key</code><br>\n<code>$ chmod 400 ~/.totp-key</code></p>\n\n<blockquote>\n<p>Now we have a hexadecimal key, but apps usually want a base32 secret. I initially wrote a small script to do the conversion.<br>\nWhile writing this article, I took the opportunity to improve it. When I initially wrote this utility for my use, python-qrcode hadn’t yet been imported to the OpenBSD ports/packages system. It’s easy to install now, so let’s use it.<br>\nHere’s the improved version. It will ask for the hex key and output the secret as a base32-encoded string, both with and without spacing so you can copy-paste it into your password manager or easily retype it. It will then ask for the information needed to generate a QR code. Adding our new OTP secret to any mobile app using the QR code will be super easy!</p>\n</blockquote>\n\n<ul>\n<li>SYSTEM CONFIGURATION</li>\n</ul>\n\n<blockquote>\n<p>We can now move to the configuration of the system to put our new TOTP to use. As you might guess, it’s going to be quite close to what we did with the yubikey.<br>\nWe need to tweak login.conf. Be careful and keep a root shell open at all times. The few times I broke my OpenBSD were because I messed with login.conf without showing enough care.</p>\n</blockquote>\n\n<ul>\n<li>SSHD CONFIGURATION</li>\n</ul>\n\n<blockquote>\n<p>Again, keeping a root shell around decreases the risk of losing access to the system and being locked outside.<br>\nA good standard is to use PasswordAuthentication no and to use public key only. Except… have a guess what the P stands for in TOTP. Yes, congrats, you guessed it!<br>\nWe need to switch to PasswordAuthentication yes. However, if we made this change alone, sshd would then accept a public key OR a password (which are TOTP because of our login.conf). 2FA uses both at the same time.<br>\nTo inform sshd we intend to use both, we need to set AuthenticationMethods publickey,password. This way, the user trying to login will first need to perform the traditional publickey authentication. Once that’s done, ssh will prompt for a password and the user will need to submit a valid TOTP for the system.<br>\nWe could do this the other way around, but I think bots could try passwords, wasting resources. Evaluated in this order, failing to provide a public key leads to sshd immediately declining your attempt.</p>\n</blockquote>\n\n<ul>\n<li>IMPROVING SECURITY WITHOUT IMPACTING UX</li>\n</ul>\n\n<blockquote>\n<p>My phone has a long enough password that most of the time, I fail to type it correctly on the first try. Of course, if I had to unlock my phone, launch my TOTP app and use my keyboard to enter what I see on my phone’s screen, I would quickly disable 2FA.<br>\nTo find a balance, I have whitelisted certain IP addresses and users. If I connect from a particular IP address or as a specific user, I don’t want to go through 2FA. For some users, I might not even enable 2FA.<br>\nTo sum up, we covered how to create a seed, how to perform a hexadecimal to base32 conversion and how to create a QR code for mobile applications. We configured the login system with login.conf so that ssh authentication uses the TOTP login system, and we told sshd to ask for both the public key and the Time-based One-Time Password. Now you should be all set to use two-factor ssh authentication on OpenBSD!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSAndDirectoryDType\">How ZFS maintains file type information in directories</a></p>\n\n<blockquote>\n<p>As an aside in yesterday’s history of file type information being available in Unix directories, I mentioned that it was possible for a filesystem to support this even though its Unix didn’t. By supporting it, I mean that the filesystem maintains this information in its on disk format for directories, even though the rest of the kernel will never ask for it. This is what ZFS does.<br>\nThe easiest way to see that ZFS does this is to use zdb to dump a directory. I’m going to do this on an OmniOS machine, to make it more convincing, and it turns out that this has some interesting results. Since this is OmniOS, we don’t have the convenience of just naming a directory in zdb, so let’s find the root directory of a filesystem, starting from dnode 1 (as seen before).</p>\n</blockquote>\n\n<p><code># zdb -dddd fs3-corestaff-01/h/281 1</code><br>\n<code>Dataset [....]</code><br>\n<code>[...]</code><br>\n<code>microzap: 512 bytes, 4 entries</code><br>\n<code>[...]</code><br>\n<code>ROOT = 3</code><br>\n<code></code><br>\n<code># zdb -dddd fs3-corestaff-01/h/281 3</code><br>\n<code>Object lvl iblk dblk dsize lsize %full type</code><br>\n<code>3 1 16K 1K 8K 1K 100.00 ZFS directory</code><br>\n<code>[...]</code><br>\n<code>microzap: 1024 bytes, 8 entries</code><br>\n<code></code><br>\n<code>RESTORED = 4396504 (type: Directory)</code><br>\n<code>ckstst = 12017 (type: not specified)</code><br>\n<code>ckstst3 = 25069 (type: Directory)</code><br>\n<code>.demo-file = 5832188 (type: Regular File)</code><br>\n<code>.peergroup = 12590 (type: not specified)</code><br>\n<code>cks = 5 (type: not specified)</code><br>\n<code>cksimap1 = 5247832 (type: Directory)</code><br>\n<code>.diskuse = 12016 (type: not specified)</code><br>\n<code>ckstst2 = 12535 (type: not specified)</code></p>\n\n<blockquote>\n<p>This is actually an old filesystem (it dates from Solaris 10 and has been transferred around with ‘zfs send | zfs recv’ since then), but various home directories for real and test users have been created in it over time (you can probably guess which one is the oldest one). Sufficiently old directories and files have no file type information, but more recent ones have this information, including .demo-file, which I made just now so this would have an entry that was a regular file with type information.<br>\nOnce I dug into it, this turned out to be a change introduced (or activated) in ZFS filesystem version 2, which is described in ‘zfs upgrade -v’ as ‘enhanced directory entries’. As an actual change in (Open)Solaris, it dates from mid 2007, although I’m not sure what Solaris release it made it into. The upshot is that if you made your ZFS filesystem any time in the last decade, you’ll have this file type information in your directories.<br>\nHow ZFS stores this file type information is interesting and clever, especially when it comes to backwards compatibility. I’ll start by quoting the comment from zfs_znode.h:</p>\n</blockquote>\n\n<p><code>/*</code><br>\n<code>* The directory entry has the type (currently unused on</code><br>\n<code>* Solaris) in the top 4 bits, and the object number in</code><br>\n<code>* the low 48 bits. The &quot;middle&quot; 12 bits are unused.</code><br>\n<code>*/</code></p>\n\n<blockquote>\n<p>In yesterday’s entry I said that Unix directory entries need to store at least the filename and the inode number of the file. What ZFS is doing here is reusing the 64 bit field used for the ‘inode’ (the ZFS dnode number) to also store the file type, because it knows that object numbers have only a limited range. This also makes old directory entries compatible, by making type 0 (all 4 bits 0) mean ‘not specified’. Since old directory entries only stored the object number and the object number is 48 bits or less, the higher bits are guaranteed to be all zero.<br>\nThe reason this needed a new ZFS filesystem version is now clear. If you tried to read directory entries with file type information on a version of ZFS that didn’t know about them, the old version would likely see crazy (and non-existent) object numbers and nothing would work. In order to even read a ‘file type in directory entries’ filesystem, you need to know to only look at the low 48 bits of the object number field in directory entries.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://euroquis.nl/bobulate/?p=1976\">Everything old is new again</a></p>\n\n<blockquote>\n<p>Just because KDE4-era software has been deprecated by the KDE-FreeBSD team in the official ports-repository, doesn’t mean we don’t care for it while we still need to. KDE4 was released on January 11th, 2008 — I still have the T-shirt — which was a very different C++ world than what we now live in. Much of the code pre-dates the availability of C<ins>11 — certainly the availability of compilers with C</ins>11 support. The language has changed a great deal in those ten years since the original release.<br>\nThe platforms we run KDE code on have, too — FreeBSD 12 is a long way from the FreeBSD 6 or 7 that were current at release (although at the time, I was more into OpenSolaris). In particular, since then the FreeBSD world has switched over to Clang, and FreeBSD current is experimenting with Clang 7. So we’re seeing KDE4-era code being built, and running, on FreeBSD 12 with Clang 7. That’s a platform with a very different idea of what constitutes correct code, than what the code was originally written for. (Not quite as big a difference as Helio’s KDE1 efforts, though)<br>\nSo, while we’re counting down to removing KDE4 from the FreeBSD ports tree, we’re also going through and fixing it to work with Clang 7, which defaults to a newer C++ standard and which is quite picky about some things. Some time in the distant past, when pointers were integers and NULL was zero, there was some confusion about booleans. So there’s lots of code that does list.contains(element) &gt; 0 … this must have been a trick before booleans were a supported type in all our compilers. In any case it breaks with Clang 7, since contains() returns a QBool which converts to a nullptr (when false) which isn’t comparable to the integer 0. Suffice to say I’ve spent more time reading KDE4-era code this month, than in the past two years.<br>\nHowever, work is proceeding apace, so if you really really want to, you can still get your old-school kicks on a new platform. Because we care about packaging things right, even when we want to get rid of it.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://nanxiao.gitbooks.io/openbsd-netcat-demystified/\">OpenBSD netcat demystified</a></p>\n\n<blockquote>\n<p>Owing to its versatile functionalities, netcat earns the reputation as “TCP/IP Swiss army knife”. For example, you can create a simple chat app using netcat:</p>\n</blockquote>\n\n<ul>\n<li>(1) Open a terminal and input following command:</li>\n</ul>\n\n<p><code># nc -l 3003</code></p>\n\n<blockquote>\n<p>This means a netcat process will listen on 3003 port in this machine (the IP address of current machine is 192.168.35.176).</p>\n</blockquote>\n\n<ul>\n<li>(2) Connect aforemontioned netcat process in another machine, and send a greeting:</li>\n</ul>\n\n<p><code># nc 192.168.35.176 3003</code><br>\n<code>hello</code></p>\n\n<blockquote>\n<p>Then in the first machine’s terminal, you will see the “hello” text:</p>\n</blockquote>\n\n<p><code># nc -l 3003</code><br>\n<code>hello</code></p>\n\n<blockquote>\n<p>A primitive chatroom is built successfully. Very cool! Isn’t it? I think many people can’t wait to explore more features of netcatnow. If you are among them, congratulations! This tutorial may be the correct place for you.<br>\nIn the following parts, I will delve into OpenBSD’s netcatcode to give a detailed anatomy of it. The reason of picking OpenBSD’s netcat rather than others’ is because its code repository is small (~2000 lines of code) and neat. Furthermore, I also hope this little book can assist you learn more socket programming knowledge not just grasping usage of netcat.<br>\nWe’re all set. Let’s go!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.geeklan.co.uk/files/eurobsdcon2018.pdf\">What’s in store for NetBSD 9.0</a></li>\n<li><a href=\"https://mail-index.netbsd.org/netbsd-advocacy/2018/09/25/msg000783.html\">NetBSD machines at Open Source Conference 2018 Hiroshima</a></li>\n<li><a href=\"http://vincentdelft.be/post/post_20180922\">nmctl adapted with limited privileges: nmctl-0.6.0</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/submit-your-work-check-out-scale-17x-and-fosdem-19-cfps/\">Submit Your Work: Check out SCALE 17x and FOSDEM ’19 CFPs</a></li>\n<li><a href=\"https://www.openbsd.org/64.html\">OpenBSD 6.4 site is up! (with a partial list of new features)</a></li>\n<li><a href=\"https://www.blackcatenterprises.us/using-alpine-to-read-your-email/\">Using Alpine to Read Your Email on OpenBSD</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Morgan - <a href=\"http://dpaste.com/0EXPWQK#wrap\">Send/Receive to Manage Fragmentation?</a></li>\n<li>Ryan - <a href=\"http://dpaste.com/0B6C0Y0\">ZFS and mmap</a></li>\n<li>Marcus - <a href=\"http://dpaste.com/1DT26S8#wrap\">Linux Compat</a></li>\n<li>Ben - <a href=\"http://dpaste.com/20GTHZE#wrap\">Multiple Pools</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"6 metrics for zpool performance, 2FA with ssh on OpenBSD, ZFS maintaining file type information in dirs, everything old is new again, netcat demystified, and more.","date_published":"2018-10-17T01:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/78b4306b-b0ac-4221-b4f4-60d2bde9628e.mp3","mime_type":"audio/mp3","size_in_bytes":40587288,"duration_in_seconds":4040}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2689","title":"Episode 267: Absolute FreeBSD | BSD Now 267","url":"https://www.bsdnow.tv/267","content_text":"We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.\n\n##Headlines\n##Interview - Michael W. Lucas - mwlucas@michaelwlucas.com / @mwlauthor\n\n\nBR: [Welcome Back]\nAJ: What have you been doing since last we talked to you [ed, ssh, and af3e]\nBR: Tell us more about AF3e\nAJ: How did the first Absolute FreeBSD come about?\nBR: Do you have anything special planned for MeetBSD?\nAJ: What are you working on now? [FM:Jails, Git sync Murder]\nBR: What are your plans for next year?\nAJ: How has SEMIBug been going?\n\n\nAuction at https://mwl.io\nPatreon Link:\n\n\n\n##Feedback/Questions\n\n\nPaul - Recent bhyve related videos (daemon)\nMichael - freebsd-update question\nSigflup - pkg file search\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.</p>\n\n<p>##Headlines<br>\n##Interview - Michael W. Lucas - <a href=\"mailto:mwlucas@michaelwlucas.com\">mwlucas@michaelwlucas.com</a> / <a href=\"https://twitter.com/mwlauthor\">@mwlauthor</a></p>\n\n<ul>\n<li>BR: [Welcome Back]</li>\n<li>AJ: What have you been doing since last we talked to you [ed, ssh, and af3e]</li>\n<li>BR: Tell us more about AF3e</li>\n<li>AJ: How did the first Absolute FreeBSD come about?</li>\n<li>BR: Do you have anything special planned for MeetBSD?</li>\n<li>AJ: What are you working on now? [FM:Jails, Git sync Murder]</li>\n<li>BR: What are your plans for next year?</li>\n<li>AJ: How has SEMIBug been going?</li>\n</ul>\n\n<p>Auction at <a href=\"https://mwl.io\">https://mwl.io</a><br>\nPatreon Link:</p>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Paul - <a href=\"http://dpaste.com/0Q6C25T#wrap\">Recent bhyve related videos (daemon)</a></li>\n<li>Michael - <a href=\"http://dpaste.com/1YTR9FZ\">freebsd-update question</a></li>\n<li>Sigflup - <a href=\"http://dpaste.com/3799BBX#wrap\">pkg file search</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.","date_published":"2018-10-10T06:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/065b608e-9204-46f2-a689-63ccf08c58a2.mp3","mime_type":"audio/mp3","size_in_bytes":40763471,"duration_in_seconds":4058}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2661","title":"Episode 266: File Type History | BSD Now 266","url":"https://www.bsdnow.tv/266","content_text":"Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.\n\n##Headlines\n###OpenBSD/NetBSD on FreeBSD using grub2-bhyve\n\n\nWhen I was writing a blog post about the process title, I needed a couple of virtual machines with OpenBSD, NetBSD, and Ubuntu. Before that day I mainly used FreeBSD and Windows with bhyve. I spent some time trying to set up an OpenBSD using bhyve and UEFI as described here. I had numerous problems trying to use it, and this was the day I discovered the grub2-bhyve tool, and I love it!\nThe grub2-bhyve allows you to load a kernel using GRUB bootloader. GRUB supports most of the operating systems with a standard configuration, so exactly the same method can be used to install NetBSD or Ubuntu. First, let’s install grub2-bhyve on our FreeBSD box:\n\n\n# pkg install grub2-bhyve\n\n\nTo run grub2-bhyve we need to provide at least the name of the VM. In bhyve, if the memsize is not specified the default VM is created with 256MB of the memory.\n\n\n# grub-bhyve test\nGNU GRUB version 2.00\nMinimal BASH-like line editing is supported. For the first word, TAB lists possible command\ncompletions. Anywhere else TAB lists possible device or file completions.\n\n\ngrub&gt;\n\n\nAfter running grub-bhyve command we will enter the GRUB loader. If we type the ls command, we will see all the available devices. In the case of the grub2-bhyve there is one additional device called “(host)” that is always available and allows the host filesystem to be accessed. We can list files under that device.\n\n\ngrub&gt; ls\n(host)\ngrub&gt; ls (host)/\nlibexec/ bin/ usr/ bhyve/ compat/ tank/ etc/ boot/ net/ entropy proc/ lib/ root/ sys/ mnt/ rescue/ tmp/ home/ sbin/ media/ jail/ COPYRIGHT var/ dev/\ngrub&gt;\n\n\nTo exit console simply type ‘reboot’. I would like to install my new operating system under a ZVOL ztank/bhyve/post. On another terminal, we create:\n\n\n# zfs create -V 10G ztank/bhyve/post\n\n\nIf you don’t use ZFS for some crazy reason you can also create a raw blob using the truncate(1) command.\n\n\n# truncate -s 10G post.img\n\n\nI recommend installing an operating system from the disk image (installXX.fs for OpenBSD and NetBSD-X.X-amd64-install.img for NetBSD). Now we need to create a device map for a GRUB.\n\n\ncat &gt; /tmp/post.map &lt;&lt; EOF\n(hd0) /directory/to/disk/image\n(hd1) /dev/zvol/ztank/bhyve/post\nEOF\n\n\nThe mapping files describe the names for files in the GRUB. In our case under hd0 we will have an installation image and in hd1 we will have our ZVOL/blob. You can also try to use an ISO image then instead of using hd0 device name use a cd0. When we will run the grub-bhyve command we will see two additional devices.\n\n\n# grub-bhyve -m /tmp/post.map post\ngrub&gt; ls\n(hd0) (hd0,msdos4) (hd0,msdos1) (hd0,openbsd9) (hd0,openbsd1) (hd1) (host)\n\n\nThe hd0 (in this example OpenBSD image) contains multiple partitions. We can check what is on it.\n\n\ngrub&gt; ls (hd0,msdos4)/\nboot bsd 6.4/ etc/\n\n\nAnd this is the partition that contains a kernel. Now we can set a root device, load an OpenBSD kernel and boot:\n\n\ngrub&gt; set root=(hd0,msdos4)\ngrub&gt; kopenbsd -h com0 -r sd0a /bsd\ngrub&gt; boot\n\n\nAfter that, we can run bhyve virtual machine. In my case it is:\n\n\n# bhyve -c 1 -w -u -H \\\n-s 0,amd_hostbridge \\\n-s 3,ahci-hd,/directory/to/disk/image \\\n-s 4,ahci-hd,/dev/zvol/ztank/bhyve/post \\\n-s 31,lpc -l com1,stdio \\\npost\n\n\nUnfortunately explaining the whole bhyve(8)  command line is beyond this article. After installing the operating system remove hd0 from the mapping file and the image from the bhyve(8) command. If you don’t want to type all those GRUB commands, you can simply redirect them to the standard input.\n\n\ncat &lt;&lt; EOF | grub-bhyve -m /tmp/post.map -M 512 post\nset root=(hd0,4)\nkopenbsd -h com0 -r sd0a /bsd\nboot\nEOF\n\n\n\n###My FreeBSD Story\n\n\nMy first devices/computers/consoles (not at the same time) that I remember were Atari 2600 and Pegasus console which was hardware clone of the Nintendo NES.\nBack then I did not even knew that it was Atari 2600 as I referred to it as Video Computer System … and I did not even knew any english by then. It took me about two decades to get to know (by accident) that this Video Computer System was Atari 2600\nThen I got AMIGA 600 computer (or should I say my parents bought it for me) which served both for playing computer games and also other activities for the first time. AMIGA is the computer that had the greatest influence on me, as it was the first time I studied the books about Amiga Workbench operating system and learned commands from Amiga Shell terminal. I loved the idea of Ram Disk icon/directory on the desktop that allowed me to transparently put any things in system memory. I still miss that concept on today’s desktop systems … and I still remember how dismal I was when I watched Amiga Deathbed Vigil movie.\nAt the end of 1998 I got my first PC that of course came with Windows and that computer served both as gaming machine and as well as typical tool. One time I dig into the internals with Windows Registry (which left me disgusted by its concepts and implementation) and its limited command line interface provided by CMD.EXE executable. I remember that the heart of this box was not the CPU or the motherboard but the graphics accelerator – the legendary 3Dfx Voodoo card. This company (3Dfx) – their attitude and philosophy – also left solid fingerprint on my way. Like AMIGA did.\nAfter ‘migration’ from AMIGA to PC it never again ‘felt right’. The games were cool but the Windows system was horrible. Time has passed and different Windows versions and hardware modifications took place. Windows XP felt really heavy at that time, not to mention Windows 2000 for example with even bigger hardware requirements. I also do not understand all the hate about Windows ME. It crashed with the same frequency as Windows 98 or later Windows 98 Second Edition but maybe my hardware was different ??\nI do not have any ‘mine’ screenshots from that period as I lost all my 40 GB (huge then) drive of data when I moved/resized the partition with Partition Magic to get some more space from the less filled C: drive. That day I learned hard that “there are people who do backups and people who will do backups”. I never lost data again as I had multiple copies of my data, but the same as Netheril fall the lost data was was gone forever.\nI always followed various alternatives which led me to try Linux in 2003, after reading about various distributions philosophies I decided to run Slackware Linux with KDE 3. My buddy used Aurox Linux by then (one of the few Linux distributions from Poland) and encouraged me to do the same – especially in the context of fixing possible problems as he already knew it and also as he recently dumped Windows system. But Slackware sounded like a better idea so I took that path instead. At first I dual booted between Windows XP and Slackware Linux cause I had everything worked out on the Windows world while I often felt helpless in the Linux world, so I would reboot into Windows to play some games or find a solution for Linux problem if that was required. I remember how strange the concept of dual clipboards (PRIMARY and SECONDARY) was for me by then. I was amazed why ‘so much better’ system as Linux (at least marketed that way) needs a system tray program to literally manage the clipboard. On Windows it was obvious, you do [CTRL]+[C] to copy and [CTRL]+[V] to paste things, but on Linux there (no I know its X11 feature) there were two clipboards that were synchronized by this little system tray program from KDE 3. It was also unthinkable for me that I will ‘lost’ contents of last/recent [CTRL]+[C] operation if I close the application from which the copy was made. I settled down a little on Slackware but not for long. I really did not liked manual dependency management for packages for example. Also KDE 3 was really ugly and despite trying all possible options I was not able to tweak it into something nice looking.\nAfter half a year on Slackware I checked the Linux distributions again and decided to try Gentoo Linux. I definitely agree with the image below which visualizes Gentoo Linux experience, especially when You install it for he first time ??\nOf course I went with the most hardcore version with self building Stage 1 (compiler and toolchain) which was horrible idea at that time because compilation on slow single core machine took forever … but after many hours I got Gentoo installed. I now have to decide which desktop environment to use. I have read a lot of good news about Fluxbox at that time so this is what I tried. It was very weird experience (to create everything in GUI from scratch) but very pleasant one. That recalled me the times of AMIGA … but Linux came in the way too much often. The more I dig into Gentoo Linux the more I read that lots of Gentoo features are based on FreeBSD solutions. Gentoo Portage is a clone of FreeBSD Ports. That ‘central’ /etc/rc.conf system configuration file concept was taken from FreeBSD as well. So I started to gather information about FreeBSD. The (then) FreeBSD website or FreeBSD Ports site (still) felt little outdated to say the least but that did not discouraged me.\nSomewhere in 2005 I installed FreeBSD 5.4 on my computer. The beginnings were hard, like the earlier step with Gentoo but similarly like Gentoo the FreeBSD project came with a lot of great documentation. While Gentoo documentation is concentrated within various Gentoo Wiki sites the FreeBSD project comes with ‘official’ documentation in the form of Handbook and FAQ. I remember my first questions at the now nonexistent BSDForums.org site – for example one of the first ones – how to scroll the terminal output in the plain console. I now know that I had to push Scroll Lock button but it was something totally new for me.\nWhy FreeBSD and not OpenBSD or NetBSD? Probably because Gentoo based most their concepts on the FreeBSD solutions, so that led me to FreeBSD instead of the other BSD operating systems. Currently I still use FreeBSD but I keep an steady eye on the OpenBSD, HardenedBSD and DragonFly BSD solutions and improvements.\nAs the migration path from Linux to FreeBSD is a lot easier – all configuration files from /home can be just copied – the migration was quite fast easy. I again had the Fluxbox configuration which I used on the Gentoo. Now – on FreeBSD – it started to fell even more like AMIGA times. Everything is/has been well thought and had its place and reason. The documentation was good and the FreeBSD Community was second to none.\nAfter 15 years of using various Windows, UNIX (macOS/AIX/HP-UX/Solaris/OpenSolaris/Illumos/FreeBSD/OpenBSD/NetBSD) and UNIX-like (Linux) systems I always come to conclusion that FreeBSD is the system that sucks least. And sucks least with each release and one day I will write why FreeBSD is such great operating system … if I already haven’t\n\n\n\n\n##News Roundup\n###OpenBSD on the Desktop: some thoughts\n\n\nI’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.\nThe OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative. You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI. That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS. Their development process is purely based on developers that love to contribute and hack around, just because it’s fun. Even the mailing list is a cool place to hang on! Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.\nI like the idea of a platform that continually evolves. pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.\nI like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.\nJust install a browser and you’re ready to go.\nManual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares. They help you understand inner workings of the operating system, no internet connection needed. There are some trade-offs, too.\nPerformance is not first-class, mostly because of all the security mitigations and checks done at runtime.\nI write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference. Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems. But again, trade-offs.\nTo use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.\n\n\n\n\n###The history of file type information being available in Unix directories\n\n\nThe two things that Unix directory entries absolutely have to have are the name of the directory entry and its ‘inode’, by which we generically mean some stable kernel identifier for the file that will persist if it gets renamed, linked to other directories, and so on. Unsurprisingly, directory entries have had these since the days when you read the raw bytes of directories with read(), and for a long time that was all they had; if you wanted more than the name and the inode number, you had to stat() the file, not just read the directory. Then, well, I’ll quote myself from an old entry on a find optimization:\n[…], Unix filesystem developers realized that it was very common for programs reading directories to need to know a bit more about directory entries than just their names, especially their file types (find is the obvious case, but also consider things like ‘ls -F’). Given that the type of an active inode never changes, it’s possible to embed this information straight in the directory entry and then return this to user level, and that’s what developers did; on some systems, readdir(3) will now return directory entries with an additional d_type field that has the directory entry’s type.\nOn Twitter, I recently grumbled about Illumos not having this d_type field. The ensuing conversation wound up with me curious about exactly where d_type came from and how far back it went. The answer turns out to be a bit surprising due to there being two sides of d_type.\nOn the kernel side, d_type appears to have shown up in 4.4 BSD. The 4.4 BSD /usr/src/sys/dirent.h has a struct dirent that has a d_type field, but the field isn’t documented in either the comments in the file or in the getdirentries(2) manpage; both of those admit only to the traditional BSD dirent fields. This 4.4 BSD d_type was carried through to things that inherited from 4.4 BSD (Lite), specifically FreeBSD, but it continued to be undocumented for at least a while.\n(In FreeBSD, the most convenient history I can find is here, and the d_type field is present in sys/dirent.h as far back as FreeBSD 2.0, which seems to be as far as the repo goes for releases.)\nDocumentation for d_type appeared in the getdirentries(2) manpage in FreeBSD 2.2.0, where the manpage itself claims to have been updated on May 3rd 1995 (cf). In FreeBSD, this appears to have been part of merging 4.4 BSD ‘Lite2’, which seems to have been done in 1997. I stumbled over a repo of UCB BSD commit history, and in it the documentation appears in this May 3rd 1995 change, which at least has the same date. It appears that FreeBSD 2.2.0 was released some time in 1997, which is when this would have appeared in an official release.\nIn Linux, it seems that a dirent structure with a d_type member appeared only just before 2.4.0, which was released at the start of 2001. Linux took this long because the d_type field only appeared in the 64-bit ‘large file support’ version of the dirent structure, and so was only return by the new 64-bit getdents64() system call. This would have been a few years after FreeBSD officially documented d_type, and probably many years after it was actually available if you peeked at the structure definition.\nAs far as I can tell, d_type is present on Linux, FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, and Darwin (aka MacOS or OS X). It’s not present on Solaris and thus Illumos. As far as other commercial Unixes go, you’re on your own; all the links to manpages for things like AIX from my old entry on the remaining Unixes appear to have rotted away.\nSidebar: The filesystem also matters on modern Unixes\nEven if your Unix supports d_type in directory entries, it doesn’t mean that it’s supported by the filesystem of any specific directory. As far as I know, every Unix with d_type support has support for it in their normal local filesystems, but it’s not guaranteed to be in all filesystems, especially non-Unix ones like FAT32. Your code should always be prepared to deal with a file type of DT_UNKNOWN.\nIt’s also possible to have things the other way around, where you have a filesystem with support for file type information in directories that’s on a Unix that doesn’t support it. There are a number of plausible reasons for this to happen, but they’re either obvious or beyond the scope of this entry.\n\n\n\n\n###Multiboot Pinebook KDE neon\n\n\nRecently a KDE neon image for the Pinebook was announced. There is a new image, with a handful of fixes, which the KDE Plasma team has been working on over the past week and a half.\nHere’s a picture of my Pinebook running KDE neon — watching Panic! At the Disco’s High Hopes — sitting in front of my monitor that’s hooked up to one of my openSUSE systems. There are still some errata, and watching video sucks up battery, but for hacking on documentation from my hammock in the garden, or doing IRC meetings it’s a really nice machine.\nBut one of the neat things about running KDE neon off of an SD card on the Pinebook is that it’s portable — that SD card can move around. So let’s talk about multiboot in the sense of “booting the same OS storage medium in different hardware units” rather than “booting different OS from a medium in a single hardware unit”. On these little ARM boards, u-boot does all the heavy lifting early in the boot process. So to re-use the KDE neon Pinebook image on another ARM board, the u-boot blocks need to be replaced.\nI have the u-boot from a Pine64 image (I forget what) lying around, 1015 blocks of 1024 bytes, which I can dd over the u-boot blocks on the SD card, dd bs=1k conv=notrunc,sync if=uboot.img of=/dev/da0 seek=8, and then the same SD card, with the filesystem and data from the Pinebook, will boot on the Pine64 board. Of course, to move the SD card back again, I need to restore the Pinebook u-boot blocks.\nHere’s a picture of my Pineboard (the base is a piece of the garden fence, it’s Douglas pine, with 4mm threaded rods acting as the corner posts for my Pine64 mini-rack), with power and network and a serial console attached, along with the serial console output of the same.\nThe nice thing here is that the same software stack runs on the Pine64 but then has a wired network — which in turn means that if I switch on the other boards in that mini-rack, I’ve got a distcc-capable cluster for fast development, and vast NFS storage (served from ZFS on my FreeBSD machines) for source. I can develop in a high(er) powered environment, and then swap the card around into the Pinebook for testing-on-the-go.\nSo to sum up: you can multiboot the KDE neon Pinebook image on other Pine64 hardware (i.e. the Pine64 board). To do so, you need to swap around u-boot blocks. The blocks can be picked out of an image built for each board, and then a particular image (e.g. the latest KDE neon Pinebook) can be run on either board.\n\n\n\n\n##Beastie Bits\n\n\nUnexpected benefit with Ryzen – reducing power for build server\nHappy #CIDRDay!\nAbsolute FreeBSD 3e ship date\nMWL FreeBSD talk @ October 9th 2018 - MUG Meeting\nMeetBSD Oct 19-20\nOctober’s London *BSD meetup - 9th Oct 2018\nNRW BUG Meeting at Trivago Oct. 9\nLars Wittebrood blogs about his visit to EuroBSDCon 2018\nEuroBSDcon 2018 OpenBSD slides available\nEuroBSDCon conference site has most slides as well\n\n\n\n\n##Feedback/Questions\n\n\nBrad - Unmounted ZFS sends\nNiclas - Report from a Meetup\nGhislain - Bhyve not used?\nShane - zpool history and snapshots\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://oshogbo.vexillium.org/blog/53/\">OpenBSD/NetBSD on FreeBSD using grub2-bhyve</a></p>\n\n<blockquote>\n<p>When I was writing a blog post about the process title, I needed a couple of virtual machines with OpenBSD, NetBSD, and Ubuntu. Before that day I mainly used FreeBSD and Windows with bhyve. I spent some time trying to set up an OpenBSD using bhyve and UEFI as described here. I had numerous problems trying to use it, and this was the day I discovered the grub2-bhyve tool, and I love it!<br>\nThe grub2-bhyve allows you to load a kernel using GRUB bootloader. GRUB supports most of the operating systems with a standard configuration, so exactly the same method can be used to install NetBSD or Ubuntu. First, let’s install grub2-bhyve on our FreeBSD box:</p>\n</blockquote>\n\n<p><code># pkg install grub2-bhyve</code></p>\n\n<blockquote>\n<p>To run grub2-bhyve we need to provide at least the name of the VM. In bhyve, if the memsize is not specified the default VM is created with 256MB of the memory.</p>\n</blockquote>\n\n<p><code># grub-bhyve test</code><br>\n<code>GNU GRUB version 2.00</code><br>\n<code>Minimal BASH-like line editing is supported. For the first word, TAB lists possible command</code><br>\n<code>completions. Anywhere else TAB lists possible device or file completions.</code><br>\n<code></code><br>\n<code></code><br>\n<code>grub&gt;</code></p>\n\n<blockquote>\n<p>After running grub-bhyve command we will enter the GRUB loader. If we type the ls command, we will see all the available devices. In the case of the grub2-bhyve there is one additional device called “(host)” that is always available and allows the host filesystem to be accessed. We can list files under that device.</p>\n</blockquote>\n\n<p><code>grub&gt; ls</code><br>\n<code>(host)</code><br>\n<code>grub&gt; ls (host)/</code><br>\n<code>libexec/ bin/ usr/ bhyve/ compat/ tank/ etc/ boot/ net/ entropy proc/ lib/ root/ sys/ mnt/ rescue/ tmp/ home/ sbin/ media/ jail/ COPYRIGHT var/ dev/</code><br>\n<code>grub&gt;</code></p>\n\n<blockquote>\n<p>To exit console simply type ‘reboot’. I would like to install my new operating system under a ZVOL <code>ztank/bhyve/post</code>. On another terminal, we create:</p>\n</blockquote>\n\n<p><code># zfs create -V 10G ztank/bhyve/post</code></p>\n\n<blockquote>\n<p>If you don’t use ZFS for some crazy reason you can also create a raw blob using the truncate(1) command.</p>\n</blockquote>\n\n<p><code># truncate -s 10G post.img</code></p>\n\n<blockquote>\n<p>I recommend installing an operating system from the disk image (installXX.fs for OpenBSD and NetBSD-X.X-amd64-install.img for NetBSD). Now we need to create a device map for a GRUB.</p>\n</blockquote>\n\n<p><code>cat &gt; /tmp/post.map &lt;&lt; EOF</code><br>\n<code>(hd0) /directory/to/disk/image</code><br>\n<code>(hd1) /dev/zvol/ztank/bhyve/post</code><br>\n<code>EOF</code></p>\n\n<blockquote>\n<p>The mapping files describe the names for files in the GRUB. In our case under hd0 we will have an installation image and in hd1 we will have our ZVOL/blob. You can also try to use an ISO image then instead of using hd0 device name use a cd0. When we will run the grub-bhyve command we will see two additional devices.</p>\n</blockquote>\n\n<p><code># grub-bhyve -m /tmp/post.map post</code><br>\n<code>grub&gt; ls</code><br>\n<code>(hd0) (hd0,msdos4) (hd0,msdos1) (hd0,openbsd9) (hd0,openbsd1) (hd1) (host)</code></p>\n\n<blockquote>\n<p>The hd0 (in this example OpenBSD image) contains multiple partitions. We can check what is on it.</p>\n</blockquote>\n\n<p><code>grub&gt; ls (hd0,msdos4)/</code><br>\n<code>boot bsd 6.4/ etc/</code></p>\n\n<blockquote>\n<p>And this is the partition that contains a kernel. Now we can set a root device, load an OpenBSD kernel and boot:</p>\n</blockquote>\n\n<p><code>grub&gt; set root=(hd0,msdos4)</code><br>\n<code>grub&gt; kopenbsd -h com0 -r sd0a /bsd</code><br>\n<code>grub&gt; boot</code></p>\n\n<blockquote>\n<p>After that, we can run bhyve virtual machine. In my case it is:</p>\n</blockquote>\n\n<p><code># bhyve -c 1 -w -u -H \\</code><br>\n<code>-s 0,amd_hostbridge \\</code><br>\n<code>-s 3,ahci-hd,/directory/to/disk/image \\</code><br>\n<code>-s 4,ahci-hd,/dev/zvol/ztank/bhyve/post \\</code><br>\n<code>-s 31,lpc -l com1,stdio \\</code><br>\n<code>post</code></p>\n\n<blockquote>\n<p>Unfortunately explaining the whole bhyve(8)  command line is beyond this article. After installing the operating system remove hd0 from the mapping file and the image from the bhyve(8) command. If you don’t want to type all those GRUB commands, you can simply redirect them to the standard input.</p>\n</blockquote>\n\n<p><code>cat &lt;&lt; EOF | grub-bhyve -m /tmp/post.map -M 512 post</code><br>\n<code>set root=(hd0,4)</code><br>\n<code>kopenbsd -h com0 -r sd0a /bsd</code><br>\n<code>boot</code><br>\n<code>EOF</code></p>\n\n<p><hr></p>\n\n<p>###<a href=\"https://vermaden.wordpress.com/2018/09/07/my-freebsd-story/\">My FreeBSD Story</a></p>\n\n<blockquote>\n<p>My first devices/computers/consoles (not at the same time) that I remember were Atari 2600 and Pegasus console which was hardware clone of the Nintendo NES.<br>\nBack then I did not even knew that it was Atari 2600 as I referred to it as Video Computer System … and I did not even knew any english by then. It took me about two decades to get to know (by accident) that this Video Computer System was Atari 2600<br>\nThen I got AMIGA 600 computer (or should I say my parents bought it for me) which served both for playing computer games and also other activities for the first time. AMIGA is the computer that had the greatest influence on me, as it was the first time I studied the books about Amiga Workbench operating system and learned commands from Amiga Shell terminal. I loved the idea of Ram Disk icon/directory on the desktop that allowed me to transparently put any things in system memory. I still miss that concept on today’s desktop systems … and I still remember how dismal I was when I watched Amiga Deathbed Vigil movie.<br>\nAt the end of 1998 I got my first PC that of course came with Windows and that computer served both as gaming machine and as well as typical tool. One time I dig into the internals with Windows Registry (which left me disgusted by its concepts and implementation) and its limited command line interface provided by CMD.EXE executable. I remember that the heart of this box was not the CPU or the motherboard but the graphics accelerator – the legendary 3Dfx Voodoo card. This company (3Dfx) – their attitude and philosophy – also left solid fingerprint on my way. Like AMIGA did.<br>\nAfter ‘migration’ from AMIGA to PC it never again ‘felt right’. The games were cool but the Windows system was horrible. Time has passed and different Windows versions and hardware modifications took place. Windows XP felt really heavy at that time, not to mention Windows 2000 for example with even bigger hardware requirements. I also do not understand all the hate about Windows ME. It crashed with the same frequency as Windows 98 or later Windows 98 Second Edition but maybe my hardware was different ??<br>\nI do not have any ‘mine’ screenshots from that period as I lost all my 40 GB (huge then) drive of data when I moved/resized the partition with Partition Magic to get some more space from the less filled C: drive. That day I learned hard that “there are people who do backups and people who will do backups”. I never lost data again as I had multiple copies of my data, but the same as Netheril fall the lost data was was gone forever.<br>\nI always followed various alternatives which led me to try Linux in 2003, after reading about various distributions philosophies I decided to run Slackware Linux with KDE 3. My buddy used Aurox Linux by then (one of the few Linux distributions from Poland) and encouraged me to do the same – especially in the context of fixing possible problems as he already knew it and also as he recently dumped Windows system. But Slackware sounded like a better idea so I took that path instead. At first I dual booted between Windows XP and Slackware Linux cause I had everything worked out on the Windows world while I often felt helpless in the Linux world, so I would reboot into Windows to play some games or find a solution for Linux problem if that was required. I remember how strange the concept of dual clipboards (PRIMARY and SECONDARY) was for me by then. I was amazed why ‘so much better’ system as Linux (at least marketed that way) needs a system tray program to literally manage the clipboard. On Windows it was obvious, you do [CTRL]+[C] to copy and [CTRL]+[V] to paste things, but on Linux there (no I know its X11 feature) there were two clipboards that were synchronized by this little system tray program from KDE 3. It was also unthinkable for me that I will ‘lost’ contents of last/recent [CTRL]+[C] operation if I close the application from which the copy was made. I settled down a little on Slackware but not for long. I really did not liked manual dependency management for packages for example. Also KDE 3 was really ugly and despite trying all possible options I was not able to tweak it into something nice looking.<br>\nAfter half a year on Slackware I checked the Linux distributions again and decided to try Gentoo Linux. I definitely agree with the image below which visualizes Gentoo Linux experience, especially when You install it for he first time ??<br>\nOf course I went with the most hardcore version with self building Stage 1 (compiler and toolchain) which was horrible idea at that time because compilation on slow single core machine took forever … but after many hours I got Gentoo installed. I now have to decide which desktop environment to use. I have read a lot of good news about Fluxbox at that time so this is what I tried. It was very weird experience (to create everything in GUI from scratch) but very pleasant one. That recalled me the times of AMIGA … but Linux came in the way too much often. The more I dig into Gentoo Linux the more I read that lots of Gentoo features are based on FreeBSD solutions. Gentoo Portage is a clone of FreeBSD Ports. That ‘central’ /etc/rc.conf system configuration file concept was taken from FreeBSD as well. So I started to gather information about FreeBSD. The (then) FreeBSD website or FreeBSD Ports site (still) felt little outdated to say the least but that did not discouraged me.<br>\nSomewhere in 2005 I installed FreeBSD 5.4 on my computer. The beginnings were hard, like the earlier step with Gentoo but similarly like Gentoo the FreeBSD project came with a lot of great documentation. While Gentoo documentation is concentrated within various Gentoo Wiki sites the FreeBSD project comes with ‘official’ documentation in the form of Handbook and FAQ. I remember my first questions at the now nonexistent <a href=\"http://BSDForums.org\">BSDForums.org</a> site – for example one of the first ones – how to scroll the terminal output in the plain console. I now know that I had to push Scroll Lock button but it was something totally new for me.<br>\nWhy FreeBSD and not OpenBSD or NetBSD? Probably because Gentoo based most their concepts on the FreeBSD solutions, so that led me to FreeBSD instead of the other BSD operating systems. Currently I still use FreeBSD but I keep an steady eye on the OpenBSD, HardenedBSD and DragonFly BSD solutions and improvements.<br>\nAs the migration path from Linux to FreeBSD is a lot easier – all configuration files from /home can be just copied – the migration was quite fast easy. I again had the Fluxbox configuration which I used on the Gentoo. Now – on FreeBSD – it started to fell even more like AMIGA times. Everything is/has been well thought and had its place and reason. The documentation was good and the FreeBSD Community was second to none.<br>\nAfter 15 years of using various Windows, UNIX (macOS/AIX/HP-UX/Solaris/OpenSolaris/Illumos/FreeBSD/OpenBSD/NetBSD) and UNIX-like (Linux) systems I always come to conclusion that FreeBSD is the system that sucks least. And sucks least with each release and one day I will write why FreeBSD is such great operating system … if I already haven’t</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://blog.gsora.xyz/openbsd-on-the-desktop-some-thoughts/\">OpenBSD on the Desktop: some thoughts</a></p>\n\n<blockquote>\n<p>I’ve been using OpenBSD on my ThinkPad X230 for some weeks now, and the experience has been peculiar in some ways.<br>\nThe OS itself in my opinion is not ready for widespread desktop usage, and the development team is not trying to push it in the throat of anybody who wants a Windows or macOS alternative. You need to understand a little bit of how *NIX systems work, because you’ll use CLI more than UI. That’s not necessarily bad, and I’m sure I learned a trick or two that could translate easily to Linux or macOS. Their development process is purely based on developers that love to contribute and hack around, just because it’s fun. Even the mailing list is a cool place to hang on! Code correctness and security are a must, nothing gets committed if it doesn’t get reviewed thoroughly first - nowadays the first two properties should be enforced in every major operating system.<br>\nI like the idea of a platform that continually evolves. pledge(2) and unveil(2) are the proof that with a little effort, you can secure existing software better than ever.<br>\nI like the “sensible defaults” approach, having an OS ready to be used - UI included if you selected it during the setup process - is great.<br>\nJust install a browser and you’re ready to go.<br>\nManual pages on OpenBSD are real manuals, not an extension of the “–help” command found in most CLI softwares. They help you understand inner workings of the operating system, no internet connection needed. There are some trade-offs, too.<br>\nPerformance is not first-class, mostly because of all the security mitigations and checks done at runtime.<br>\nI write Go code in neovim, and sometimes you can feel a slight slowdown when you’re compiling and editing multiple files at the same time, but usually I can’t notice any meaningful difference. Browsers are a different matter though, you can definitely feel something differs from the experience you can have on mainstream operating systems. But again, trade-offs.<br>\nTo use OpenBSD on the desktop you must be ready to sacrifice some of the goodies of mainstream OSes, but if you’re searching for a zen place to do your computing stuff, it’s the best you can get right now.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/DirectoryDTypeHistory\">The history of file type information being available in Unix directories</a></p>\n\n<blockquote>\n<p>The two things that Unix directory entries absolutely have to have are the name of the directory entry and its ‘inode’, by which we generically mean some stable kernel identifier for the file that will persist if it gets renamed, linked to other directories, and so on. Unsurprisingly, directory entries have had these since the days when you read the raw bytes of directories with read(), and for a long time that was all they had; if you wanted more than the name and the inode number, you had to stat() the file, not just read the directory. Then, well, I’ll quote myself from an old entry on a find optimization:<br>\n[…], Unix filesystem developers realized that it was very common for programs reading directories to need to know a bit more about directory entries than just their names, especially their file types (find is the obvious case, but also consider things like ‘ls -F’). Given that the type of an active inode never changes, it’s possible to embed this information straight in the directory entry and then return this to user level, and that’s what developers did; on some systems, readdir(3) will now return directory entries with an additional d_type field that has the directory entry’s type.<br>\nOn Twitter, I recently grumbled about Illumos not having this d_type field. The ensuing conversation wound up with me curious about exactly where d_type came from and how far back it went. The answer turns out to be a bit surprising due to there being two sides of d_type.<br>\nOn the kernel side, d_type appears to have shown up in 4.4 BSD. The 4.4 BSD /usr/src/sys/dirent.h has a struct dirent that has a d_type field, but the field isn’t documented in either the comments in the file or in the getdirentries(2) manpage; both of those admit only to the traditional BSD dirent fields. This 4.4 BSD d_type was carried through to things that inherited from 4.4 BSD (Lite), specifically FreeBSD, but it continued to be undocumented for at least a while.<br>\n(In FreeBSD, the most convenient history I can find is here, and the d_type field is present in sys/dirent.h as far back as FreeBSD 2.0, which seems to be as far as the repo goes for releases.)<br>\nDocumentation for d_type appeared in the getdirentries(2) manpage in FreeBSD 2.2.0, where the manpage itself claims to have been updated on May 3rd 1995 (cf). In FreeBSD, this appears to have been part of merging 4.4 BSD ‘Lite2’, which seems to have been done in 1997. I stumbled over a repo of UCB BSD commit history, and in it the documentation appears in this May 3rd 1995 change, which at least has the same date. It appears that FreeBSD 2.2.0 was released some time in 1997, which is when this would have appeared in an official release.<br>\nIn Linux, it seems that a dirent structure with a d_type member appeared only just before 2.4.0, which was released at the start of 2001. Linux took this long because the d_type field only appeared in the 64-bit ‘large file support’ version of the dirent structure, and so was only return by the new 64-bit getdents64() system call. This would have been a few years after FreeBSD officially documented d_type, and probably many years after it was actually available if you peeked at the structure definition.<br>\nAs far as I can tell, d_type is present on Linux, FreeBSD, OpenBSD, NetBSD, Dragonfly BSD, and Darwin (aka MacOS or OS X). It’s not present on Solaris and thus Illumos. As far as other commercial Unixes go, you’re on your own; all the links to manpages for things like AIX from my old entry on the remaining Unixes appear to have rotted away.<br>\nSidebar: The filesystem also matters on modern Unixes<br>\nEven if your Unix supports d_type in directory entries, it doesn’t mean that it’s supported by the filesystem of any specific directory. As far as I know, every Unix with d_type support has support for it in their normal local filesystems, but it’s not guaranteed to be in all filesystems, especially non-Unix ones like FAT32. Your code should always be prepared to deal with a file type of DT_UNKNOWN.<br>\nIt’s also possible to have things the other way around, where you have a filesystem with support for file type information in directories that’s on a Unix that doesn’t support it. There are a number of plausible reasons for this to happen, but they’re either obvious or beyond the scope of this entry.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://euroquis.nl/bobulate/?p=1979\">Multiboot Pinebook KDE neon</a></p>\n\n<blockquote>\n<p>Recently a KDE neon image for the Pinebook was announced. There is a new image, with a handful of fixes, which the KDE Plasma team has been working on over the past week and a half.<br>\nHere’s a picture of my Pinebook running KDE neon — watching Panic! At the Disco’s High Hopes — sitting in front of my monitor that’s hooked up to one of my openSUSE systems. There are still some errata, and watching video sucks up battery, but for hacking on documentation from my hammock in the garden, or doing IRC meetings it’s a really nice machine.<br>\nBut one of the neat things about running KDE neon off of an SD card on the Pinebook is that it’s portable — that SD card can move around. So let’s talk about multiboot in the sense of “booting the same OS storage medium in different hardware units” rather than “booting different OS from a medium in a single hardware unit”. On these little ARM boards, u-boot does all the heavy lifting early in the boot process. So to re-use the KDE neon Pinebook image on another ARM board, the u-boot blocks need to be replaced.<br>\nI have the u-boot from a Pine64 image (I forget what) lying around, 1015 blocks of 1024 bytes, which I can dd over the u-boot blocks on the SD card, dd bs=1k conv=notrunc,sync if=uboot.img of=/dev/da0 seek=8, and then the same SD card, with the filesystem and data from the Pinebook, will boot on the Pine64 board. Of course, to move the SD card back again, I need to restore the Pinebook u-boot blocks.<br>\nHere’s a picture of my Pineboard (the base is a piece of the garden fence, it’s Douglas pine, with 4mm threaded rods acting as the corner posts for my Pine64 mini-rack), with power and network and a serial console attached, along with the serial console output of the same.<br>\nThe nice thing here is that the same software stack runs on the Pine64 but then has a wired network — which in turn means that if I switch on the other boards in that mini-rack, I’ve got a distcc-capable cluster for fast development, and vast NFS storage (served from ZFS on my FreeBSD machines) for source. I can develop in a high(er) powered environment, and then swap the card around into the Pinebook for testing-on-the-go.<br>\nSo to sum up: you can multiboot the KDE neon Pinebook image on other Pine64 hardware (i.e. the Pine64 board). To do so, you need to swap around u-boot blocks. The blocks can be picked out of an image built for each board, and then a particular image (e.g. the latest KDE neon Pinebook) can be run on either board.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/users/2018-September/357883.html\">Unexpected benefit with Ryzen – reducing power for build server</a></li>\n<li><a href=\"https://mwl.io/archives/3758\">Happy #CIDRDay!</a></li>\n<li><a href=\"https://mwl.io/archives/3771\">Absolute FreeBSD 3e ship date</a></li>\n<li><a href=\"http://www.mug.org/\">MWL FreeBSD talk @ October 9th 2018 - MUG Meeting</a></li>\n<li><a href=\"https://www.ixsystems.com/blog/meetbsd-2018-countdown/\">MeetBSD Oct 19-20</a></li>\n<li><a href=\"http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-September/014218.html\">October’s London *BSD meetup - 9th Oct 2018</a></li>\n<li><a href=\"https://www.bsd.nrw/\">NRW BUG Meeting at Trivago Oct. 9</a></li>\n<li><a href=\"https://blog.socruel.nu/misc/eurobsdcon-2018.html\">Lars Wittebrood blogs about his visit to EuroBSDCon 2018</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180925075334\">EuroBSDcon 2018 OpenBSD slides available</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/talks-speakers/\">EuroBSDCon conference site has most slides as well</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Brad - <a href=\"http://dpaste.com/3T9M2QC#wrap\">Unmounted ZFS sends</a></li>\n<li>Niclas - <a href=\"http://dpaste.com/11TKDK2\">Report from a Meetup</a></li>\n<li>Ghislain - <a href=\"http://dpaste.com/2790GC6\">Bhyve not used?</a></li>\n<li>Shane - <a href=\"http://dpaste.com/1P055SQ\">zpool history and snapshots</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Running OpenBSD/NetBSD on FreeBSD using grub2-bhyve, vermaden’s FreeBSD story, thoughts on OpenBSD on the desktop, history of file type info in Unix dirs, Multiboot a Pinebook KDE neon image, and more.","date_published":"2018-10-03T13:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/04e29e6e-69af-4d6a-9e57-2caa87aaeb48.mp3","mime_type":"audio/mp3","size_in_bytes":45192669,"duration_in_seconds":4500}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2631","title":"Episode 265: Software Disenchantment | BSD Now 265","url":"https://www.bsdnow.tv/265","content_text":"We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.\n\n##Headlines\n\n###[FreeBSD DevSummit &amp; EuroBSDcon 2018 in Romania]\n\n\nYour hosts are back from EuroBSDcon 2018 held in Bucharest, Romania this year. The first two days of the conference are used for tutorials and devsummits (FreeBSD and NetBSD), while the last two are for talks.\nAlthough Benedict organized the devsummit in large parts, he did not attend it this year. He held his Ansible tutorial in the morning of the first day, followed by Niclas Zeising’s new ports and poudriere tutorial (which had a record attendance). It was intended for beginners that had never used poudriere before and those who wanted to create their first port. The tutorial was well received and Niclas already has ideas for extending it for future conferences.\nOn the second day, Benedict took Kirk McKusick’s “An Introduction to the FreeBSD Open-Source Operating System” tutorial, held as a one full day class this year. Although it was reduced in content, it went into enough depth of many areas of the kernel and operating system to spark many questions from attendees. Clearly, this is a good start into kernel programming as Kirk provides enough material and backstories to understand why certain things are implemented as they are.\nOlivier Robert took [https://www.talegraph.com/tales/l2o9ltrvsE](pictures from the devsummit) and created a nice gallery out of it.\nDevsummit evenings saw dinners at two restaurants that allowed developers to spend some time talking over food and drinks.\nThe conference opened on the next day with the opening session held by Mihai Carabas. He introduced the first keynote speaker, a colleague of his who presented “Lightweight virtualization with LightVM and Unikraft”.\nBenedict helped out at the FreeBSD Foundation sponsor table and talked to people. He saw the following talks in between:\n\n\n\nSelfhosting as an alternative to the public cloud (by Albert Dengg)\nUsing Boot Environments at Scale (by Allan Jude)\nLivepatching FreeBSD kernel (by Maciej Grochowski)\nFreeBSD: What to (Not) Monitor (by Andrew Fengler)\nFreeBSD Graphics (by Niclas Zeising)\n\n\n\nAllan spent a lot of time talking to people and helping track down issues they were having, in addition to attending many talks:\n\nHacking together a FreeBSD presentation streaming box – For as little as possible (by Tom Jones)\nIntroduction of FreeBSD in new environments (by Baptiste Daroussin)\nKeynote: Some computing and networking historical perspectives (by Ron Broersma)\nLivepatching FreeBSD kernel (by Maciej Grochowski)\nFreeBSD: What to (Not) Monitor (by Andrew Fengler)\nBeing a BSD user (by Roller Angel)\nFrom “Hello World” to the VFS Layer: building a beadm for DragonFly BSD (by Michael Voight)\n\n\nWe also met the winner of our Power Bagel raffle from Episode 2^8. He received the item in the meantime and had it with him at the conference, providing a power outlet to charge other people’s devices.\nDuring the closing session, GroffTheBSDGoat was handed over to Deb Goodkin, who will bring the little guy to the Grace Hopper Celebration of Women in Computing conference and then to MeetBSD later this year. It was also revealed that next year’s EuroBSDcon will be held in Lillehammer, Norway.\nThanks to all the speakers, helpers, sponsors, organizers, and attendees for making it a successful conferences. There were no talks recorded this year, but the slides will be uploaded to the EuroBSDcon website in a couple of weeks. The OpenBSD talks are already available, so check them out.\n\n\n###Software disenchantment\n\n\nI’ve been programming for 15 years now. Recently our industry’s lack of care for efficiency, simplicity, and excellence started really getting to me, to the point of me getting depressed by my own career and the IT in general.\nModern cars work, let’s say for the sake of argument, at 98% of what’s physically possible with the current engine design. Modern buildings use just enough material to fulfill their function and stay safe under the given conditions. All planes converged to the optimal size/form/load and basically look the same.\nOnly in software, it’s fine if a program runs at 1% or even 0.01% of the possible performance. Everybody just seems to be ok with it. People are often even proud about how much inefficient it is, as in “why should we worry, computers are fast enough”:\n@tveastman: I have a Python program I run every day, it takes 1.5 seconds. I spent six hours re-writing it in rust, now it takes 0.06 seconds. That efficiency improvement means I’ll make my time back in 41 years, 24 days :-)\nYou’ve probably heard this mantra: “programmer time is more expensive than computer time”. What it means basically is that we’re wasting computers at an unprecedented scale. Would you buy a car if it eats 100 liters per 100 kilometers? How about 1000 liters? With computers, we do that all the time.\n\n\n\nEverything is unbearably slow\n\n\n\nLook around: our portable computers are thousands of times more powerful than the ones that brought man to the moon. Yet every other webpage struggles to maintain a smooth 60fps scroll on the latest top-of-the-line MacBook Pro. I can comfortably play games, watch 4K videos but not scroll web pages? How is it ok?\nGoogle Inbox, a web app written by Google, running in Chrome browser also by Google, takes 13 seconds to open moderately-sized emails:\nIt also animates empty white boxes instead of showing their content because it’s the only way anything can be animated on a webpage with decent performance. No, decent doesn’t mean 60fps, it’s rather “as fast as this web page could possibly go”. I’m dying to see web community answer when 120Hz displays become mainstream. Shit barely hits 60Hz already.\nWindows 10 takes 30 minutes to update. What could it possibly be doing for that long? That much time is enough to fully format my SSD drive, download a fresh build and install it like 5 times in a row.\nPavel Fatin: Typing in editor is a relatively simple process, so even 286 PCs were able to provide a rather fluid typing experience.\nModern text editors have higher latency than 42-year-old Emacs. Text editors! What can be simpler? On each keystroke, all you have to do is update tiny rectangular region and modern text editors can’t do that in 16ms. It’s a lot of time. A LOT. A 3D game can fill the whole screen with hundreds of thousands (!!!) of polygons in the same 16ms and also process input, recalculate the world and dynamically load/unload resources. How come?\nAs a general trend, we’re not getting faster software with more features. We’re getting faster hardware that runs slower software with the same features. Everything works way below the possible speed. Ever wonder why your phone needs 30 to 60 seconds to boot? Why can’t it boot, say, in one second? There are no physical limitations to that. I would love to see that. I would love to see limits reached and explored, utilizing every last bit of performance we can get for something meaningful in a meaningful way.\n\n\n\nEverything is HUUUUGE\n\n\n\nAnd then there’s bloat. Web apps could open up to 10× faster if you just simply block all ads. Google begs everyone to stop shooting themselves in their feet with AMP initiative—a technology solution to a problem that doesn’t need any technology, just a little bit of common sense. If you remove bloat, the web becomes crazy fast. How smart do you have to be to understand that?\nAndroid system with no apps takes almost 6 Gb. Just think for a second how obscenely HUGE that number is. What’s in there, HD movies? I guess it’s basically code: kernel, drivers. Some string and resources too, sure, but those can’t be big. So, how many drivers do you need for a phone?\nWindows 95 was 30Mb. Today we have web pages heavier than that! Windows 10 is 4Gb, which is 133 times as big. But is it 133 times as superior? I mean, functionally they are basically the same. Yes, we have Cortana, but I doubt it takes 3970 Mb. But whatever Windows 10 is, is Android really 150% of that?\nGoogle keyboard app routinely eats 150 Mb. Is an app that draws 30 keys on a screen really five times more complex than the whole Windows 95? Google app, which is basically just a package for Google Web Search, is 350 Mb! Google Play Services, which I do not use (I don’t buy books, music or videos there)—300 Mb that just sit there and which I’m unable to delete.\nAll that leaves me around 1 Gb for my photos after I install all the essential (social, chats, maps, taxi, banks etc) apps. And that’s with no games and no music at all! Remember times when an OS, apps and all your data fit on a floppy?\nYour desktop todo app is probably written in Electron and thus has userland driver for Xbox 360 controller in it, can render 3d graphics and play audio and take photos with your web camera.\nA simple text chat is notorious for its load speed and memory consumption. Yes, you really have to count Slack in as a resource-heavy application. I mean, chatroom and barebones text editor, those are supposed to be two of the less demanding apps in the whole world. Welcome to 2018.\nAt least it works, you might say. Well, bigger doesn’t imply better. Bigger means someone has lost control. Bigger means we don’t know what’s going on. Bigger means complexity tax, performance tax, reliability tax. This is not the norm and should not become the norm. Overweight apps should mean a red flag. They should mean run away scared.\n\n\n\nBetter world manifesto\n\n\n\nI want to see progress. I want change. I want state-of-the-art in software engineering to improve, not just stand still. I don’t want to reinvent the same stuff over and over, less performant and more bloated each time. I want something to believe in, a worthy end goal, a future better than what we have today, and I want a community of engineers who share that vision.\nWhat we have today is not progress. We barely meet business goals with poor tools applied over the top. We’re stuck in local optima and nobody wants to move out. It’s not even a good place, it’s bloated and inefficient. We just somehow got used to it.\nSo I want to call it out: where we are today is bullshit. As engineers, we can, and should, and will do better. We can have better tools, we can build better apps, faster, more predictable, more reliable, using fewer resources (orders of magnitude fewer!). We need to understand deeply what are we doing and why. We need to deliver: reliably, predictably, with topmost quality. We can—and should–take pride in our work. Not just “given what we had…”—no buts!\nI hope I’m not alone at this. I hope there are people out there who want to do the same. I’d appreciate if we at least start talking about how absurdly bad our current situation in the software industry is. And then we maybe figure out how to get out.\n\n\n\n\n##News Roundup\n###[llvm-announce] LLVM 7.0.0 Release\n\nI am pleased to announce that LLVM 7 is now available.\n\nGet it here: https://llvm.org/releases/download.html#7.0.0\n\nThe release contains the work on trunk up to SVN revision 338536 plus\nwork on the release branch. It is the result of the community's work\nover the past six months, including: function multiversioning in Clang\nwith the 'target' attribute for ELF-based x86/x86_64 targets, improved\nPCH support in clang-cl, preliminary DWARF v5 support, basic support\nfor OpenMP 4.5 offloading to NVPTX, OpenCL C++ support, MSan, X-Ray\nand libFuzzer support for FreeBSD, early UBSan, X-Ray and libFuzzer\nsupport for OpenBSD, UBSan checks for implicit conversions, many\nlong-tail compatibility issues fixed in lld which is now production\nready for ELF, COFF and MinGW, new tools llvm-exegesis, llvm-mca and\ndiagtool. And as usual, many optimizations, improved diagnostics, and\nbug fixes.\n\nFor more details, see the release notes:\nhttps://llvm.org/releases/7.0.0/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/clang/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/lld/docs/ReleaseNotes.html\n\nThanks to everyone who helped with filing, fixing, and code reviewing\nfor the release-blocking bugs!\n\nSpecial thanks to the release testers and packagers: Bero\nRosenkränzer, Brian Cain, Dimitry Andric, Jonas Hahnfeld, Lei Huang\nMichał Górny, Sylvestre Ledru, Takumi Nakamura, and Vedant Kumar.\n\nFor questions or comments about the release, please contact the\ncommunity on the mailing lists. Onwards to LLVM 8!\n\nCheers,\nHans\n\n\n\n\n###Update your Thinkpad’s bios with Linux or OpenBSD\n\n\nGet your new bios\n\n\n\nAt first, go to the Lenovo website and download your new bios:\n\n\n\nGo to lenovo support\nUse the search bar to find your product (example for me, x270)\nChoose the right product (if necessary) and click search\nOn the right side, click on Update Your System\nClick on BIOS/UEFI\nChoose *BIOS Update (Bootable CD) for Windows *\nDownload\n\n\n\nFor me the file is called like this : r0iuj25wd.iso\n\n\n\nExtract bios update\n\n\n\nNow you will need to install geteltorito.\n\n\n\nWith OpenBSD:\n\n\n$ doas pkg_add geteltorito\nquirks-3.7 signed on 2018-09-09T13:15:19Z\ngeteltorito-0.6: ok\n\n\nWith Debian:\n\n\n$ sudo apt-get install genisoimage\n\n\nNow we will extract the bios update :\n\n\n$ geteltorito -o bios_update.img r0iuj25wd.iso\nBooting catalog starts at sector: 20\nManufacturer of CD: NERO BURNING ROM VER 12\nImage architecture: x86\nBoot media type is: harddisk\nEl Torito image starts at sector 27 and has 43008 sector(s) of 512 Bytes\n\nImage has been written to file \"bios_update.img\".\nThis will create a file called bios_update.img.\n\n\nPut the image on an USB key\nCAREFULL : on my computer, my USB key is sda1 on Linux and sd1 on OpenBSD.\n\n\n\nPlease check twice on your computer the name of your USB key.\n\n\n\nWith OpenBSD :\n\n\n$ doas dd if=bios_update.img of=/dev/rsd1c\n\n\nWith Linux :\n\n\n$ sudo dd if=bios_update.img of=/dev/sda\n\n\nNow all you need is to reboot, to boot on your USB key and follow the instructions. Enjoy 😉\n\n\n\n\n###Announcing The HardenedBSD Foundation\n\n\nIn June of 2018, we announced our intent to become a not-for-profit, tax-exempt 501©(3) organization in the United States. It took a dedicated team months of work behind-the-scenes to make that happen. On 06 September 2018, HardenedBSD Foundation Corp was granted 501©(3) status, from which point all US-based persons making donations can deduct the donation from their taxes.\nWe are grateful for those who contribute to HardenedBSD in whatever way they can. Thank you for making HardenedBSD possible. We look forward to a bright future, driven by a helpful and positive community.\n\n\n\n\n###How you migrate ZFS filesystems matters\n\n\nIf you want to move a ZFS filesystem around from one host to another, you have two general approaches; you can use ‘zfs send’ and ‘zfs receive’, or you can use a user level copying tool such as rsync (or ‘tar -cf | tar -xf’, or any number of similar options). Until recently, I had considered these two approaches to be more or less equivalent apart from their convenience and speed (which generally tilted in favour of ‘zfs send’). It turns out that this is not necessarily the case and there are situations where you will want one instead of the other.\nWe have had two generations of ZFS fileservers so far, the Solaris ones and the OmniOS ones. When we moved from the first generation to the second generation, we migrated filesystems across using ‘zfs send’, including the filesystem with my home directory in it (we did this for various reasons). Recently I discovered that some old things in my filesystem didn’t have file type information in their directory entries. ZFS has been adding file type information to directories for a long time, but not quite as long as my home directory has been on ZFS.\nThis illustrates an important difference between the ‘zfs send’ approach and the rsync approach, which is that zfs send doesn’t update or change at least some ZFS on-disk data structures, in the way that re-writing them from scratch from user level does. There are both positives and negatives to this, and a certain amount of rewriting does happen even in the ‘zfs send’ case (for example, all of the block pointers get changed, and ZFS will re-compress your data as applicable).\nI knew that in theory you had to copy things at the user level if you wanted to make sure that your ZFS filesystem and everything in it was fully up to date with the latest ZFS features. But I didn’t expect to hit a situation where it mattered in practice until, well, I did. Now I suspect that old files on our old filesystems may be partially missing a number of things, and I’m wondering how much of the various changes in ‘zfs upgrade -v’ apply even to old data.\n(I’d run into this sort of general thing before when I looked into ext3 to ext4 conversion on Linux.)\nWith all that said, I doubt this will change our plans for migrating our ZFS filesystems in the future (to our third generation fileservers). ZFS sending and receiving is just too convenient, too fast and too reliable to give up. Rsync isn’t bad, but it’s not the same, and so we only use it when we have to (when we’re moving only some of the people in a filesystem instead of all of them, for example).\nPS: I was going to try to say something about what ‘zfs send’ did and didn’t update, but having looked briefly at the code I’ve concluded that I need to do more research before running my keyboard off. In the mean time, you can read the OpenZFS wiki page on ZFS send and receive, which has plenty of juicy technical details.\nPPS: Since eliminating all-zero blocks is a form of compression, you can turn zero-filled files into sparse files through a ZFS send/receive if the destination has compression enabled. As far as I know, genuine sparse files on the source will stay sparse through a ZFS send/receive even if they’re sent to a destination with compression off.\n\n\n\n\n##Beastie Bits\n\n\nBSD Users Stockholm Meetup #4: Tuesday, November 13, 2018 at 18:00\nBSD Poland User Group: Next Meeting: October 11, 2018, 18:15 - 21:15 at Warsaw University of Technology\nn2k18 Hackathon report: Ken Westerback (krw@) on disklabel(8) work, dhclient(8) progress\nRunning MirageOS Unikernels on OpenBSD in vmm (Now Works)\nvmm(4) gets support for qcow2\nMeetBSD and SecurityBsides\nColin Percival reduced FreeBSD startup time from 10627ms (11.2) to 4738ms (12.0)\nFreeBSD 11.1 end-of-life\nKnoxBug: Monday, October 1, 2018 at 18:00: Real-world Performance Advantages of NVDIMM and NVMe: Case Study with OpenZFS\n\n\n\n\n##Feedback/Questions\n\n\nTodd - 2 Nics, 1 bhyve and a jail cell\nThomas - Deep Dive\nMorgan - Send/Receive to Manage Fragmentation?\nDominik - hierarchical jails -&gt; networking\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.</p>\n\n<p>##Headlines</p>\n\n<p>###[FreeBSD DevSummit &amp; EuroBSDcon 2018 in Romania]</p>\n\n<ul>\n<li>Your hosts are back from EuroBSDcon 2018 held in Bucharest, Romania this year. The first two days of the conference are used for tutorials and devsummits (FreeBSD and NetBSD), while the last two are for talks.</li>\n<li>Although Benedict organized the devsummit in large parts, he did not attend it this year. He held his Ansible tutorial in the morning of the first day, followed by Niclas Zeising’s new ports and poudriere tutorial (which had a record attendance). It was intended for beginners that had never used poudriere before and those who wanted to create their first port. The tutorial was well received and Niclas already has ideas for extending it for future conferences.</li>\n<li>On the second day, Benedict took Kirk McKusick’s “An Introduction to the FreeBSD Open-Source Operating System” tutorial, held as a one full day class this year. Although it was reduced in content, it went into enough depth of many areas of the kernel and operating system to spark many questions from attendees. Clearly, this is a good start into kernel programming as Kirk provides enough material and backstories to understand why certain things are implemented as they are.</li>\n<li>Olivier Robert took [<a href=\"https://www.talegraph.com/tales/l2o9ltrvsE\">https://www.talegraph.com/tales/l2o9ltrvsE</a>](pictures from the devsummit) and created a nice gallery out of it.</li>\n<li>Devsummit evenings saw dinners at two restaurants that allowed developers to spend some time talking over food and drinks.</li>\n<li>The conference opened on the next day with the opening session held by Mihai Carabas. He introduced the first keynote speaker, a colleague of his who presented “Lightweight virtualization with LightVM and Unikraft”.</li>\n<li>Benedict helped out at the FreeBSD Foundation sponsor table and talked to people. He saw the following talks in between:</li>\n</ul>\n\n<blockquote>\n<p>Selfhosting as an alternative to the public cloud (by Albert Dengg)<br>\nUsing Boot Environments at Scale (by Allan Jude)<br>\nLivepatching FreeBSD kernel (by Maciej Grochowski)<br>\nFreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>\nFreeBSD Graphics (by Niclas Zeising)</p>\n</blockquote>\n\n<ul>\n<li>Allan spent a lot of time talking to people and helping track down issues they were having, in addition to attending many talks:\n<blockquote>\n<p>Hacking together a FreeBSD presentation streaming box – For as little as possible (by Tom Jones)<br>\nIntroduction of FreeBSD in new environments (by Baptiste Daroussin)<br>\nKeynote: Some computing and networking historical perspectives (by Ron Broersma)<br>\nLivepatching FreeBSD kernel (by Maciej Grochowski)<br>\nFreeBSD: What to (Not) Monitor (by Andrew Fengler)<br>\nBeing a BSD user (by Roller Angel)<br>\nFrom “Hello World” to the VFS Layer: building a beadm for DragonFly BSD (by Michael Voight)</p>\n</blockquote>\n</li>\n<li>We also met the winner of our Power Bagel raffle from <a href=\"http://www.bsdnow.tv/episodes/2018_07_25-2_8_because_computers\">Episode 2^8</a>. He received the item in the meantime and had it with him at the conference, providing a power outlet to charge other people’s devices.</li>\n<li>During the closing session, <a href=\"https://twitter.com/groffthebsdgoat\">GroffTheBSDGoat</a> was handed over to Deb Goodkin, who will bring the little guy to the <a href=\"https://ghc.anitab.org/\">Grace Hopper Celebration of Women in Computing conference</a> and then to <a href=\"http://meetbsd.com\">MeetBSD</a> later this year. It was also revealed that next year’s EuroBSDcon will be held in Lillehammer, Norway.</li>\n<li>Thanks to all the speakers, helpers, sponsors, organizers, and attendees for making it a successful conferences. There were no talks recorded this year, but the slides will be uploaded to the <a href=\"http://eurobsdcon.org\">EuroBSDcon website</a> in a couple of weeks. The <a href=\"https://www.openbsd.org/events.html#eurobsdcon2018\">OpenBSD talks</a> are already available, so check them out.</li>\n</ul>\n\n<p>###<a href=\"http://tonsky.me/blog/disenchantment/\">Software disenchantment</a></p>\n\n<blockquote>\n<p>I’ve been programming for 15 years now. Recently our industry’s lack of care for efficiency, simplicity, and excellence started really getting to me, to the point of me getting depressed by my own career and the IT in general.<br>\nModern cars work, let’s say for the sake of argument, at 98% of what’s physically possible with the current engine design. Modern buildings use just enough material to fulfill their function and stay safe under the given conditions. All planes converged to the optimal size/form/load and basically look the same.<br>\nOnly in software, it’s fine if a program runs at 1% or even 0.01% of the possible performance. Everybody just seems to be ok with it. People are often even proud about how much inefficient it is, as in “why should we worry, computers are fast enough”:<br>\n@tveastman: I have a Python program I run every day, it takes 1.5 seconds. I spent six hours re-writing it in rust, now it takes 0.06 seconds. That efficiency improvement means I’ll make my time back in 41 years, 24 days :-)<br>\nYou’ve probably heard this mantra: “programmer time is more expensive than computer time”. What it means basically is that we’re wasting computers at an unprecedented scale. Would you buy a car if it eats 100 liters per 100 kilometers? How about 1000 liters? With computers, we do that all the time.</p>\n</blockquote>\n\n<ul>\n<li>Everything is unbearably slow</li>\n</ul>\n\n<blockquote>\n<p>Look around: our portable computers are thousands of times more powerful than the ones that brought man to the moon. Yet every other webpage struggles to maintain a smooth 60fps scroll on the latest top-of-the-line MacBook Pro. I can comfortably play games, watch 4K videos but not scroll web pages? How is it ok?<br>\nGoogle Inbox, a web app written by Google, running in Chrome browser also by Google, takes 13 seconds to open moderately-sized emails:<br>\nIt also animates empty white boxes instead of showing their content because it’s the only way anything can be animated on a webpage with decent performance. No, decent doesn’t mean 60fps, it’s rather “as fast as this web page could possibly go”. I’m dying to see web community answer when 120Hz displays become mainstream. Shit barely hits 60Hz already.<br>\nWindows 10 takes 30 minutes to update. What could it possibly be doing for that long? That much time is enough to fully format my SSD drive, download a fresh build and install it like 5 times in a row.<br>\nPavel Fatin: Typing in editor is a relatively simple process, so even 286 PCs were able to provide a rather fluid typing experience.<br>\nModern text editors have higher latency than 42-year-old Emacs. Text editors! What can be simpler? On each keystroke, all you have to do is update tiny rectangular region and modern text editors can’t do that in 16ms. It’s a lot of time. A LOT. A 3D game can fill the whole screen with hundreds of thousands (!!!) of polygons in the same 16ms and also process input, recalculate the world and dynamically load/unload resources. How come?<br>\nAs a general trend, we’re not getting faster software with more features. We’re getting faster hardware that runs slower software with the same features. Everything works way below the possible speed. Ever wonder why your phone needs 30 to 60 seconds to boot? Why can’t it boot, say, in one second? There are no physical limitations to that. I would love to see that. I would love to see limits reached and explored, utilizing every last bit of performance we can get for something meaningful in a meaningful way.</p>\n</blockquote>\n\n<ul>\n<li>Everything is HUUUUGE</li>\n</ul>\n\n<blockquote>\n<p>And then there’s bloat. Web apps could open up to 10× faster if you just simply block all ads. Google begs everyone to stop shooting themselves in their feet with AMP initiative—a technology solution to a problem that doesn’t need any technology, just a little bit of common sense. If you remove bloat, the web becomes crazy fast. How smart do you have to be to understand that?<br>\nAndroid system with no apps takes almost 6 Gb. Just think for a second how obscenely HUGE that number is. What’s in there, HD movies? I guess it’s basically code: kernel, drivers. Some string and resources too, sure, but those can’t be big. So, how many drivers do you need for a phone?<br>\nWindows 95 was 30Mb. Today we have web pages heavier than that! Windows 10 is 4Gb, which is 133 times as big. But is it 133 times as superior? I mean, functionally they are basically the same. Yes, we have Cortana, but I doubt it takes 3970 Mb. But whatever Windows 10 is, is Android really 150% of that?<br>\nGoogle keyboard app routinely eats 150 Mb. Is an app that draws 30 keys on a screen really five times more complex than the whole Windows 95? Google app, which is basically just a package for Google Web Search, is 350 Mb! Google Play Services, which I do not use (I don’t buy books, music or videos there)—300 Mb that just sit there and which I’m unable to delete.<br>\nAll that leaves me around 1 Gb for my photos after I install all the essential (social, chats, maps, taxi, banks etc) apps. And that’s with no games and no music at all! Remember times when an OS, apps and all your data fit on a floppy?<br>\nYour desktop todo app is probably written in Electron and thus has userland driver for Xbox 360 controller in it, can render 3d graphics and play audio and take photos with your web camera.<br>\nA simple text chat is notorious for its load speed and memory consumption. Yes, you really have to count Slack in as a resource-heavy application. I mean, chatroom and barebones text editor, those are supposed to be two of the less demanding apps in the whole world. Welcome to 2018.<br>\nAt least it works, you might say. Well, bigger doesn’t imply better. Bigger means someone has lost control. Bigger means we don’t know what’s going on. Bigger means complexity tax, performance tax, reliability tax. This is not the norm and should not become the norm. Overweight apps should mean a red flag. They should mean run away scared.</p>\n</blockquote>\n\n<ul>\n<li>Better world manifesto</li>\n</ul>\n\n<blockquote>\n<p>I want to see progress. I want change. I want state-of-the-art in software engineering to improve, not just stand still. I don’t want to reinvent the same stuff over and over, less performant and more bloated each time. I want something to believe in, a worthy end goal, a future better than what we have today, and I want a community of engineers who share that vision.<br>\nWhat we have today is not progress. We barely meet business goals with poor tools applied over the top. We’re stuck in local optima and nobody wants to move out. It’s not even a good place, it’s bloated and inefficient. We just somehow got used to it.<br>\nSo I want to call it out: where we are today is bullshit. As engineers, we can, and should, and will do better. We can have better tools, we can build better apps, faster, more predictable, more reliable, using fewer resources (orders of magnitude fewer!). We need to understand deeply what are we doing and why. We need to deliver: reliably, predictably, with topmost quality. We can—and should–take pride in our work. Not just “given what we had…”—no buts!<br>\nI hope I’m not alone at this. I hope there are people out there who want to do the same. I’d appreciate if we at least start talking about how absurdly bad our current situation in the software industry is. And then we maybe figure out how to get out.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://lists.llvm.org/pipermail/llvm-announce/2018-September/000080.html\">[llvm-announce] LLVM 7.0.0 Release</a></p>\n\n<pre><code>I am pleased to announce that LLVM 7 is now available.\n\nGet it here: https://llvm.org/releases/download.html#7.0.0\n\nThe release contains the work on trunk up to SVN revision 338536 plus\nwork on the release branch. It is the result of the community's work\nover the past six months, including: function multiversioning in Clang\nwith the 'target' attribute for ELF-based x86/x86_64 targets, improved\nPCH support in clang-cl, preliminary DWARF v5 support, basic support\nfor OpenMP 4.5 offloading to NVPTX, OpenCL C++ support, MSan, X-Ray\nand libFuzzer support for FreeBSD, early UBSan, X-Ray and libFuzzer\nsupport for OpenBSD, UBSan checks for implicit conversions, many\nlong-tail compatibility issues fixed in lld which is now production\nready for ELF, COFF and MinGW, new tools llvm-exegesis, llvm-mca and\ndiagtool. And as usual, many optimizations, improved diagnostics, and\nbug fixes.\n\nFor more details, see the release notes:\nhttps://llvm.org/releases/7.0.0/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/clang/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html\nhttps://llvm.org/releases/7.0.0/tools/lld/docs/ReleaseNotes.html\n\nThanks to everyone who helped with filing, fixing, and code reviewing\nfor the release-blocking bugs!\n\nSpecial thanks to the release testers and packagers: Bero\nRosenkränzer, Brian Cain, Dimitry Andric, Jonas Hahnfeld, Lei Huang\nMichał Górny, Sylvestre Ledru, Takumi Nakamura, and Vedant Kumar.\n\nFor questions or comments about the release, please contact the\ncommunity on the mailing lists. Onwards to LLVM 8!\n\nCheers,\nHans\n</code></pre>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.raveland.org/post/thinkpad_update_bios/\">Update your Thinkpad’s bios with Linux or OpenBSD</a></p>\n\n<ul>\n<li>Get your new bios</li>\n</ul>\n\n<blockquote>\n<p>At first, go to the Lenovo website and download your new bios:</p>\n</blockquote>\n\n<ul>\n<li>Go to lenovo support</li>\n<li>Use the search bar to find your product (example for me, x270)</li>\n<li>Choose the right product (if necessary) and click search</li>\n<li>On the right side, click on Update Your System</li>\n<li>Click on BIOS/UEFI</li>\n<li>Choose *BIOS Update (Bootable CD) for Windows *</li>\n<li>Download</li>\n</ul>\n\n<blockquote>\n<p>For me the file is called like this : r0iuj25wd.iso</p>\n</blockquote>\n\n<ul>\n<li>Extract bios update</li>\n</ul>\n\n<blockquote>\n<p>Now you will need to install geteltorito.</p>\n</blockquote>\n\n<ul>\n<li>With OpenBSD:</li>\n</ul>\n\n<p><code>$ doas pkg_add geteltorito</code><br>\n<code>quirks-3.7 signed on 2018-09-09T13:15:19Z</code><br>\n<code>geteltorito-0.6: ok</code></p>\n\n<ul>\n<li>With Debian:</li>\n</ul>\n\n<p><code>$ sudo apt-get install genisoimage</code></p>\n\n<ul>\n<li>Now we will extract the bios update :</li>\n</ul>\n\n<p><code>$ geteltorito -o bios_update.img r0iuj25wd.iso</code><br>\n<code>Booting catalog starts at sector: 20</code><br>\n<code>Manufacturer of CD: NERO BURNING ROM VER 12</code><br>\n<code>Image architecture: x86</code><br>\n<code>Boot media type is: harddisk</code><br>\n<code>El Torito image starts at sector 27 and has 43008 sector(s) of 512 Bytes</code><br>\n<code></code><br>\n<code>Image has been written to file &quot;bios_update.img&quot;.</code><br>\n<code>This will create a file called bios_update.img.</code></p>\n\n<ul>\n<li>Put the image on an USB key</li>\n<li>CAREFULL : on my computer, my USB key is sda1 on Linux and sd1 on OpenBSD.</li>\n</ul>\n\n<blockquote>\n<p>Please check twice on your computer the name of your USB key.</p>\n</blockquote>\n\n<ul>\n<li>With OpenBSD :</li>\n</ul>\n\n<p><code>$ doas dd if=bios_update.img of=/dev/rsd1c</code></p>\n\n<ul>\n<li>With Linux :</li>\n</ul>\n\n<p><code>$ sudo dd if=bios_update.img of=/dev/sda</code></p>\n\n<blockquote>\n<p>Now all you need is to reboot, to boot on your USB key and follow the instructions. Enjoy &#x1f609;</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://hardenedbsd.org/article/shawn-webb/2018-09-17/announcing-hardenedbsd-foundation\">Announcing The HardenedBSD Foundation</a></p>\n\n<blockquote>\n<p>In June of 2018, we announced our intent to become a not-for-profit, tax-exempt 501©(3) organization in the United States. It took a dedicated team months of work behind-the-scenes to make that happen. On 06 September 2018, HardenedBSD Foundation Corp was granted 501©(3) status, from which point all US-based persons making donations can deduct the donation from their taxes.<br>\nWe are grateful for those who contribute to HardenedBSD in whatever way they can. Thank you for making HardenedBSD possible. We look forward to a bright future, driven by a helpful and positive community.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSSendRecvVsRsync\">How you migrate ZFS filesystems matters</a></p>\n\n<blockquote>\n<p>If you want to move a ZFS filesystem around from one host to another, you have two general approaches; you can use ‘zfs send’ and ‘zfs receive’, or you can use a user level copying tool such as rsync (or ‘tar -cf | tar -xf’, or any number of similar options). Until recently, I had considered these two approaches to be more or less equivalent apart from their convenience and speed (which generally tilted in favour of ‘zfs send’). It turns out that this is not necessarily the case and there are situations where you will want one instead of the other.<br>\nWe have had two generations of ZFS fileservers so far, the Solaris ones and the OmniOS ones. When we moved from the first generation to the second generation, we migrated filesystems across using ‘zfs send’, including the filesystem with my home directory in it (we did this for various reasons). Recently I discovered that some old things in my filesystem didn’t have file type information in their directory entries. ZFS has been adding file type information to directories for a long time, but not quite as long as my home directory has been on ZFS.<br>\nThis illustrates an important difference between the ‘zfs send’ approach and the rsync approach, which is that zfs send doesn’t update or change at least some ZFS on-disk data structures, in the way that re-writing them from scratch from user level does. There are both positives and negatives to this, and a certain amount of rewriting does happen even in the ‘zfs send’ case (for example, all of the block pointers get changed, and ZFS will re-compress your data as applicable).<br>\nI knew that in theory you had to copy things at the user level if you wanted to make sure that your ZFS filesystem and everything in it was fully up to date with the latest ZFS features. But I didn’t expect to hit a situation where it mattered in practice until, well, I did. Now I suspect that old files on our old filesystems may be partially missing a number of things, and I’m wondering how much of the various changes in ‘zfs upgrade -v’ apply even to old data.<br>\n(I’d run into this sort of general thing before when I looked into ext3 to ext4 conversion on Linux.)<br>\nWith all that said, I doubt this will change our plans for migrating our ZFS filesystems in the future (to our third generation fileservers). ZFS sending and receiving is just too convenient, too fast and too reliable to give up. Rsync isn’t bad, but it’s not the same, and so we only use it when we have to (when we’re moving only some of the people in a filesystem instead of all of them, for example).<br>\nPS: I was going to try to say something about what ‘zfs send’ did and didn’t update, but having looked briefly at the code I’ve concluded that I need to do more research before running my keyboard off. In the mean time, you can read the OpenZFS wiki page on ZFS send and receive, which has plenty of juicy technical details.<br>\nPPS: Since eliminating all-zero blocks is a form of compression, you can turn zero-filled files into sparse files through a ZFS send/receive if the destination has compression enabled. As far as I know, genuine sparse files on the source will stay sparse through a ZFS send/receive even if they’re sent to a destination with compression off.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/254235663/\">BSD Users Stockholm Meetup #4: Tuesday, November 13, 2018 at 18:00</a></li>\n<li><a href=\"https://bsd-pl.org/en\">BSD Poland User Group: Next Meeting: October 11, 2018, 18:15 - 21:15 at Warsaw University of Technology</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180915112028\">n2k18 Hackathon report: Ken Westerback (krw@) on disklabel(8) work, dhclient(8) progress</a></li>\n<li><a href=\"https://lists.xenproject.org/archives/html/mirageos-devel/2018-09/msg00013.html\">Running MirageOS Unikernels on OpenBSD in vmm (Now Works)</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180910070407\">vmm(4) gets support for qcow2</a></li>\n<li><a href=\"https://oshogbo.vexillium.org/blog/52/\">MeetBSD and SecurityBsides</a></li>\n<li><a href=\"https://twitter.com/cperciva/status/1041433506453155840\">Colin Percival reduced FreeBSD startup time from 10627ms (11.2) to 4738ms (12.0)</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2018-September/001842.html\">FreeBSD 11.1 end-of-life</a></li>\n<li><a href=\"https://www.meetup.com/KnoxBUG-BSD-Linux-and-FOSS-Users-Unite/events/254759084\">KnoxBug: Monday, October 1, 2018 at 18:00: Real-world Performance Advantages of NVDIMM and NVMe: Case Study with OpenZFS</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Todd - <a href=\"http://dpaste.com/2QZEZPA\">2 Nics, 1 bhyve and a jail cell</a></li>\n<li>Thomas - <a href=\"http://dpaste.com/3SFM1YP#wrap\">Deep Dive</a></li>\n<li>Morgan - <a href=\"http://dpaste.com/07EK4RK#wrap\">Send/Receive to Manage Fragmentation?</a></li>\n<li>Dominik - <a href=\"http://dpaste.com/0SZJ0V4#wrap\">hierarchical jails -&gt; networking</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"We report from our experiences at EuroBSDcon, disenchant software, LLVM 7.0.0 has been released, Thinkpad BIOS update options, HardenedBSD Foundation announced, and ZFS send vs. rsync.","date_published":"2018-09-27T04:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/01bccaf7-cfe6-48d1-90e8-8fd66badaeb6.mp3","mime_type":"audio/mp3","size_in_bytes":61339126,"duration_in_seconds":6115}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2594","title":"Episode 264: Optimized-out | BSD Now 264","url":"https://www.bsdnow.tv/264","content_text":"FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.\n\n##Headlines\n###FreeBSD &amp; DragonFlyBSD Put Up A Strong Fight On AMD’s Threadripper 2990WX, Benchmarks Against Linux\n\n\nThe past two weeks I have been delivering a great deal of AMD Threadripper 2990WX benchmarks on Linux as well as some against Windows and Windows Server. But recently I got around to trying out some of the BSD operating systems on this 32-core / 64-thread processor to see how they would run and to see whether they would have similar scaling issues or not like we’ve seen on the Windows side against Linux. In this article are FreeBSD and DragonFlyBSD benchmarks with the X399 + 2990WX compared to a few Linux distributions.\nThe BSDs I focused my testing on were FreeBSD 11.2-STABLE and 12.0-CURRENT/ALPHA1 (the version in development) as well as iX System’s TrueOS that is tracking FreeBSD 12.0-CURRENT. Also included were DragonFlyBSD, with FreeBSD and DragonFlyBSD being tied as my favorite operating systems when it comes to the BSDs. When it came to FreeBSD 11.2-STABLE and 12.0-ALPHA1 on the Threadripper 2990WX, it worked out surprisingly well. I encountered no real issues during my two days of benchmarking on FreeBSD (and TrueOS). It was a great experience and FreeBSD was happy to exploit the 64 threads on the system.\nDragonFlyBSD was a bit of a different story… Last week when I started this BSD testing I tried DragonFly 5.2.2 as the latest stable release as well as a DragonFlyBSD 5.3 development snapshot from last week: both failed to boot in either BIOS or UEFI modes.\nBut then a few days ago DragonFlyBSD lead developer Matthew Dillon bought himself a 2990WX platform. He made the necessary changes to get DragonFlyBSD 5.3 working and he ended up finding really great performance and potential out of the platform. So I tried the latest DragonFlyBSD 5.3 daily ISO on 22 August and indeed it now booted successfully and we were off to the races. Thus there are some DragonFlyBSD 5.3 benchmarks included in this article too.\nJust hours ago, Matthew Dillon landed some 2990WX topology and scheduler enhancements but that fell out of the scope of when DragonFly was installed on this system. But over the weekend or so I plan to re-test DragonFlyBSD 5.3 and see how those optimizations affect the overall 2990WX performance now on that BSD. DragonFlyBSD 5.4 stable should certainly be an interesting release on several fronts!\nWith FreeBSD 11.2-STABLE and 12.0-ALPHA1 I ran benchmarks when using their stock compiler (LLVM Clang 6.0) as well as GCC 7.3 obtained via GCC 7.3. That was done to rule out compiler differences in benchmarking against the GCC-based Linux distributions. On DragonFlyBSD 5.3 it defaults to the GCC 5.4.1 but via pkg I also did a secondary run when upgraded to GCC 7.3.\nThe hardware and BIOS/UEFI settings were maintained the same throughout the entire benchmarking process. The system was made up of the AMD Ryzen Threadripper 2990WX at stock speeds, the ASUS ROG ZENITH EXTREME motherboard, 4 x 8GB DDR4-3200MHz memory, Samsung 970 EVO 500GB NVMe SSD, and Radeon RX Vega 56 graphics card.\nAll of these Linux vs. BSD benchmarks were carried out in a fully-automated and reproducible manner using the open-source Phoronix Test Suite benchmarking framework.\nWhile for the last of today’s BSD vs. Linux benchmarking on the Threadripper 2990WX, the Linux distributions came out slightly ahead of FreeBSD and DragonFlyBSD with GCC (another test having issues with Clang 6.0 on the BSDs).\nOverall, I was quite taken away by the BSD performance on the Threadripper 2990WX – particularly FreeBSD. In a surprising number of benchmarks, the BSDs were outperforming the tested Linux distributions though often by incredibly thin margins. Still, quite an accomplishment for these BSD operating systems and considering how much better Linux is already doing than Windows 10 / Windows Server on this 32-core / 64-thread processor. Then again, the BSDs like Linux have a long history of running on high core/thread-count systems, super computers, and other HPC environments.\nIt will be interesting to see how much faster DragonFlyBSD can run given today’s commit to its kernel with scheduler and topology improvements for the 2990WX. Those additional DragonFlyBSD benchmarks will be published in the coming days once they are completed.\n\n\n\n\n###NetBSD 7.2 released\n\n\nThe NetBSD Project is pleased to announce NetBSD 7.2, the second feature update of the NetBSD 7 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.\n\n\n\nGeneral Security Note\n\n\nThe NetBSD 7.2 release is a maintenance release of the netbsd-7 branch, which had it's first major release, NetBSD 7.0 in September 2015. A lot of security features have been added to later NetBSD versions, and for new installations we highly recommend using our latest release, NetBSD 8.0 instead.\n\n\nSome highlights of the 7.2 release are:\nSupport for USB 3.0.\nEnhancements to the Linux emulation subsystem.\nFixes in binary compatibility for ancient NetBSD executables.\niwm(4) driver for Intel Wireless 726x, 316x, 826x and 416x series added.\nSupport for Raspberry Pi 3 added.\nFix interrupt setup on Hyper-V VMs with Legacy Network Adapter.\nSVR4 and IBCS2 compatibility subsystems have been disabled by default (besides IBCS2 on VAX). These subsystems also do not auto-load their modules any more.\nVarious USB stability enhancements.\nNumerous bug fixes and stability improvements.\n\n\n\nComplete source and binaries for NetBSD 7.2 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at https://www.NetBSD.org/mirrors/. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.2 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc\nNetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:\n\n\n\n\n##News Roundup\n###Including optimized-out kernel symbols in dtrace on FreeBSD\n\n\nHave you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).\n\n\n\nIn my case, I was trying to instrument on ieee80211_ioctl_get80211, whose sister function ieee80211_ioctl_set80211 has a dtrace(1) probe in the generic FreeBSD 11 and 12 kernels. Both functions are located in /usr/src/sys/net80211/ieee80211_ioctl.c.\n\n\n\nMy first attempt was to add to /etc/make.conf as follows and recompile the kernel.\n\n\nCFLAGS+=-O0 and -fno-inline-functions\n\n\nThis failed to produce the dtrace(1) probe. Several other attempts failed and I was getting inconsistent compilation results (Is it me or is ieee80211_ioctl.c compiled with different flags if NO_CLEAN=1 is set?). When I manually compiled the object file by copying the compilation line for the object file and adding -O0 -fno-inline-functions, nm(1) on both the object file and kernel demonstrated that the symbol was present. I installed the kernel, rebooted and it was listed as a dtrace probe. Great!\n\n\n\nBut as I continued to debug my WiFi driver (oh yeah, I’m very slowly extending rtwn(4)), I found myself rebuilding the kernel several times and frequently rebooting. Why not do this across the entire kernel?\n\n\n\nAfter hacking around, my solution was to modify the build scripts. My solution was to edit /usr/src/sys/conf/kern.pre.mk and modify all optimization level 2 to optimization level 0. The following is my diff(1) on FreeBSD 12.0-CURRENT.\n\n\n\nA few thoughts:\n\n\n\nThis seems like a hack rather than a long-term solution. Either the problem is with the hard-coded optimization flags, or the inability to overwrite them in all places in make.conf.\nRemoving optimizations is only something I would do in a non-production kernel, so its as if I have to choose between optimizations for a production kernel or having dtrace probes. But dtrace explicitly markets itself as not impactful on production.\nUsing the dtrace pony as your featured image on WordPress does not render properly and must be rotated and modified. Blame Bryan Cantrill.\nIf you have a better solution, please let me know and I will update the article, but this works for me!\n\n\n\n\n###FreeBSD: UEFI Bootloader stuck on BootCurrent/BootOrder/BootInfo on Asus Motherboards (and fix!)\n\n\nStarting with FreeBSD CURRENT from about a few weeks of posting date, but including FreeBSD 12 alpha releases (not related to DEC Alpha), I noticed one thing: When I boot FreeBSD from UEFI on a homebuilt desktop with a Asus H87M-E motherboard, and have Root on ZFS, the bootloader gets stuck on lines like BootCurrent, BootOrder, and  BootInfo. This issue occurs when I try to boot directly to  efi\\boot\\bootx64.efi.\n\n\n\nOne person had a similar issue on a Asus H87I-PLUS motherboard. This issue may or may not exist on other Asus motherboards, desktops, or laptops. This may be specific to Asus motherboards for Intel’s Haswell, but may also exist on newer systems (e.g. Skylake) or older (e.g. Ivy Bridge) with Asus motherboards, as well as Asus desktops or laptops.\n\n\n\nThere are two solutions to this problem:\nUse Legacy BIOS mode instead of UEFI mode\nInstall a FreeBSD UEFI Boot entry\n\n\n\nKeep in mind that I am not going to talk about this issue and third-party UEFI boot managers such as rEFInd here.\nThe first option is rather straightforward: you need to make sure your computer has “Secure Boot” disabled and “Legacy Boot” or “CSM” enabled. Then, you need to make sure FreeBSD is installed in BIOS mode. However, this solution is (in my opinion) suboptimal. Why? Because:\nYou won’t be able to use hard drives bigger than 2TB\nYou are limited to MBR Partitioning on Asus motherboards with UEFI as Asus motherboards refuse to boot GPT partitioned disks in BIOS mode\nLegacy BIOS mode may not exist on future computers or motherboards (although those systems may not have this issue, and this issue may get fixed by then)\nThe second option, however, is less straightforward, but will let you keep UEFI. Many UEFI systems, including affected Asus motherboards described here, include a boot manager built into the UEFI. FreeBSD includes a tool called efibootmgr to manage this, similar to the similarly-named tool in Linux, but with a different syntax.\n\n\n\n\n###Why ed(1) is not a good editor today\n\n\nI’ll start with my tweet:\n\n\nHeretical Unix opinion time: ed(1) may be the 'standard Unix editor', but it is not a particularly good editor outside of a limited environment that almost never applies today.\n\n\nThere is a certain portion of Unixdom that really likes ed(1), the ‘standard Unix editor’. Having actually used ed for a not insignificant amount of time (although it was the friendlier ‘UofT ed’ variant), I have some reactions to what I feel is sometimes overzealous praise of it. One of these is what I tweeted.\nThe fundamental limitation of ed is that it is what I call an indirect manipulation interface, in contrast to the explicit manipulation interfaces of screen editors like vi and graphical editors like sam (which are generally lumped together as ‘visual’ editors, so called because they actually show you the text you’re editing). When you edit text in ed, you have some problems that you don’t have in visual editors; you have to maintain in your head the context of what the text looks like (and where you are in it), you have to figure out how to address portions of that text in order to modify them, and finally you have to think about how your edit commands will change the context. Copious use of ed’s p command can help with the first problem, but nothing really deals with the other two. In order to use ed, you basically have to simulate parts of ed in your head.\nEd is a great editor in situations where the editor explicitly presenting this context is a very expensive or outright impossible operation. Ed works great on real teletypes, for example, or over extremely slow links where you want to send and receive as little data as possible (and on real teletypes you have some amount of context in the form of an actual printout that you can look back at). Back in the old days of Unix, this described a fairly large number of situations; you had actual teletypes, you had slow dialup links (and later slow, high latency network links), and you had slow and heavily overloaded systems.\nHowever, that’s no longer the situation today (at least almost all of the time). Modern systems and links can easily support visual editors that continually show you the context of the text and generally let you more or less directly manipulate it (whether that is through cursoring around it or using a mouse). Such editors are easier and faster to use, and they leave you with more brainpower free to think about things like the program you’re writing (which is the important thing).\nIf you can use a visual editor, ed is not a particularly good editor to use instead; you will probably spend a lot of effort (and some amount of time) on doing by hand something that the visual editor will do for you. If you are very practiced at ed, maybe this partly goes away, but I maintain that you are still working harder than you need to be.\nThe people who say that ed is a quite powerful editor are correct; ed is quite capable (although sadly limited by only editing a single file). It’s just that it’s also a pain to use.\n(They’re also correct that ed is the foundation of many other things in Unix, including sed and vi. But that doesn’t mean that the best way to learn or understand those things is to learn and use ed.)\nThis doesn’t make ed a useless, vestigial thing on modern Unix, though. There are uses for ed in non-interactive editing, for example. But on modern Unix, ed is a specialized tool, much like dc. It’s worth knowing that ed is there and roughly what it can do, but it’s probably not worth learning how to use it before you need it. And you’re unlikely to ever be in a situation where it’s the best choice for interactive editing (and if you are, something has generally gone wrong).\n(But if you enjoy exploring the obscure corners of Unix, sure, go for it. Learn dc too, because it’s interesting in its own way and, like ed, it’s one of those classical old Unix programs.)\n\n\n\n\n##Beastie Bits\n\n\nIs there any interest in a #BSD user group in #Montreal?\nTell your BSD story\nFinishing leftover tasks from Google Summer of Code\nFuzzing the OpenBSD Kernel\nARM - any Tier-1 *BSD options?\n\n\n\n\n##Feedback/Questions\n\n\nChris - byhve question\nPaulo - Topic suggestion\nBostjan - How data gets to disk\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.phoronix.com/scan.php?page=article&amp;item=bsd-threadripper-2990wx&amp;num=1\">FreeBSD &amp; DragonFlyBSD Put Up A Strong Fight On AMD’s Threadripper 2990WX, Benchmarks Against Linux</a></p>\n\n<blockquote>\n<p>The past two weeks I have been delivering a great deal of AMD Threadripper 2990WX benchmarks on Linux as well as some against Windows and Windows Server. But recently I got around to trying out some of the BSD operating systems on this 32-core / 64-thread processor to see how they would run and to see whether they would have similar scaling issues or not like we’ve seen on the Windows side against Linux. In this article are FreeBSD and DragonFlyBSD benchmarks with the X399 + 2990WX compared to a few Linux distributions.<br>\nThe BSDs I focused my testing on were FreeBSD 11.2-STABLE and 12.0-CURRENT/ALPHA1 (the version in development) as well as iX System’s TrueOS that is tracking FreeBSD 12.0-CURRENT. Also included were DragonFlyBSD, with FreeBSD and DragonFlyBSD being tied as my favorite operating systems when it comes to the BSDs. When it came to FreeBSD 11.2-STABLE and 12.0-ALPHA1 on the Threadripper 2990WX, it worked out surprisingly well. I encountered no real issues during my two days of benchmarking on FreeBSD (and TrueOS). It was a great experience and FreeBSD was happy to exploit the 64 threads on the system.<br>\nDragonFlyBSD was a bit of a different story… Last week when I started this BSD testing I tried DragonFly 5.2.2 as the latest stable release as well as a DragonFlyBSD 5.3 development snapshot from last week: both failed to boot in either BIOS or UEFI modes.<br>\nBut then a few days ago DragonFlyBSD lead developer Matthew Dillon bought himself a 2990WX platform. He made the necessary changes to get DragonFlyBSD 5.3 working and he ended up finding really great performance and potential out of the platform. So I tried the latest DragonFlyBSD 5.3 daily ISO on 22 August and indeed it now booted successfully and we were off to the races. Thus there are some DragonFlyBSD 5.3 benchmarks included in this article too.<br>\nJust hours ago, Matthew Dillon landed some 2990WX topology and scheduler enhancements but that fell out of the scope of when DragonFly was installed on this system. But over the weekend or so I plan to re-test DragonFlyBSD 5.3 and see how those optimizations affect the overall 2990WX performance now on that BSD. DragonFlyBSD 5.4 stable should certainly be an interesting release on several fronts!<br>\nWith FreeBSD 11.2-STABLE and 12.0-ALPHA1 I ran benchmarks when using their stock compiler (LLVM Clang 6.0) as well as GCC 7.3 obtained via GCC 7.3. That was done to rule out compiler differences in benchmarking against the GCC-based Linux distributions. On DragonFlyBSD 5.3 it defaults to the GCC 5.4.1 but via pkg I also did a secondary run when upgraded to GCC 7.3.<br>\nThe hardware and BIOS/UEFI settings were maintained the same throughout the entire benchmarking process. The system was made up of the AMD Ryzen Threadripper 2990WX at stock speeds, the ASUS ROG ZENITH EXTREME motherboard, 4 x 8GB DDR4-3200MHz memory, Samsung 970 EVO 500GB NVMe SSD, and Radeon RX Vega 56 graphics card.<br>\nAll of these Linux vs. BSD benchmarks were carried out in a fully-automated and reproducible manner using the open-source Phoronix Test Suite benchmarking framework.<br>\nWhile for the last of today’s BSD vs. Linux benchmarking on the Threadripper 2990WX, the Linux distributions came out slightly ahead of FreeBSD and DragonFlyBSD with GCC (another test having issues with Clang 6.0 on the BSDs).<br>\nOverall, I was quite taken away by the BSD performance on the Threadripper 2990WX – particularly FreeBSD. In a surprising number of benchmarks, the BSDs were outperforming the tested Linux distributions though often by incredibly thin margins. Still, quite an accomplishment for these BSD operating systems and considering how much better Linux is already doing than Windows 10 / Windows Server on this 32-core / 64-thread processor. Then again, the BSDs like Linux have a long history of running on high core/thread-count systems, super computers, and other HPC environments.<br>\nIt will be interesting to see how much faster DragonFlyBSD can run given today’s commit to its kernel with scheduler and topology improvements for the 2990WX. Those additional DragonFlyBSD benchmarks will be published in the coming days once they are completed.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.netbsd.org/releases/formal-7/NetBSD-7.2.html\">NetBSD 7.2 released</a></p>\n\n<blockquote>\n<p>The NetBSD Project is pleased to announce NetBSD 7.2, the second feature update of the NetBSD 7 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements.</p>\n</blockquote>\n\n<ul>\n<li>General Security Note</li>\n</ul>\n\n<p><code>The NetBSD 7.2 release is a maintenance release of the netbsd-7 branch, which had it's first major release, NetBSD 7.0 in September 2015. A lot of security features have been added to later NetBSD versions, and for new installations we highly recommend using our latest release, NetBSD 8.0 instead.</code></p>\n\n<ul>\n<li>Some highlights of the 7.2 release are:</li>\n<li>Support for USB 3.0.</li>\n<li>Enhancements to the Linux emulation subsystem.</li>\n<li>Fixes in binary compatibility for ancient NetBSD executables.</li>\n<li>iwm(4) driver for Intel Wireless 726x, 316x, 826x and 416x series added.</li>\n<li>Support for Raspberry Pi 3 added.</li>\n<li>Fix interrupt setup on Hyper-V VMs with Legacy Network Adapter.</li>\n<li>SVR4 and IBCS2 compatibility subsystems have been disabled by default (besides IBCS2 on VAX). These subsystems also do not auto-load their modules any more.</li>\n<li>Various USB stability enhancements.</li>\n<li>Numerous bug fixes and stability improvements.</li>\n</ul>\n\n<blockquote>\n<p>Complete source and binaries for NetBSD 7.2 are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at <a href=\"https://www.NetBSD.org/mirrors/\">https://www.NetBSD.org/mirrors/</a>. We encourage users who wish to install via ISO or USB disk images to download via BitTorrent by using the torrent files supplied in the images area. A list of hashes for the NetBSD 7.2 distribution has been signed with the well-connected PGP key for the NetBSD Security Officer: <a href=\"https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc\">https://cdn.NetBSD.org/pub/NetBSD/security/hashes/NetBSD-7.2_hashes.asc</a><br>\nNetBSD is free. All of the code is under non-restrictive licenses, and may be used without paying royalties to anyone. Free support services are available via our mailing lists and website. Commercial support is available from a variety of sources. More extensive information on NetBSD is available from our website:</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://farhan.codes/2018/08/16/including-optimized-out-kernel-symbols-in-dtrace-on-freebsd/\">Including optimized-out kernel symbols in dtrace on FreeBSD</a></p>\n\n<blockquote>\n<p>Have you ever had dtrace(1) on FreeBSD fail to list a probe that should exist in the kernel? This is because Clang will optimize-out some functions. The result is ctfconvert(1) will not generate debugging symbols that dtrace(1) uses to identify probes. I have a quick solution to getting those probes visible to dtrace(1).</p>\n</blockquote>\n\n<blockquote>\n<p>In my case, I was trying to instrument on ieee80211_ioctl_get80211, whose sister function ieee80211_ioctl_set80211 has a dtrace(1) probe in the generic FreeBSD 11 and 12 kernels. Both functions are located in /usr/src/sys/net80211/ieee80211_ioctl.c.</p>\n</blockquote>\n\n<blockquote>\n<p>My first attempt was to add to /etc/make.conf as follows and recompile the kernel.</p>\n</blockquote>\n\n<p><code>CFLAGS+=-O0 and -fno-inline-functions</code></p>\n\n<blockquote>\n<p>This failed to produce the dtrace(1) probe. Several other attempts failed and I was getting inconsistent compilation results (Is it me or is ieee80211_ioctl.c compiled with different flags if NO_CLEAN=1 is set?). When I manually compiled the object file by copying the compilation line for the object file and adding -O0 -fno-inline-functions, nm(1) on both the object file and kernel demonstrated that the symbol was present. I installed the kernel, rebooted and it was listed as a dtrace probe. Great!</p>\n</blockquote>\n\n<blockquote>\n<p>But as I continued to debug my WiFi driver (oh yeah, I’m very slowly extending rtwn(4)), I found myself rebuilding the kernel several times and frequently rebooting. Why not do this across the entire kernel?</p>\n</blockquote>\n\n<blockquote>\n<p>After hacking around, my solution was to modify the build scripts. My solution was to edit /usr/src/sys/conf/kern.pre.mk and modify all optimization level 2 to optimization level 0. The following is my diff(1) on FreeBSD 12.0-CURRENT.</p>\n</blockquote>\n\n<ul>\n<li>A few thoughts:</li>\n</ul>\n\n<blockquote>\n<p>This seems like a hack rather than a long-term solution. Either the problem is with the hard-coded optimization flags, or the inability to overwrite them in all places in make.conf.<br>\nRemoving optimizations is only something I would do in a non-production kernel, so its as if I have to choose between optimizations for a production kernel or having dtrace probes. But dtrace explicitly markets itself as not impactful on production.<br>\nUsing the dtrace pony as your featured image on WordPress does not render properly and must be rotated and modified. Blame Bryan Cantrill.<br>\nIf you have a better solution, please let me know and I will update the article, but this works for me!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.neelc.org/freebsd-uefi-on-asus-motherboards/\">FreeBSD: UEFI Bootloader stuck on BootCurrent/BootOrder/BootInfo on Asus Motherboards (and fix!)</a></p>\n\n<blockquote>\n<p>Starting with FreeBSD CURRENT from about a few weeks of posting date, but including FreeBSD 12 alpha releases (not related to DEC Alpha), I noticed one thing: When I boot FreeBSD from UEFI on a homebuilt desktop with a Asus H87M-E motherboard, and have Root on ZFS, the bootloader gets stuck on lines like BootCurrent, BootOrder, and  BootInfo. This issue occurs when I try to boot directly to  efi\\boot\\bootx64.efi.</p>\n</blockquote>\n\n<blockquote>\n<p>One person had a similar issue on a Asus H87I-PLUS motherboard. This issue may or may not exist on other Asus motherboards, desktops, or laptops. This may be specific to Asus motherboards for Intel’s Haswell, but may also exist on newer systems (e.g. Skylake) or older (e.g. Ivy Bridge) with Asus motherboards, as well as Asus desktops or laptops.</p>\n</blockquote>\n\n<ul>\n<li>There are two solutions to this problem:</li>\n<li>Use Legacy BIOS mode instead of UEFI mode</li>\n<li>Install a FreeBSD UEFI Boot entry</li>\n</ul>\n\n<blockquote>\n<p>Keep in mind that I am not going to talk about this issue and third-party UEFI boot managers such as rEFInd here.<br>\nThe first option is rather straightforward: you need to make sure your computer has “Secure Boot” disabled and “Legacy Boot” or “CSM” enabled. Then, you need to make sure FreeBSD is installed in BIOS mode. However, this solution is (in my opinion) suboptimal. Why? Because:<br>\nYou won’t be able to use hard drives bigger than 2TB<br>\nYou are limited to MBR Partitioning on Asus motherboards with UEFI as Asus motherboards refuse to boot GPT partitioned disks in BIOS mode<br>\nLegacy BIOS mode may not exist on future computers or motherboards (although those systems may not have this issue, and this issue may get fixed by then)<br>\nThe second option, however, is less straightforward, but will let you keep UEFI. Many UEFI systems, including affected Asus motherboards described here, include a boot manager built into the UEFI. FreeBSD includes a tool called efibootmgr to manage this, similar to the similarly-named tool in Linux, but with a different syntax.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/unix/EdNoLongerGoodEditor\">Why ed(1) is not a good editor today</a></p>\n\n<blockquote>\n<p>I’ll start with my tweet:</p>\n</blockquote>\n\n<p><code>Heretical Unix opinion time: ed(1) may be the 'standard Unix editor', but it is not a particularly good editor outside of a limited environment that almost never applies today.</code></p>\n\n<blockquote>\n<p>There is a certain portion of Unixdom that really likes ed(1), the ‘standard Unix editor’. Having actually used ed for a not insignificant amount of time (although it was the friendlier ‘UofT ed’ variant), I have some reactions to what I feel is sometimes overzealous praise of it. One of these is what I tweeted.<br>\nThe fundamental limitation of ed is that it is what I call an indirect manipulation interface, in contrast to the explicit manipulation interfaces of screen editors like vi and graphical editors like sam (which are generally lumped together as ‘visual’ editors, so called because they actually show you the text you’re editing). When you edit text in ed, you have some problems that you don’t have in visual editors; you have to maintain in your head the context of what the text looks like (and where you are in it), you have to figure out how to address portions of that text in order to modify them, and finally you have to think about how your edit commands will change the context. Copious use of ed’s p command can help with the first problem, but nothing really deals with the other two. In order to use ed, you basically have to simulate parts of ed in your head.<br>\nEd is a great editor in situations where the editor explicitly presenting this context is a very expensive or outright impossible operation. Ed works great on real teletypes, for example, or over extremely slow links where you want to send and receive as little data as possible (and on real teletypes you have some amount of context in the form of an actual printout that you can look back at). Back in the old days of Unix, this described a fairly large number of situations; you had actual teletypes, you had slow dialup links (and later slow, high latency network links), and you had slow and heavily overloaded systems.<br>\nHowever, that’s no longer the situation today (at least almost all of the time). Modern systems and links can easily support visual editors that continually show you the context of the text and generally let you more or less directly manipulate it (whether that is through cursoring around it or using a mouse). Such editors are easier and faster to use, and they leave you with more brainpower free to think about things like the program you’re writing (which is the important thing).<br>\nIf you can use a visual editor, ed is not a particularly good editor to use instead; you will probably spend a lot of effort (and some amount of time) on doing by hand something that the visual editor will do for you. If you are very practiced at ed, maybe this partly goes away, but I maintain that you are still working harder than you need to be.<br>\nThe people who say that ed is a quite powerful editor are correct; ed is quite capable (although sadly limited by only editing a single file). It’s just that it’s also a pain to use.<br>\n(They’re also correct that ed is the foundation of many other things in Unix, including sed and vi. But that doesn’t mean that the best way to learn or understand those things is to learn and use ed.)<br>\nThis doesn’t make ed a useless, vestigial thing on modern Unix, though. There are uses for ed in non-interactive editing, for example. But on modern Unix, ed is a specialized tool, much like dc. It’s worth knowing that ed is there and roughly what it can do, but it’s probably not worth learning how to use it before you need it. And you’re unlikely to ever be in a situation where it’s the best choice for interactive editing (and if you are, something has generally gone wrong).<br>\n(But if you enjoy exploring the obscure corners of Unix, sure, go for it. Learn dc too, because it’s interesting in its own way and, like ed, it’s one of those classical old Unix programs.)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://twitter.com/DavieDavieDave/status/1040359656864903169\">Is there any interest in a #BSD user group in #Montreal?</a></li>\n<li><a href=\"https://www.bsdjobs.com/people/hi.html\">Tell your BSD story</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/finishing_leftover_tasks_from_google\">Finishing leftover tasks from Google Summer of Code</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180906072459\">Fuzzing the OpenBSD Kernel</a></li>\n<li><a href=\"http://lists.nycbug.org/pipermail/talk/2018-August/017692.html\">ARM - any Tier-1 *BSD options?</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Chris - <a href=\"http://dpaste.com/2Y6XBYN\">byhve question</a></li>\n<li>Paulo - <a href=\"http://dpaste.com/1A88F2W\">Topic suggestion</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/140ZHZD#wrap\">How data gets to disk</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"FreeBSD and DragonflyBSD benchmarks on AMD’s Threadripper, NetBSD 7.2 has been released, optimized out DTrace kernel symbols, stuck UEFI bootloaders, why ed is not a good editor today, tell your BSD story, and more.","date_published":"2018-09-20T01:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/870be997-e69a-4290-b287-0465a463522d.mp3","mime_type":"audio/mp3","size_in_bytes":43367569,"duration_in_seconds":4318}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2528","title":"Episode 263: Encrypt That Pool | BSD Now 263","url":"https://www.bsdnow.tv/263","content_text":"Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.\n\n\n##Headlines\n###How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD\n\n\nAs recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article?\nSpectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this.\nPatching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work.\nWhat is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now.\nIn order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this.\nInstead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it\n\n\n\nSee the article for the technical breakdown\n\n\n\n\n###A look beyond the BSD teacup: OmniOS installation\n\n\nFive years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.\n\n\n\nWhy Illumos / OmniOS?\n\n\n\nThere are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS?\nAlso the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system.\nOf course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general.\nIn the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.”\nBut then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;&amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.\n\n\n\nWhat’s next?\n\n\n\nThat’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!\n\n\n\n\n###What are all these types of memory in top(1)?\n\n\nEarlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites\nMark updated the explanations to be more correct, and to include more technical detail for inquiring minds\nHe also added the new type that appeared in FreeBSD somewhat recently\n\n\n\nActive - Contains memory “actively” (recently) being used by applications\nInactive - Contains memory that has not been touched recently, or was released from the Buffer Cache\nLaundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again\nWired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC\nBuf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC)\nFree - Memory that is immediately available for use by the rest of the system\n\n\n\n\n##News Roundup\n###OpenBSD saves me again! — Debug a memory corruption issue\n\n\nYesterday, I came across a third-part library issue, which crashes at allocating memory:\n\n\nProgram terminated with signal SIGSEGV, Segmentation fault.\n#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6\n(gdb) bt\n#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6\n#1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6\n#2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50\n\n\nIt is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way:\n(1) Open all warnings during compilation: -Wall. Nothing found.\n(2) Use valgrind, but unfortunately, valgrind crashes itself:\n\n\nvalgrind: the 'impossible' happened:\nKilled by fatal signal\n\nhost stacktrace:\n==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303)\n==43326== by 0x58053139: get_bszB (m_mallocfree.c:315)\n==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799)\n==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372)\n==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427)\n==43326== by 0x5809F785: do_client_request (scheduler.c:1866)\n==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433)\n==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103)\n==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)\n\nsched status:\nrunning_tid=1\n\n\n(3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect.\n(4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:\n\n\nProgram terminated with signal SIGSEGV, Segmentation fault.\n#0 0x000014b07f01e52d in addMod (r=&lt;error reading variable&gt;, a=4693443247995522, b=28622907746665631,\n\n\nI figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!\n\n\n\n\n###Native Encryption for ZFS on FreeBSD (Call for Testing)\n\n\nTo anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: https://github.com/mattmacy/networking.git\n\n\ngit clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820\n\n\nThe UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location.\nPlease note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted.\nBy way of background the original ZoL commit can be found at:\n\n\n\nhttps://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49\n\n\n\n\n###VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance\n\n\nDuring its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud.\nSurveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds.\nThis focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention.\nAnother major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology.\nThe iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution.\nAnother special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year.\nOverall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!\n\n\n\n\n###End of life for NetBSD 6.x\n\n\nIn keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.\n\n\n\n\nAs of now, the following branches are no longer maintained:\n\n\nnetbsd-6-1\n\n\nnetbsd-6-0\n\n\nnetbsd-6\n\n\nThis means:\n\n\nThere will be no more pullups to those branches (even for security issues)\n\n\nThere will be no security advisories made for any those branches\n\n\nThe existing 6.x releases on ftp.NetBSD.org will be moved into /pub/NetBSD-archive/\n\n\nMay NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)\n\n\n\n\n\n##Beastie Bits\n\n\nBlast from the past: OpenBSD 3.7 CD artwork\nPeople are asking about scale of BSD projects. Let’s figure it out…\nTuesday, 21 August 18: me, on ed(1), at SemiBUG\narm64 gains RETGUARD\nCall for participation\nFreeBSD-UPB/bhyvearm64-utils\n\n\n\n\n##Feedback/Questions\n\n\nEric - FreeNAS for Vacation\nPatrick - Long Live Unix\nJason - Jason - Full MP3 Recordings\nBostjan - Question about jails and kernel\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.<br>\n<hr></p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.adminbyaccident.com/freebsd/how-to-freebsd/how-to-mitigate-spectre-and-meltdown-on-an-hp-proliant-server-with-freebsd/\">How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD</a></p>\n\n<blockquote>\n<p>As recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article?<br>\nSpectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this.<br>\nPatching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work.<br>\nWhat is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now.<br>\nIn order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this.<br>\nInstead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it</p>\n</blockquote>\n\n<ul>\n<li>See the article for the technical breakdown</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://eerielinux.wordpress.com/2018/08/25/a-look-beyond-the-bsd-teacup-omnios-installation/\">A look beyond the BSD teacup: OmniOS installation</a></p>\n\n<blockquote>\n<p>Five years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.</p>\n</blockquote>\n\n<ul>\n<li>Why Illumos / OmniOS?</li>\n</ul>\n\n<blockquote>\n<p>There are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS?<br>\nAlso the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system.<br>\nOf course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general.<br>\nIn the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.”<br>\nBut then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;&amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.</p>\n</blockquote>\n\n<ul>\n<li>What’s next?</li>\n</ul>\n\n<blockquote>\n<p>That’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://wiki.freebsd.org/Memory\">What are all these types of memory in top(1)?</a></p>\n\n<ul>\n<li>Earlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites</li>\n<li>Mark updated the explanations to be more correct, and to include more technical detail for inquiring minds</li>\n<li>He also added the new type that appeared in FreeBSD somewhat recently</li>\n</ul>\n\n<blockquote>\n<p>Active - Contains memory “actively” (recently) being used by applications<br>\nInactive - Contains memory that has not been touched recently, or was released from the Buffer Cache<br>\nLaundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again<br>\nWired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC<br>\nBuf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC)<br>\nFree - Memory that is immediately available for use by the rest of the system</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://nanxiao.me/en/openbsd-saves-me-again-debug-a-memory-corruption-issue/\">OpenBSD saves me again! — Debug a memory corruption issue</a></p>\n\n<blockquote>\n<p>Yesterday, I came across a third-part library issue, which crashes at allocating memory:</p>\n</blockquote>\n\n<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>\n<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>\n<code>(gdb) bt</code><br>\n<code>#0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6</code><br>\n<code>#1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6</code><br>\n<code>#2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50</code></p>\n\n<blockquote>\n<p>It is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way:<br>\n(1) Open all warnings during compilation: -Wall. Nothing found.<br>\n(2) Use valgrind, but unfortunately, valgrind crashes itself:</p>\n</blockquote>\n\n<p><code>valgrind: the 'impossible' happened:</code><br>\n<code>Killed by fatal signal</code><br>\n<code></code><br>\n<code>host stacktrace:</code><br>\n<code>==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303)</code><br>\n<code>==43326== by 0x58053139: get_bszB (m_mallocfree.c:315)</code><br>\n<code>==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799)</code><br>\n<code>==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372)</code><br>\n<code>==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427)</code><br>\n<code>==43326== by 0x5809F785: do_client_request (scheduler.c:1866)</code><br>\n<code>==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433)</code><br>\n<code>==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103)</code><br>\n<code>==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)</code><br>\n<code></code><br>\n<code>sched status:</code><br>\n<code>running_tid=1</code></p>\n\n<blockquote>\n<p>(3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect.<br>\n(4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:</p>\n</blockquote>\n\n<p><code>Program terminated with signal SIGSEGV, Segmentation fault.</code><br>\n<code>#0 0x000014b07f01e52d in addMod (r=&lt;error reading variable&gt;, a=4693443247995522, b=28622907746665631,</code></p>\n\n<blockquote>\n<p>I figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html\">Native Encryption for ZFS on FreeBSD (Call for Testing)</a></p>\n\n<blockquote>\n<p>To anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: <a href=\"https://github.com/mattmacy/networking.git\">https://github.com/mattmacy/networking.git</a></p>\n</blockquote>\n\n<p><code>git clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820</code></p>\n\n<blockquote>\n<p>The UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location.<br>\nPlease note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted.<br>\nBy way of background the original ZoL commit can be found at:</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49\">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.ixsystems.com/blog/vmworld2018/\">VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance</a></p>\n\n<blockquote>\n<p>During its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud.<br>\nSurveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds.<br>\nThis focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention.<br>\nAnother major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology.<br>\nThe iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution.<br>\nAnother special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year.<br>\nOverall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/end_of_life_for_netbsd1\">End of life for NetBSD 6.x</a></p>\n\n<blockquote>\n<p>In keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>As of now, the following branches are no longer maintained:</p>\n</li>\n<li>\n<p>netbsd-6-1</p>\n</li>\n<li>\n<p>netbsd-6-0</p>\n</li>\n<li>\n<p>netbsd-6</p>\n</li>\n<li>\n<p>This means:</p>\n</li>\n<li>\n<p>There will be no more pullups to those branches (even for security issues)</p>\n</li>\n<li>\n<p>There will be no security advisories made for any those branches</p>\n</li>\n<li>\n<p>The existing 6.x releases on <a href=\"http://ftp.NetBSD.org\">ftp.NetBSD.org</a> will be moved into /pub/NetBSD-archive/</p>\n</li>\n<li>\n<p>May NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://imgur.com/a/fkzTwYm\">Blast from the past: OpenBSD 3.7 CD artwork</a></li>\n<li><a href=\"https://twitter.com/romanzolotarev/status/1030345831751270400\">People are asking about scale of BSD projects. Let’s figure it out…</a></li>\n<li><a href=\"https://mwl.io/archives/3642\">Tuesday, 21 August 18: me, on ed(1), at SemiBUG</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180813133939\">arm64 gains RETGUARD</a></li>\n<li><a href=\"https://fosdem.org/2019/news/2018-08-10-call-for-participation/\">Call for participation</a></li>\n<li><a href=\"https://github.com/FreeBSD-UPB/bhyvearm64-utils\">FreeBSD-UPB/bhyvearm64-utils</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Eric - <a href=\"http://dpaste.com/2GY2S6T#wrap\">FreeNAS for Vacation</a></li>\n<li>Patrick - <a href=\"http://dpaste.com/347WCR3\">Long Live Unix</a></li>\n<li>Jason - <a href=\"http://dpaste.com/1B7E8F5#wrap\">Jason - Full MP3 Recordings</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/34AQNSE#wrap\">Question about jails and kernel</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.","date_published":"2018-09-07T14:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/c8edc035-36d5-4699-a081-43c1e08686bf.mp3","mime_type":"audio/mp3","size_in_bytes":38437869,"duration_in_seconds":3825}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2521","title":"Episode 262: OpenBSD Surfacing | BSD Now 262","url":"https://www.bsdnow.tv/262","content_text":"OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.\n\n##Headlines\n###OpenBSD on the Microsoft Surface Go\n\n\nFor some reason I like small laptops and the constraints they place on me (as long as they’re still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11\" MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.\n\n\n\nHardware\n\n\n\nThe Surface Go is available in two hardware configurations: one with 4Gb of RAM and a 64Gb eMMC, and another with 8Gb of RAM with a 128Gb NVMe SSD. (I went with the latter.) Both ship with an Intel Pentium Gold 4415Y processor which is not very fast, but it’s certainly usable.\nThe tablet measures 9.65\" across, 6.9\" tall, and 0.3\" thick. Its 10\" diagonal 3:2 touchscreen is covered with Gorilla Glass and has a resolution of 1800x1200. The bezel is quite large, especially for such a small screen, but it makes sense on a device that is meant to be held, to avoid accidental screen touches.\nThe keyboard and touchpad are located on a separate, removable slab called the Surface Go Signature Type Cover which is sold separately. I opted for the “cobalt blue” cover which has a soft, cloth-like alcantara material. The cover attaches magnetically along the bottom edge of the device and presents USB-attached keyboard and touchpad devices. When the cover is folded up against the screen, it sends an ACPI sleep signal and is held to the screen magnetically. During normal use, the cover can be positioned flat on a surface or slightly raised up about 3/4\" near the screen for better ergonomics. When using the device as a tablet, the cover can be rotated behind the screen which causes it to automatically stop sending keyboard and touchpad events until it is rotated back around.\nThe keyboard has a decent amount of key travel and a good layout, with Home/End/Page Up/Page Down being accessible via Fn+Left/Right/Up/Down but also dedicated Home/End/Page Up/Page Down keys on the F9-F12 keys which I find quite useful since the keyboard layout is somewhat small. By default, the F1-F12 keys do not send F1-F12 key codes and Fn must be used, either held down temporarily or Fn pressed by itself to enable Fn-lock which annoyingly keeps the bright Fn LED illuminated. The keys are backlit with three levels of adjustment, handled by the keyboard itself with the F7 key.\nThe touchpad on the Type Cover is a Windows Precision Touchpad connected via USB HID. It has a decent click feel but when the cover is angled up instead of flat on a surface, it sounds a bit hollow and cheap.\n\n\n\nSurface Go Pen\n\n\n\nThe touchscreen is powered by an Elantech chip connected via HID-over-i2c, which also supports pen input. A Surface Pen digitizer is available separately from Microsoft and comes in the same colors as the Type Covers. The pen works without any pairing necessary, though the top button on it works over Bluetooth so it requires pairing to use. Either way, the pen requires an AAAA battery inside it to operate. The Surface Pen can attach magnetically to the left side of the screen when not in use.\nA kickstand can swing out behind the display to use the tablet in a laptop form factor, which can adjust to any angle up to about 170 degrees. The kickstand stays firmly in place wherever it is positioned, which also means it requires a bit of force to pull it out when initially placing the Surface Go on a desk.\nAlong the top of the display are a power button and physical volume rocker buttons. Along the right side are the 3.5mm headphone jack, USB-C port, power port, and microSD card slot located behind the kickstand.\nCharging can be done via USB-C or the dedicated charge port, which accommodates a magnetically-attached, thin barrel similar to Apple’s first generation MagSafe adapter. The charging cable has a white LED that glows when connected, which is kind of annoying since it’s near the mid-line of the screen rather than down by the keyboard. Unlike Apple’s MagSafe, the indicator light does not indicate whether the battery is charged or not. The barrel charger plug can be placed up or down, but in either direction I find it puts an awkward strain on the power cable coming out of it due to the vertical position of the port.\nWireless connectivity is provided by a Qualcomm Atheros QCA6174 802.11ac chip which also provides Bluetooth connectivity.\nMost of the sensors on the device such as the gyroscope and ambient light sensor are connected behind an Intel Sensor Hub PCI device, which provides some power savings as the host CPU doesn’t have to poll the sensors all the time.\n\n\n\nFirmware\n\n\n\nThe Surface Go’s BIOS/firmware menu can be entered by holding down the Volume Up button, then pressing and releasing the Power button, and releasing Volume Up when the menu appears. Secure Boot as well as various hardware components can be disabled in this menu. Boot order can also be adjusted. A temporary boot menu can be brought up the same way but using Volume Down instead.\n\n\n\n\n###FreeBSD Foundation Update, August 2018\n\n\nMESSAGE FROM THE EXECUTIVE DIRECTOR\n\n\n\nDear FreeBSD Community Member,\nIt’s been a busy summer for the Foundation. From traveling around the globe spreading the word about FreeBSD to bringing on new team members to improve the Project’s Continuous Integration work, we’re very excited about what we’ve accomplished. Take a minute to check out the latest updates within our Foundation sponsored projects; read more about our advocacy efforts in Bangladesh and community building in Cambridge; don’t miss upcoming Travel Grant deadlines, and new Developer Summits; and be sure to find out how your support will ensure our progress continues into 2019.\nWe can’t do this without you! Happy reading!! Deb\n\n\n\nAugust 2018 Development Projects Update\nFundraising Update: Supporting the Project\nAugust 2018 Release Engineering Update\nBSDCam 2018 Recap\nOctober 2018 FreeBSD Developer Summit Call for Participation\nSANOG32 and COSCUP 2018 Recap\nMeetBSD 2018 Travel Grant Application Deadline: September 7\n\n\n\n\n##News Roundup\n###Project Trident: What’s taking so long?\n\n\nWhat is taking so long?\n\n\n\nThe short answer is that it’s complicated.\nProject Trident is quite literally a test of the new TrueOS build system. As expected, there have been quite a few bugs, undocumented features, and other optional bits that we discovered we needed that were not initially present. All of these things have to be addressed and retested in a constant back and forth process.\nWhile Ken and JT are both experienced developers, neither has done this kind of release engineering before. JT has done some release engineering back in his Linux days, but the TrueOS and FreeBSD build system is very different. Both Ken and JT are learning a completely new way of building a FreeBSD/TrueOS distribution. Please keep in mind that no one has used this new TrueOS build system before, so Ken and JT want to not only provide a good Trident release, but also provide a model or template for other potential TrueOS distributions too!\n\n\n\nWhere are we now?\n\n\n\nThrough perseverance, trial and error, and a lot of head-scratching we have reached the point of having successful builds. It took a while to get there, but now we are simply working out a few bugs with the new installer that Ken wrote as well as finding and fixing all the new Xorg configuration options which recently landed in FreeBSD. We also found that a number of services have been removed or replaced between TrueOS 18.03 and 18.06 so we are needing to adjust what we consider the “base” services for the desktop. All of these issues are being resolved and we are continually rebuilding and pulling in new patches from TrueOS as soon as they are committed.\nIn the meantime we have made an early BETA release of Trident available to the users in our Telegram Channel for those who want to help out in testing these early versions.\n\n\n\nDo you foresee any other delays?\n\n\n\nAt the moment we are doing many iterations of testing and tweaking the install ISO and package configurations in order to ensure that all the critical functionality works out-of-box (networking, sound, video, basic apps, etc). While we do not foresee any other major delays, sometimes things happen that our outside of our control. For an example, one of the recent delays that hit recently was completely unexpected: we had a hard drive failure on our build server. Up until recently, The aptly named “Poseidon” build server was running a Micron m500dc drive, but that drive is now constantly reporting errors. Despite ordering a replacement Western Digital Blue SSD several weeks ago, we just received it this past week. The drive is now installed with the builder back to full functionality, but we did lose many precious days with the delay.\nThe build server for Project Trident is very similar to the one that JT donated to the TrueOS project. JT had another DL580 G7, so he donated one to the Trident Project for their build server. Poseidon also has 256GB RAM (64 x 4GB sticks) which is a smidge higher than what the TrueOS builder has.\nSince we are talking about hardware, we probably should address another question we get often, “What Hardware are the devs testing on?” So let’s go ahead and answer that one now.\n\n\n\n\nDeveloper Hardware\n\n\nJT: His main test box is a custom-built Intel i7 7700K system running 32GB RAM, dual Intel Optane 900P drives, and an Nvidia 1070 GTX with four 4K Acer Monitors. He also uses a Lenovo x250 ThinkPad alongside a desk full of x230t and x220 ThinkPads. One of which he gave away at SouthEast LinuxFest this year, which you can read about here.  However it’s not done there, being a complete hardware hoarder, JT also tests on several Intel NUCs and his second laptop a Fujitsu t904, not to mention a Plethora of HP DL580 servers, a DL980 server, and a stack of BL485c, BL460c, and BL490c Blades in his HP c7000 and c3000 Bladecenter chassis. (Maybe it’s time for an intervention for his hardware collecting habits)\n\n\nKen: For a laptop, he primarily uses a 3rd generation X1 Carbon, but also has an old Eee PC T101MT Netbook (dual core 1GHz, 2GB of memory) which he uses for verifying how well Trident works on low-end hardware. As far as workstations go, his office computer is an Intel i7 with an NVIDIA Geforce GTX 960 running three 4K monitors and he has a couple other custom-built workstations (1 AMD, 1 Intel+NVIDIA) at his home. Generally he assembled random workstations based on hardware that was given to him or that he could acquire cheap.\n\n\nTim: is using a third gen X1 Carbon and a custom built desktop with an Intel Core i5-4440 CPU, 16 GiB RAM, Nvidia GeForce GTX 750 Ti, and a RealTek 8168 / 8111 network card.\n\n\nRod: Rod uses… No one knows what Rod uses, It’s kinda like how many licks does it take to get to the center of a Tootsie-Roll Tootsie-Pop… the world may just never know.\n\n\n\n\n\n###NetBSD GSoC: pkgsrc config file versioning\n\n\nA series of reports from the course of the summer on this Google Summer of Code project\nThe goal of the project is to integrate with a VCS (Version Control System) to make managing local changes to config files for packages easier\nGSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1\n\n\n\nPackages may install code (both machine executable code and interpreted programs), documentation and manual pages, source headers, shared libraries and other resources such as graphic elements, sounds, fonts, document templates, translations and configuration files, or a combination of them.\nConfiguration files are usually the means through which the behaviour of software without a user interface is specified. This covers parts of the operating systems, network daemons and programs in general that don’t come with an interactive graphical or textual interface as the principal mean for setting options.\nSystem wide configuration for operating system software tends to be kept under /etc, while configuration for software installed via pkgsrc ends up under LOCALBASE/etc (e.g., /usr/pkg/etc).\nSoftware packaged as part of pkgsrc provides example configuration files, if any, which usually get extracted to LOCALBASE/share/examples/PKGBASE/.\nDon’t worry: automatic merging is disabled by default, set $VCSAUTOMERGE to enable it.\nIn order to avoid breakage, installed configuration is backed up first in the VCS, separating user-modified files from files that have been already automatically merged in the past, in order to allow the administrator to easily restore the last manually edited file in case of breakage.\nVCS functionality only applies to configuration files, not to rc.d scripts, and only if the environment variable $NOVCS is unset.\nThe version control system to be used as a backend can be set through $VCS. It default to RCS, the Revision Control System, which works only locally and doesn’t support atomic transactions.\nOther backends such as CVS are supported and more will come; these, being used at the explicit request of the administrator, need to be already installed and placed in a directory part of $PATH.\n\n\n\nGSoC 2018 Reports: Configuration files versioning in pkgsrc, part 2: remote repositories (git and CVS)\n\n\n\npkgsrc is now able to deploy configuration from packages being installed from a remote, site-specific vcs repository.\nUser modified files are always tracked even if automerge functionality is not enabled, and a new tool, pkgconftrack(1), exists to manually store user changes made outside of package upgrade time.\nVersion Control software is executed as the same user running pkg_add or make install, unless the user is “root”. In this case, a separate, unprivileged user, pkgvcsconf, gets created with its own home directory and a working login shell (but no password). The home directory is not strictly necessary, it exists to facilitate migrations betweens repositories and vcs changes; it also serves to store keys used to access remote repositories.\nUsing git instead of rcs is simply done by setting VCS=git in pkg_install.conf\n\n\n\nGSoC 2018 Reports: Configuration files versioning in pkgsrc, part 3: remote repositories (SVN and Mercurial)\nGSoC 2018 Reports: Configuration files versioning in pkgsrc, part 4: configuration deployment, pkgtools and future improvements\n\n\n\nSupport for configuration tracking is in scripts, pkginstall scripts, that get built into binary packages and are run by pkg_add upon installation. The idea behind the proposal suggested that users of the new feature should be able to store revisions of their installed configuration files, and of package-provided default, both in local or remote repositories. With this capability in place, it doesn’t take much to make the scripts “pull” configuration from a VCS repository at installation time.\nThat’s what setting VCSCONFPULL=yes in pkg_install.conf after having enabled VCSTRACK_CONF does: You are free to use official, third party prebuilt packages that have no customization in them, enable these options, and point pkgsrc to a private conf repository. If it contains custom configuration for the software you are installing, an attempt will be made to use it and install it on your system. If it fails, pkginstall will fall back to using the defaults that come inside the package. RC scripts are always deployed from the binary package, if existing and PKG_RCD_SCRIPTS=yes in pkg_install.conf or the environment.\nThis will be part of packages, not a separate solution like configuration management tools. It doesn’t support running scripts on the target system to customize the installation, it doesn’t come with its domain-specific language, it won’t run as a daemon or require remote logins to work. It’s quite limited in scope, but you can define a ROLE for your system in pkg_install.conf or in the environment, and pkgsrc will look for configuration you or your organization crafted for such a role (e.g., public, standalone webserver vs reverse proxy or node in a database cluster)\n\n\n\n\n###A little bit of the one-time MacOS version still lingers in ZFS\n\n\nOnce upon a time, Apple came very close to releasing ZFS as part of MacOS. Apple did this work in its own copy of the ZFS source base (as far as I know), but the people in Sun knew about it and it turns out that even today there is one little lingering sign of this hoped-for and perhaps prepared-for ZFS port in the ZFS source code. Well, sort of, because it’s not quite in code.\nLurking in the function that reads ZFS directories to turn (ZFS) directory entries into the filesystem independent format that the kernel wants is the following comment:\n\n\nobjnum = ZFS_DIRENT_OBJ(zap.za_first_integer);\n/*\n* MacOS X can extract the object type here such as:\n* uint8_t type = ZFS_DIRENT_TYPE(zap.za_first_integer);\n*/\n\n\nSpecifically, this is in zfs_readdir in zfs_vnops.c .\n\n\n\nZFS maintains file type information in directories. This information can’t be used on Solaris (and thus Illumos), where the overall kernel doesn’t have this in its filesystem independent directory entry format, but it could have been on MacOS (‘Darwin’), because MacOS is among the Unixes that support d_type. The comment itself dates all the way back to this 2007 commit, which includes the change ‘reserve bits in directory entry for file type’, which created the whole setup for this.\nI don’t know if this file type support was added specifically to help out Apple’s MacOS X port of ZFS, but it’s certainly possible, and in 2007 it seems likely that this port was at least on the minds of ZFS developers. It’s interesting but understandable that FreeBSD didn’t seem to have influenced them in the same way, at least as far as comments in the source code go; this file type support is equally useful for FreeBSD, and the FreeBSD ZFS port dates to 2007 too (per this announcement).\nRegardless of the exact reason that ZFS picked up maintaining file type information in directory entries, it’s quite useful for people on both FreeBSD and Linux that it does so. File type information is useful for any number of things and ZFS filesystems can (and do) provide this information on those Unixes, which helps make ZFS feel like a truly first class filesystem, one that supports all of the expected general system features.\n\n\n\n\n##Beastie Bits\n\n\nMac-like FreeBSD Laptop\nSyncthing on FreeBSD\nNew ZFS Boot Environments Tool\nMy system’s time was so wrong, that even ntpd didn’t work\nOpenSSH 7.8/7.8p1 (2018-08-24)\nEuroBSD (Sept 20-23rd) registration Early Bird Period is coming to an end\nMeetBSD (Oct 18-20th) is coming up fast, hurry up and register!\nAsiaBSDcon 2019 Dates\n\n\n\n\n##Feedback/Questions\n\n\nWill - Kudos and a Question\nPeter - Fanless Computers\nRon - ZFS disk clone or replace or something\nBostjan - ZFS Record Size\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://jcs.org/2018/08/31/surface_go\">OpenBSD on the Microsoft Surface Go</a></p>\n\n<blockquote>\n<p>For some reason I like small laptops and the constraints they place on me (as long as they’re still usable). I used a Dell Mini 9 for a long time back in the netbook days and was recently using an 11&quot; MacBook Air as my primary development machine for many years. Recently Microsoft announced a smaller, cheaper version of its Surface tablets called Surface Go which piqued my interest.</p>\n</blockquote>\n\n<ul>\n<li>Hardware</li>\n</ul>\n\n<blockquote>\n<p>The Surface Go is available in two hardware configurations: one with 4Gb of RAM and a 64Gb eMMC, and another with 8Gb of RAM with a 128Gb NVMe SSD. (I went with the latter.) Both ship with an Intel Pentium Gold 4415Y processor which is not very fast, but it’s certainly usable.<br>\nThe tablet measures 9.65&quot; across, 6.9&quot; tall, and 0.3&quot; thick. Its 10&quot; diagonal 3:2 touchscreen is covered with Gorilla Glass and has a resolution of 1800x1200. The bezel is quite large, especially for such a small screen, but it makes sense on a device that is meant to be held, to avoid accidental screen touches.<br>\nThe keyboard and touchpad are located on a separate, removable slab called the Surface Go Signature Type Cover which is sold separately. I opted for the “cobalt blue” cover which has a soft, cloth-like alcantara material. The cover attaches magnetically along the bottom edge of the device and presents USB-attached keyboard and touchpad devices. When the cover is folded up against the screen, it sends an ACPI sleep signal and is held to the screen magnetically. During normal use, the cover can be positioned flat on a surface or slightly raised up about 3/4&quot; near the screen for better ergonomics. When using the device as a tablet, the cover can be rotated behind the screen which causes it to automatically stop sending keyboard and touchpad events until it is rotated back around.<br>\nThe keyboard has a decent amount of key travel and a good layout, with Home/End/Page Up/Page Down being accessible via Fn+Left/Right/Up/Down but also dedicated Home/End/Page Up/Page Down keys on the F9-F12 keys which I find quite useful since the keyboard layout is somewhat small. By default, the F1-F12 keys do not send F1-F12 key codes and Fn must be used, either held down temporarily or Fn pressed by itself to enable Fn-lock which annoyingly keeps the bright Fn LED illuminated. The keys are backlit with three levels of adjustment, handled by the keyboard itself with the F7 key.<br>\nThe touchpad on the Type Cover is a Windows Precision Touchpad connected via USB HID. It has a decent click feel but when the cover is angled up instead of flat on a surface, it sounds a bit hollow and cheap.</p>\n</blockquote>\n\n<ul>\n<li>Surface Go Pen</li>\n</ul>\n\n<blockquote>\n<p>The touchscreen is powered by an Elantech chip connected via HID-over-i2c, which also supports pen input. A Surface Pen digitizer is available separately from Microsoft and comes in the same colors as the Type Covers. The pen works without any pairing necessary, though the top button on it works over Bluetooth so it requires pairing to use. Either way, the pen requires an AAAA battery inside it to operate. The Surface Pen can attach magnetically to the left side of the screen when not in use.<br>\nA kickstand can swing out behind the display to use the tablet in a laptop form factor, which can adjust to any angle up to about 170 degrees. The kickstand stays firmly in place wherever it is positioned, which also means it requires a bit of force to pull it out when initially placing the Surface Go on a desk.<br>\nAlong the top of the display are a power button and physical volume rocker buttons. Along the right side are the 3.5mm headphone jack, USB-C port, power port, and microSD card slot located behind the kickstand.<br>\nCharging can be done via USB-C or the dedicated charge port, which accommodates a magnetically-attached, thin barrel similar to Apple’s first generation MagSafe adapter. The charging cable has a white LED that glows when connected, which is kind of annoying since it’s near the mid-line of the screen rather than down by the keyboard. Unlike Apple’s MagSafe, the indicator light does not indicate whether the battery is charged or not. The barrel charger plug can be placed up or down, but in either direction I find it puts an awkward strain on the power cable coming out of it due to the vertical position of the port.<br>\nWireless connectivity is provided by a Qualcomm Atheros QCA6174 802.11ac chip which also provides Bluetooth connectivity.<br>\nMost of the sensors on the device such as the gyroscope and ambient light sensor are connected behind an Intel Sensor Hub PCI device, which provides some power savings as the host CPU doesn’t have to poll the sensors all the time.</p>\n</blockquote>\n\n<ul>\n<li>Firmware</li>\n</ul>\n\n<blockquote>\n<p>The Surface Go’s BIOS/firmware menu can be entered by holding down the Volume Up button, then pressing and releasing the Power button, and releasing Volume Up when the menu appears. Secure Boot as well as various hardware components can be disabled in this menu. Boot order can also be adjusted. A temporary boot menu can be brought up the same way but using Volume Down instead.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-august-2018/\">FreeBSD Foundation Update, August 2018</a></p>\n\n<ul>\n<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>\n</ul>\n\n<blockquote>\n<p>Dear FreeBSD Community Member,<br>\nIt’s been a busy summer for the Foundation. From traveling around the globe spreading the word about FreeBSD to bringing on new team members to improve the Project’s Continuous Integration work, we’re very excited about what we’ve accomplished. Take a minute to check out the latest updates within our Foundation sponsored projects; read more about our advocacy efforts in Bangladesh and community building in Cambridge; don’t miss upcoming Travel Grant deadlines, and new Developer Summits; and be sure to find out how your support will ensure our progress continues into 2019.<br>\nWe can’t do this without you! Happy reading!! Deb</p>\n</blockquote>\n\n<ul>\n<li>August 2018 Development Projects Update</li>\n<li>Fundraising Update: Supporting the Project</li>\n<li>August 2018 Release Engineering Update</li>\n<li>BSDCam 2018 Recap</li>\n<li>October 2018 FreeBSD Developer Summit Call for Participation</li>\n<li>SANOG32 and COSCUP 2018 Recap</li>\n<li>MeetBSD 2018 Travel Grant Application Deadline: September 7</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"http://project-trident.org/post/2018-09-04_what_is_taking_so_long/\">Project Trident: What’s taking so long?</a></p>\n\n<ul>\n<li>What is taking so long?</li>\n</ul>\n\n<blockquote>\n<p>The short answer is that it’s complicated.<br>\nProject Trident is quite literally a test of the new TrueOS build system. As expected, there have been quite a few bugs, undocumented features, and other optional bits that we discovered we needed that were not initially present. All of these things have to be addressed and retested in a constant back and forth process.<br>\nWhile Ken and JT are both experienced developers, neither has done this kind of release engineering before. JT has done some release engineering back in his Linux days, but the TrueOS and FreeBSD build system is very different. Both Ken and JT are learning a completely new way of building a FreeBSD/TrueOS distribution. Please keep in mind that no one has used this new TrueOS build system before, so Ken and JT want to not only provide a good Trident release, but also provide a model or template for other potential TrueOS distributions too!</p>\n</blockquote>\n\n<ul>\n<li>Where are we now?</li>\n</ul>\n\n<blockquote>\n<p>Through perseverance, trial and error, and a lot of head-scratching we have reached the point of having successful builds. It took a while to get there, but now we are simply working out a few bugs with the new installer that Ken wrote as well as finding and fixing all the new Xorg configuration options which recently landed in FreeBSD. We also found that a number of services have been removed or replaced between TrueOS 18.03 and 18.06 so we are needing to adjust what we consider the “base” services for the desktop. All of these issues are being resolved and we are continually rebuilding and pulling in new patches from TrueOS as soon as they are committed.<br>\nIn the meantime we have made an early BETA release of Trident available to the users in our Telegram Channel for those who want to help out in testing these early versions.</p>\n</blockquote>\n\n<ul>\n<li>Do you foresee any other delays?</li>\n</ul>\n\n<blockquote>\n<p>At the moment we are doing many iterations of testing and tweaking the install ISO and package configurations in order to ensure that all the critical functionality works out-of-box (networking, sound, video, basic apps, etc). While we do not foresee any other major delays, sometimes things happen that our outside of our control. For an example, one of the recent delays that hit recently was completely unexpected: we had a hard drive failure on our build server. Up until recently, The aptly named “Poseidon” build server was running a Micron m500dc drive, but that drive is now constantly reporting errors. Despite ordering a replacement Western Digital Blue SSD several weeks ago, we just received it this past week. The drive is now installed with the builder back to full functionality, but we did lose many precious days with the delay.<br>\nThe build server for Project Trident is very similar to the one that JT donated to the TrueOS project. JT had another DL580 G7, so he donated one to the Trident Project for their build server. Poseidon also has 256GB RAM (64 x 4GB sticks) which is a smidge higher than what the TrueOS builder has.<br>\nSince we are talking about hardware, we probably should address another question we get often, “What Hardware are the devs testing on?” So let’s go ahead and answer that one now.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Developer Hardware</p>\n</li>\n<li>\n<p>JT: His main test box is a custom-built Intel i7 7700K system running 32GB RAM, dual Intel Optane 900P drives, and an Nvidia 1070 GTX with four 4K Acer Monitors. He also uses a Lenovo x250 ThinkPad alongside a desk full of x230t and x220 ThinkPads. One of which he gave away at SouthEast LinuxFest this year, which you can read about here.  However it’s not done there, being a complete hardware hoarder, JT also tests on several Intel NUCs and his second laptop a Fujitsu t904, not to mention a Plethora of HP DL580 servers, a DL980 server, and a stack of BL485c, BL460c, and BL490c Blades in his HP c7000 and c3000 Bladecenter chassis. (Maybe it’s time for an intervention for his hardware collecting habits)</p>\n</li>\n<li>\n<p>Ken: For a laptop, he primarily uses a 3rd generation X1 Carbon, but also has an old Eee PC T101MT Netbook (dual core 1GHz, 2GB of memory) which he uses for verifying how well Trident works on low-end hardware. As far as workstations go, his office computer is an Intel i7 with an NVIDIA Geforce GTX 960 running three 4K monitors and he has a couple other custom-built workstations (1 AMD, 1 Intel+NVIDIA) at his home. Generally he assembled random workstations based on hardware that was given to him or that he could acquire cheap.</p>\n</li>\n<li>\n<p>Tim: is using a third gen X1 Carbon and a custom built desktop with an Intel Core i5-4440 CPU, 16 GiB RAM, Nvidia GeForce GTX 750 Ti, and a RealTek 8168 / 8111 network card.</p>\n</li>\n<li>\n<p>Rod: Rod uses… No one knows what Rod uses, It’s kinda like how many licks does it take to get to the center of a Tootsie-Roll Tootsie-Pop… the world may just never know.</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###NetBSD GSoC: pkgsrc config file versioning</p>\n\n<ul>\n<li>A series of reports from the course of the summer on this Google Summer of Code project</li>\n<li>The goal of the project is to integrate with a VCS (Version Control System) to make managing local changes to config files for packages easier</li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files\">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>\n</ul>\n\n<blockquote>\n<p>Packages may install code (both machine executable code and interpreted programs), documentation and manual pages, source headers, shared libraries and other resources such as graphic elements, sounds, fonts, document templates, translations and configuration files, or a combination of them.<br>\nConfiguration files are usually the means through which the behaviour of software without a user interface is specified. This covers parts of the operating systems, network daemons and programs in general that don’t come with an interactive graphical or textual interface as the principal mean for setting options.<br>\nSystem wide configuration for operating system software tends to be kept under /etc, while configuration for software installed via pkgsrc ends up under LOCALBASE/etc (e.g., /usr/pkg/etc).<br>\nSoftware packaged as part of pkgsrc provides example configuration files, if any, which usually get extracted to LOCALBASE/share/examples/PKGBASE/.<br>\nDon’t worry: automatic merging is disabled by default, set $VCSAUTOMERGE to enable it.<br>\nIn order to avoid breakage, installed configuration is backed up first in the VCS, separating user-modified files from files that have been already automatically merged in the past, in order to allow the administrator to easily restore the last manually edited file in case of breakage.<br>\nVCS functionality only applies to configuration files, not to rc.d scripts, and only if the environment variable $NOVCS is unset.<br>\nThe version control system to be used as a backend can be set through $VCS. It default to RCS, the Revision Control System, which works only locally and doesn’t support atomic transactions.<br>\nOther backends such as CVS are supported and more will come; these, being used at the explicit request of the administrator, need to be already installed and placed in a directory part of $PATH.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files1\">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 2: remote repositories (git and CVS)</a></li>\n</ul>\n\n<blockquote>\n<p>pkgsrc is now able to deploy configuration from packages being installed from a remote, site-specific vcs repository.<br>\nUser modified files are always tracked even if automerge functionality is not enabled, and a new tool, pkgconftrack(1), exists to manually store user changes made outside of package upgrade time.<br>\nVersion Control software is executed as the same user running pkg_add or make install, unless the user is “root”. In this case, a separate, unprivileged user, pkgvcsconf, gets created with its own home directory and a working login shell (but no password). The home directory is not strictly necessary, it exists to facilitate migrations betweens repositories and vcs changes; it also serves to store keys used to access remote repositories.<br>\nUsing git instead of rcs is simply done by setting VCS=git in pkg_install.conf</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files2\">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 3: remote repositories (SVN and Mercurial)</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files3\">GSoC 2018 Reports: Configuration files versioning in pkgsrc, part 4: configuration deployment, pkgtools and future improvements</a></li>\n</ul>\n\n<blockquote>\n<p>Support for configuration tracking is in scripts, pkginstall scripts, that get built into binary packages and are run by pkg_add upon installation. The idea behind the proposal suggested that users of the new feature should be able to store revisions of their installed configuration files, and of package-provided default, both in local or remote repositories. With this capability in place, it doesn’t take much to make the scripts “pull” configuration from a VCS repository at installation time.<br>\nThat’s what setting VCSCONFPULL=yes in pkg_install.conf after having enabled VCSTRACK_CONF does: You are free to use official, third party prebuilt packages that have no customization in them, enable these options, and point pkgsrc to a private conf repository. If it contains custom configuration for the software you are installing, an attempt will be made to use it and install it on your system. If it fails, pkginstall will fall back to using the defaults that come inside the package. RC scripts are always deployed from the binary package, if existing and PKG_RCD_SCRIPTS=yes in pkg_install.conf or the environment.<br>\nThis will be part of packages, not a separate solution like configuration management tools. It doesn’t support running scripts on the target system to customize the installation, it doesn’t come with its domain-specific language, it won’t run as a daemon or require remote logins to work. It’s quite limited in scope, but you can define a ROLE for your system in pkg_install.conf or in the environment, and pkgsrc will look for configuration you or your organization crafted for such a role (e.g., public, standalone webserver vs reverse proxy or node in a database cluster)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSDTypeAndMacOS\">A little bit of the one-time MacOS version still lingers in ZFS</a></p>\n\n<blockquote>\n<p>Once upon a time, Apple came very close to releasing ZFS as part of MacOS. Apple did this work in its own copy of the ZFS source base (as far as I know), but the people in Sun knew about it and it turns out that even today there is one little lingering sign of this hoped-for and perhaps prepared-for ZFS port in the ZFS source code. Well, sort of, because it’s not quite in code.<br>\nLurking in the function that reads ZFS directories to turn (ZFS) directory entries into the filesystem independent format that the kernel wants is the following comment:</p>\n</blockquote>\n\n<p><code>objnum = ZFS_DIRENT_OBJ(zap.za_first_integer);</code><br>\n<code>/*</code><br>\n<code>* MacOS X can extract the object type here such as:</code><br>\n<code>* uint8_t type = ZFS_DIRENT_TYPE(zap.za_first_integer);</code><br>\n<code>*/</code></p>\n\n<ul>\n<li>Specifically, this is in zfs_readdir in zfs_vnops.c .</li>\n</ul>\n\n<blockquote>\n<p>ZFS maintains file type information in directories. This information can’t be used on Solaris (and thus Illumos), where the overall kernel doesn’t have this in its filesystem independent directory entry format, but it could have been on MacOS (‘Darwin’), because MacOS is among the Unixes that support d_type. The comment itself dates all the way back to this 2007 commit, which includes the change ‘reserve bits in directory entry for file type’, which created the whole setup for this.<br>\nI don’t know if this file type support was added specifically to help out Apple’s MacOS X port of ZFS, but it’s certainly possible, and in 2007 it seems likely that this port was at least on the minds of ZFS developers. It’s interesting but understandable that FreeBSD didn’t seem to have influenced them in the same way, at least as far as comments in the source code go; this file type support is equally useful for FreeBSD, and the FreeBSD ZFS port dates to 2007 too (per this announcement).<br>\nRegardless of the exact reason that ZFS picked up maintaining file type information in directory entries, it’s quite useful for people on both FreeBSD and Linux that it does so. File type information is useful for any number of things and ZFS filesystems can (and do) provide this information on those Unixes, which helps make ZFS feel like a truly first class filesystem, one that supports all of the expected general system features.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"http://trafyx.com/?p=2551\">Mac-like FreeBSD Laptop</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/08/21/syncthing-on-freebsd/\">Syncthing on FreeBSD</a></li>\n<li><a href=\"https://vermaden.wordpress.com/2018/08/24/new-zfs-boot-environments-tool/\">New ZFS Boot Environments Tool</a></li>\n<li><a href=\"http://anadoxin.org/blog/my-systems-time-was-so-wrong-that-even-ntpd-didnt-work.html\">My system’s time was so wrong, that even ntpd didn’t work</a></li>\n<li><a href=\"https://www.openssh.com/releasenotes.html#7.8\">OpenSSH 7.8/7.8p1 (2018-08-24)</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/registration/\">EuroBSD (Sept 20-23rd) registration Early Bird Period is coming to an end</a></li>\n<li><a href=\"https://www.meetbsd.com/\">MeetBSD (Oct 18-20th) is coming up fast, hurry up and register!</a></li>\n<li><a href=\"https://2019.asiabsdcon.org/\">AsiaBSDcon 2019 Dates</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Will - <a href=\"http://dpaste.com/2EQMHXV\">Kudos and a Question</a></li>\n<li>Peter - <a href=\"http://dpaste.com/2N6DC6P#wrap\">Fanless Computers</a></li>\n<li>Ron - <a href=\"http://dpaste.com/0MRG11V#wrap\">ZFS disk clone or replace or something</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/16B1WDB\">ZFS Record Size</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"OpenBSD on Microsoft Surface Go, FreeBSD Foundation August Update, What’s taking so long with Project Trident, pkgsrc config file versioning, and MacOS remnants in ZFS code.","date_published":"2018-09-06T05:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/6aa244ea-c5e6-4c69-b8a9-aac9c652d4e1.mp3","mime_type":"audio/mp3","size_in_bytes":44187309,"duration_in_seconds":4400}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2488","title":"Episode 261: FreeBSDcon Flashback | BSD Now 261","url":"https://www.bsdnow.tv/261","content_text":"Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.\n\n##Headlines\n###An Insight into the Future of TrueOS BSD and Project Trident\n\n\nLast month, TrueOS announced that they would be spinning off their desktop offering. The team behind the new project, named Project Trident, have been working furiously towards their first release. They did take a few minutes to answer some of our question about Project Trident and TrueOS. I would like to thank JT and Ken for taking the time to compile these answers.\n\n\n\nIt’s FOSS: What is Project Trident?\n\n\n\nProject Trident: Project Trident is the continuation of the TrueOS Desktop. Essentially, it is the continuation of the primary “TrueOS software” that people have been using for the past 2 years. The continuing evolution of the entire TrueOS project has reached a stage where it became necessary to reorganize the project. To understand this change, it is important to know the history of the TrueOS project.\n\n\n\nOriginally, Kris Moore created PC-BSD. This was a Desktop release of FreeBSD focused on providing a simple and user-friendly graphical experience for FreeBSD. PC-BSD grew and matured over many years. During the evolution of PC-BSD, many users began asking for a server focused version of the software. Kris agreed, and TrueOS was born as a scaled down server version of PC-BSD. In late 2016, more contributors and growth resulted in significant changes to the PC-BSD codebase. Because the new development was so markedly different from the original PC-BSD design, it was decided to rebrand the project.\n\n\n\nTrueOS was chosen as the name for this new direction for PC-BSD as the project had grown beyond providing only a graphical front to FreeBSD and was beginning to make fundamental changes to the FreeBSD operating system. One of these changes was moving PC-BSD from being based on each FreeBSD Release to TrueOS being based on the active and less outdated FreeBSD Current. Other major changes are using OpenRC for service management and being more aggressive about addressing long-standing issues with the FreeBSD release process. TrueOS moved toward a rolling release cycle, twice a year, which tested and merged FreeBSD changes directly from the developer instead of waiting months or even years for the FreeBSD review process to finish. TrueOS also deprecated and removed obsolete technology much more regularly.\n\n\n\nAs the TrueOS Project grew, the developers found these changes were needed by other FreeBSD-based projects. These projects began expressing interest in using TrueOS rather than FreeBSD as the base for their project. This demonstrated that TrueOS needed to again evolve into a distribution framework for any BSD project to use. This allows port maintainers and source developers from any BSD project to pool their resources and use the same source repositories while allowing every distribution to still customize, build, and release their own self-contained project. The result is a natural split of the traditional TrueOS team. There were now naturally two teams in the TrueOS project: those working on the build infrastructure and FreeBSD enhancements – the “core” part of the project, and those working on end-user experience and utility – the “desktop” part of the project.\n\n\n\nWhen the decision was made to formally split the projects, the obvious question that arose was what to call the “Desktop” project. As TrueOS was already positioned to be a BSD distribution platform, the developers agreed the desktop side should pick a new name. There were other considerations too, one notable being that we were concerned that if we continued to call the desktop project “TrueOS Desktop”, it would prevent people from considering TrueOS as the basis for their distribution because of misconceptions that TrueOS was a desktop-focused OS. It also helps to “level the playing field” for other desktop distributions like GhostBSD so that TrueOS is not viewed as having a single “blessed” desktop version.\n\n\n\nIt’s FOSS: What features will TrueOS add to the FreeBSD base?\n\n\n\nProject Trident: TrueOS has already added a number of features to FreeBSD:\nOpenRC replaces rc.d for service management\nLibreSSL in base\nRoot NSS certificates out-of-box\nScriptable installations (pc-sysinstall)\nThe full list of changes can be seen on the TrueOS repository (https://github.com/trueos/trueos/blob/trueos-master/README.md). This list does change quite regularly as FreeBSD development itself changes.\n\n\n\nIt’s FOSS: I understand that TrueOS will have a new feature that will make creating a desktop spin of TrueOS very easy. Could you explain that new feature?\n\n\n\nProject Trident: Historically, one of the biggest hurdles for creating a desktop version of FreeBSD is that the build options for packages are tuned for servers rather than desktops. This means a desktop distribution cannot use the pre-built packages from FreeBSD and must build, use, and maintain a custom package repository. Maintaining a fork of the FreeBSD ports tree is no trivial task. TrueOS has created a full distribution framework so now all it takes to create a custom build of FreeBSD is a single JSON manifest file. There is now a single “source of truth” for the source and ports repositories that is maintained by the TrueOS team and regularly tagged with “stable” build markers. All projects can use this framework, which makes updates trivial.\n\n\n\nIt’s FOSS: Do you think that the new focus of TrueOS will lead to the creation of more desktop-centered BSDs?\n\n\n\nProject Trident: That is the hope. Historically, creating a desktop-centered BSD has required a lot of specialized knowledge. Not only do most people not have this knowledge, but many do not even know what they need to learn until they start troubleshooting. TrueOS is trying to drastically simplify this process to enable the wider Open Source community to experiment, contribute, and enjoy BSD-based projects.\n\n\n\nIt’s FOSS: What is going to happen to TrueOS Pico? Will Project Trident have ARM support?\n\n\n\nProject Trident: Project Trident will be dependent on TrueOS for ARM support. The developers have talked about the possibility of supporting ARM64 and RISC-V architectures, but it is not possible at the current time. If more Open Source contributors want to help develop ARM and RISC-V support, the TrueOS project is definitely willing to help test and integrate that code.\n\n\n\nIt’s FOSS: What does this change (splitting Trus OS into Project Trident) mean for the Lumina desktop environment?\n\n\n\nProject Trident: Long-term, almost nothing. Lumina is still the desktop environment for Project Trident and will continue to be developed and enhanced alongside Project Trident just as it was for TrueOS. Short-term, we will be delaying the release of Lumina 2.0 and will release an updated version of the 1.x branch (1.5.0) instead. This is simply due to all the extra overhead to get Project Trident up and running. When things settle down into a rhythm, the development of Lumina will pick up once again.\n\n\n\nIt’s FOSS: Are you planning on including any desktop environments besides Lumina?\n\n\n\nProject Trident: While Lumina is included by default, all of the other popular desktop environments will be available in the package repo exactly as they had been before.\n\n\n\nIt’s FOSS: Any plans to include Steam to increase the userbase?\n\n\n\nProject Trident: Steam is still unavailable natively on FreeBSD, so we do not have any plans to ship it out of the box currently. In the meantime, we highly recommend installing the Windows version of Steam through the PlayOnBSD utility.\n\n\n\nIt’s FOSS: What will happen to the AppCafe?\n\n\n\nProject Trident: The AppCafe is the name of the graphical interface for the “pkg” utility integrated into the SysAdm client created by TrueOS. This hasn’t changed. SysAdm, the graphical client, and by extension AppCafe are still available for all TrueOS-based distributions to use.\n\n\n\nIt’s FOSS: Does Project Trident have any corporate sponsors lined up? If not, would you be open to it or would you prefer that it be community supported?\n\n\n\nProject Trident: iXsystems is the first corporate sponsor of Project Trident and we are always open to other sponsorships as well. We would prefer smaller individual contributions from the community, but we understand that larger project needs or special-purpose goals are much more difficult to achieve without allowing larger corporate sponsorships as well. In either case, Project Trident is always looking out for the best interests of the community and will not allow intrusive or harmful code to enter the project even if a company or individual tries to make that code part of a sponsorship deal.\n\n\n\nIt’s FOSS: BSD always seems to be lagging in terms of support for newer devices. Will TrueOS be able to remedy that with a quicker release cycle?\n\n\n\nProject Trident: Yes! That was a primary reason for TrueOS to start tracking the CURRENT branch of FreeBSD in 2016. This allows for the changes that FreeBSD developers are making, including new hardware support, to be available much sooner than if we followed the FreeBSD release cycle.\n\n\n\nIt’s FOSS: Do you have any idea when Project Trident will have its first release?\n\n\n\nProject Trident: Right now we are targeting a late August release date. This is because Project Trident is “kicking the wheels” on the new TrueOS distribution system. We want to ensure everything is working smoothly before we release. Going forward, we plan on having regular package updates every week or two for the end-user packages and a new release of Trident with an updated OS version every 6 months. This will follow the TrueOS release schedule with a small time offset.\n\n\n\n\n###pf-badhost: Stop the evil doers in their tracks!\n\n\npf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet’s biggest irritants. Annoyances such as ssh bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.\nFiltering performance is exceptional, as the badhost list is stored in a pf table. To quote the OpenBSD FAQ page regarding tables: “the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses.”\npf-badhost is simple and powerful. The blocklists are pulled from quality, trusted sources. The ‘Firehol’, ‘Emerging Threats’ and ‘Binary Defense’ block lists are used as they are popular, regularly updated lists of the internet’s most egregious offenders. The pf-badhost.sh script can easily be expanded to use additional or alternate blocklists.\npf-badhost works best when used in conjunction with unbound-adblock for the ultimate badhost blocking.\n\n\n\nNotes:\nIf you are trying to run pf-badhost on a LAN or are using NAT, you will want to add a rule to your pf.conf appearing BEFORE the pf-badhost rules allowing traffic to and from your local subnet so that you can still access your gateway and any DNS servers.\nConversely, adding a line to pf-badhost.sh that removes your subnet range from the &lt;pfbadhost&gt; table should also work. Just make sure you choose a subnet range / CIDR block that is actually in the list. 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are the most common home/office subnet ranges.\n\n\n\n\nDigitalOcean\nhttps://do.co/bsdnow\n\n###FLASHBACK: FreeBSDCon’99: Fans of Linux’s lesser-known sibling gather for the first time\n\n\nFreeBSD, a port of BSD Unix to Intel, has been around almost as long as Linux has – but without the media hype. Its developer and user community recently got a chance to get together for the first time, and they did it in the city where BSD – the Berkeley Software Distribution – was born some 25 years ago.\nOctober 17, 1999 marked a milestone in the history of FreeBSD – the first FreeBSD conference was held in the city where it all began, Berkeley, CA. Over 300 developers, users, and interested parties attended from around the globe.\nThis was easily 50 percent more people than the conference organizers had expected. This first conference was meant to be a gathering mostly for developers and FreeBSD advocates. The turnout was surprisingly (and gratifyingly) large.\nIn fact, attendance exceeded expectations so much that, for instance, Kirk McKusick had to add a second, identical tutorial on FreeBSD internals, because it was impossible for everyone to attend the first!\nBut for a first-ever conference, I was impressed by how smoothly everything seemed to go. Sessions started on time, and the sessions I attended were well-run; nothing seemed to be too cold, dark, loud, late, or off-center.\nOf course, the best part about a conference such as this one is the opportunity to meet with other people who share similar interests. Lunches and breaks were a good time to meet people, as was the Tuesday night beer bash.\nThe Wednesday night reception was of a type unusual for the technical conferences I usually attend – a three-hour Hornblower dinner cruise on San Francisco Bay. Not only did we all enjoy excellent food and company, but we all got to go up on deck and watch the lights of San Francisco and Berkeley as we drifted by. Although it’s nice when a conference attracts thousands of attendees, there are some things that can only be done with smaller groups of people; this was one of them.\nIn short, this was a tiny conference, but a well-run one.\n\n\n\nSessions\n\n\n\nAlthough it was a relatively small conference, the number and quality of the sessions belied the size. Each of the three days of the conference featured a different keynote speaker. In addition to Jordan Hubbard, Jeremy Allison spoke on “Samba Futures” on day two, and Brian Behlendorf gave a talk on “FreeBSD and Apache: A Perfect Combo” to start off the third day.\nThe conference sessions themselves were divided into six tracks: advocacy, business, development, networking, security, and panels. The panels track featured three different panels, made up of three different slices of the community: the FreeBSD core team, a press panel, and a prominent user panel with representatives from such prominent commercial users as Yahoo! and USWest.\nI was especially interested in Apple Computer’s talk in the development track. Wilfredo Sanchez, technical lead for open source projects at Apple (no, that’s not an oxymoron!) spoke about Apple’s Darwin project, the company’s operating system road map, and the role of BSD (and, specifically, FreeBSD) in Apple’s plans.\nApple and Unix have had a long and uneasy history, from the Lisa through the A/UX project to today. Personally, I’m very optimistic about the chances for the Darwin project to succeed. Apple’s core OS kernel team has chosen FreeBSD as its reference platform. I’m looking forward to what this partnership will bring to both sides.\nOther development track sessions included in-depth tutorials on writing device drivers, basics of the Vinum Volume Manager, Fibre Channel, development models (the open repository model), and the FreeBSD Documentation Project (FDP). If you’re interested in contributing to the FreeBSD project, the FDP is a good place to start.\nAdvocacy sessions included “How One Person Can Make a Difference” (a timeless topic that would find a home at any technical conference!) and “Starting and Managing A User Group” (trials and tribulations as well as rewards).\nThe business track featured speakers from three commercial users of FreeBSD: Cybernet, USWest, and Applix. Applix presented its port of Applixware Office for FreeBSD and explained how Applix has taken the core services of Applixware into open source.\nCommercial applications and open source were once a rare combination; we can only hope the trend away from that state of affairs will continue.\n\n\n\nCommercial use of FreeBSD\n\n\n\nThe use of FreeBSD in embedded applications is increasing as well – and it is increasing at the same rate that hardware power is. These days, even inexpensive systems are able to run a BSD kernel.\nThe BSD license and the solid TCP/IP stack prove significant enticements to this market as well. (Unlike the GNU Public License, the BSD license does not require that vendors make derivative works open source.)\nCompanies such as USWest and Verio use FreeBSD for a wide variety of different Internet services.\nYahoo! and Hotmail are examples of companies that use FreeBSD extensively for more specific purposes. Yahoo!, for example, has many hundreds of FreeBSD boxes, and Hotmail has almost 2000 FreeBSD machines at its data center in the San Francisco Bay area.\nHotmail is owned by Microsoft, so the fact that it runs FreeBSD is a secret. Don’t tell anyone…\nWhen asked to comment on the increasing commercial interest in BSD, Hubbard said that FreeBSD is learning the Red Hat lesson. “Walnut Creek and others with business interests in FreeBSD have learned a few things from the Red Hat IPO,” he said, “and nobody is just sitting around now, content with business as usual. It’s clearly business as unusual in the open source world today.”\nHubbard had also singled out some of BSD’s commercial partners, such as Whistle Communications, for praise in his opening day keynote. These partners play a key role in moving the project forward, he said, by contributing various enhancements and major new systems, such as Netgraph, as well as by contributing paid employee time spent on FreeBSD.\nEven short FreeBSD-related contacts can yield good results, Hubbard said. An example of this is the new jail() security code introduced in FreeBSD 3.x and 4.0, which was contributed by R &amp; D Associates. A number of ISPs are also now donating the hardware and bandwidth that allows the project to provide more resource mirrors and experimental development sites.\n\n\n\nSee you next year\n\n\n\nAnd speaking of corporate sponsors, thanks go to Walnut Creek for sponsoring the conference, and to Yahoo! for covering all the expenses involved in bringing the entire FreeBSD core team to Berkeley.\nAs a fan of FreeBSD, I’m happy to see that the project has finally produced a conference. It was time: many of the 16 core team members had been working together on a regular basis for nearly seven years without actually meeting face to face.\nIt’s been an interesting year for open source projects. I’m looking forward to the next year – and the next BSD conference – to be even better.\n\n\n\n\n##News Roundup\n###OpenBSD Recommends: Disable SMT/Hyperthreading in all Intel BIOSes\n\nTwo recently disclosed hardware bugs affected Intel cpus:\n\n     - TLBleed\n\n     - T1TF (the name \"Foreshadow\" refers to 1 of 3 aspects of this\n             bug, more aspects are surely on the way)\n\nSolving these bugs requires new cpu microcode, a coding workaround,\n*AND* the disabling of SMT / Hyperthreading.\n\nSMT is fundamentally broken because it shares resources between the two\ncpu instances and those shared resources lack security differentiators.\nSome of these side channel attacks aren't trivial, but we can expect\nmost of them to eventually work and leak kernel or cross-VM memory in\ncommon usage circumstances, even such as javascript directly in a\nbrowser.\n\nThere will be more hardware bugs and artifacts disclosed.  Due to the\nway SMT interacts with speculative execution on Intel cpus, I expect SMT\nto exacerbate most of the future problems.\n\nA few months back, I urged people to disable hyperthreading on all\nIntel cpus.  I need to repeat that:\n\n    DISABLE HYPERTHREADING ON ALL YOUR INTEL MACHINES IN THE BIOS.\n\nAlso, update your BIOS firmware, if you can.\n\nOpenBSD -current (and therefore 6.4) will not use hyperthreading if it\nis enabled, and will update the cpu microcode if possible.\n\nBut what about 6.2 and 6.3?\n\nThe situation is very complex, continually evolving, and is taking too\nmuch manpower away from other tasks.  Furthermore, Intel isn't telling\nus what is coming next, and are doing a terrible job by not publically\ndocumenting what operating systems must do to resolve the problems.  We\nare having to do research by reading other operating systems.  There is\nno time left to backport the changes -- we will not be issuing a\ncomplete set of errata and syspatches against 6.2 and 6.3 because it is\nturning into a distraction.\n\nRather than working on every required patch for 6.2/6.3, we will\nre-focus manpower and make sure 6.4 contains the best solutions\npossible.\n\nSo please try take responsibility for your own machines: Disable SMT in\nthe BIOS menu, and upgrade your BIOS if you can.\n\nI'm going to spend my money at a more trustworthy vendor in the future.\n\n\n\n\n###Get Morrowind running on OpenBSD in 5 simple steps\n\n\nThis article contains brief instructions on how to get one of the greatest Western RPGs of all time, The Elder Scrolls III: Morrowind, running on OpenBSD using the OpenMW open source engine recreation. These instructions were tested on a ThinkPad X1 Carbon Gen 3. The information was adapted from this OpenMW forum thread: https://forum.openmw.org/viewtopic.php?t=3510\n\n\n\n\n\nPurchase and download the DRM-free version from GOG (also considered the best version due to the high quality PDF guide that it comes with): https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition\n\n\n\n\nInstall the required packages built from the ports tree as root. openmw is the recreated game engine, and innoextract is how we will get the game data files out of the win32 executable.\n\n\n\n\npkg_add openmw innoextract\n\n\n\n\nMove the file from GOG setup_tes_morrowind_goty_2.0.0.7.exe into its own directory morrowind/ due to innoextract’s default behaviour of extracting into the current directory. Then type:\n\n\n\n\ninnoextract setup_tes_morrowind_goty_2.0.0.7.exe\n\n\n\n\nType openmw-wizard and follow the straightforward instructions. Note that you have a pre-existing installation, and select the morrowind/app/Data Files folder that innoextract extracted.\n\n\n\n\nType in openmw-launcher, toggle the settings to your preferences, and then hit play!\n\n\n\n\n\n\niXsystems\nhttps://twitter.com/allanjude/status/1034647571124367360\n\n###My First Clang Bug\n\n\nPart of the role of being a packager is compiling lots (and lots) of packages. That means compiling lots of code from interesting places and in a variety of styles. In my opinion, being a good packager also means providing feedback to upstream when things are bad. That means filing upstream bugs when possible, and upstreaming patches.\nOne of the “exciting” moments in packaging is when tools change. So each and every major CMake update is an exercise in recompiling 2400 or more packages and adjusting bits and pieces. When a software project was last released in 2013, adjusting it to modern tools can become quite a chore (e.g. Squid Report Generator). CMake is excellent for maintaining backwards compatibility, generally accommodating old software with new policies. The most recent 3.12 release candidate had three issues filed from the FreeBSD side, all from fallout with older software.  I consider the hours put into good bug reports, part of being a good citizen of the Free Software world.\nMy most interesting bug this week, though, came from one line of code somewhere in Kleopatra: Q_UNUSED(gpgagent_data);\nThat one line triggered a really peculiar link error in KDE’s FreeBSD CI system. Yup … telling the compiler something is unused made it fall over. Commenting out that line got rid of the link error, but introduced a warning about an unused function. Working with KDE-PIM’s Volker Krause, we whittled the problem down to a six-line example program — two lines if you don’t care much for coding style. I’m glad, at that point, that I could throw it over the hedge to the LLVM team with some explanatory text. Watching the process on their side reminds me ever-so-strongly of how things work in KDE (or FreeBSD for that matter): Bugzilla, Phabricator, and git combine to be an effective workflow for developers (perhaps less so for end-users).\nToday I got a note saying that the issue had been resolved. So brief a time for a bug. Live fast. Get squashed young.\n\n\n\n\n###DragonFlyBSD Now Runs On The Threadripper 2990WX, Developer Shocked At Performance\n\n\nLast week I carried out some tests of BSD vs. Linux on the new 32-core / 64-thread Threadripper 2990WX. I tested FreeBSD 11, FreeBSD 12, and TrueOS – those benchmarks will be published in the next few days. I tried DragonFlyBSD, but at the time it wouldn’t boot with this AMD HEDT processor. But now the latest DragonFlyBSD development kernel can handle the 2990WX and the lead DragonFly developer calls this new processor “a real beast” and is stunned by its performance potential.\n\n\n\nWhen I tried last week, the DragonFlyBSD 5.2.2 stable release nor DragonFlyBSD 5.3 daily snapshot would boot on the 2990WX. But it turns out Matthew Dillon, the lead developer of DragonFlyBSD, picked up a rig and has it running now. So in time for the next 5.4 stable release or those using the daily snapshots can have this 32-core / 64-thread Zen+ CPU running on this operating system long ago forked from FreeBSD.\n\n\n\nIn announcing his success in bringing up the 2990WX under DragonFlyBSD, which required a few minor changes, he shared his performance thoughts and hopes for the rig. “The cpu is a real beast, packing 32 cores and 64 threads. It blows away our dual-core Xeon to the tune of being +50% faster in concurrent compile tests, and it also blows away our older 4-socket Opteron (which we call ‘Monster’) by about the same margin. It’s an impressive CPU. For now the new beast is going to be used to help us improve I/O performance through the filesystem, further SMP work (but DFly scales pretty well to 64 threads already), and perhaps some driver to work to support the 10gbe on the mobo.”\n\n\n\nDillon shared some results on the system as well. \" The Threadripper 2990WX is a beast. It is at least 50% faster than both the quad socket opteron and the dual socket Xeon system I tested against. The primary limitation for the 2990WX is likely its 4 channels of DDR4 memory, and like all Zen and Zen+ CPUs, memory performance matters more than CPU frequency (and costs almost no power to pump up the performance). That said, it still blow away a dual-socket Xeon with 3x the number of memory channels. That is impressive!\"\n\n\n\nThe well known BSD developer also added, “This puts the 2990WX at par efficiency vs a dual-socket Xeon system, and better than the dual-socket Xeon with slower memory and a power cap. This is VERY impressive. I should note that the 2990WX is more specialized with its asymetric NUMA architecture and 32 cores. I think the sweet spot in terms of CPU pricing and efficiency is likely going to be with the 2950X (16-cores/32-threads). It is clear that the 2990WX (32-cores/64-threads) will max out 4-channel memory bandwidth for many workloads, making it a more specialized part. But still awesome…This thing is an incredible beast, I’m glad I got it.”\n\n\n\nWhile I have the FreeBSD vs. Linux benchmarks from a few days ago, it looks like now on my ever growing TODO list will be re-trying out the newest DragonFlyBSD daily snapshot for seeing how the performance compares in the mix. Stay tuned for the numbers that should be in the next day or two.\n\n\n\n\n##Beastie Bits\n\n\nX11 on really small devices\nmandoc-1.14.4 released\nThe pfSense Book is now available to everyone\nMWL: Burn it down! Burn it all down!\nConfiguring OpenBSD: System and user config files for a more pleasant laptop\nFreeBSD Security Advisory: Resource exhaustion in TCP reassembly\nOpenBSD Foundation gets first 2018 Iridium donation\nNew ZFS commit solves issue a few users reported in the feedback segment\nProject Trident should have a beta release by the end of next week\nReminder about Stockholm BUG: September 5, 17:30-22:00\nBSD-PL User Group: September 13, 18:30-21:00\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nMalcom - Having different routes per interface\nBostjan - ZFS and integrity of data\nMichael - Suggestion for Monitoring\nBarry - Feedback\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://itsfoss.com/project-trident-interview/\">An Insight into the Future of TrueOS BSD and Project Trident</a></p>\n\n<blockquote>\n<p>Last month, TrueOS announced that they would be spinning off their desktop offering. The team behind the new project, named Project Trident, have been working furiously towards their first release. They did take a few minutes to answer some of our question about Project Trident and TrueOS. I would like to thank JT and Ken for taking the time to compile these answers.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: What is Project Trident?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Project Trident is the continuation of the TrueOS Desktop. Essentially, it is the continuation of the primary “TrueOS software” that people have been using for the past 2 years. The continuing evolution of the entire TrueOS project has reached a stage where it became necessary to reorganize the project. To understand this change, it is important to know the history of the TrueOS project.</p>\n</blockquote>\n\n<blockquote>\n<p>Originally, Kris Moore created PC-BSD. This was a Desktop release of FreeBSD focused on providing a simple and user-friendly graphical experience for FreeBSD. PC-BSD grew and matured over many years. During the evolution of PC-BSD, many users began asking for a server focused version of the software. Kris agreed, and TrueOS was born as a scaled down server version of PC-BSD. In late 2016, more contributors and growth resulted in significant changes to the PC-BSD codebase. Because the new development was so markedly different from the original PC-BSD design, it was decided to rebrand the project.</p>\n</blockquote>\n\n<blockquote>\n<p>TrueOS was chosen as the name for this new direction for PC-BSD as the project had grown beyond providing only a graphical front to FreeBSD and was beginning to make fundamental changes to the FreeBSD operating system. One of these changes was moving PC-BSD from being based on each FreeBSD Release to TrueOS being based on the active and less outdated FreeBSD Current. Other major changes are using OpenRC for service management and being more aggressive about addressing long-standing issues with the FreeBSD release process. TrueOS moved toward a rolling release cycle, twice a year, which tested and merged FreeBSD changes directly from the developer instead of waiting months or even years for the FreeBSD review process to finish. TrueOS also deprecated and removed obsolete technology much more regularly.</p>\n</blockquote>\n\n<blockquote>\n<p>As the TrueOS Project grew, the developers found these changes were needed by other FreeBSD-based projects. These projects began expressing interest in using TrueOS rather than FreeBSD as the base for their project. This demonstrated that TrueOS needed to again evolve into a distribution framework for any BSD project to use. This allows port maintainers and source developers from any BSD project to pool their resources and use the same source repositories while allowing every distribution to still customize, build, and release their own self-contained project. The result is a natural split of the traditional TrueOS team. There were now naturally two teams in the TrueOS project: those working on the build infrastructure and FreeBSD enhancements – the “core” part of the project, and those working on end-user experience and utility – the “desktop” part of the project.</p>\n</blockquote>\n\n<blockquote>\n<p>When the decision was made to formally split the projects, the obvious question that arose was what to call the “Desktop” project. As TrueOS was already positioned to be a BSD distribution platform, the developers agreed the desktop side should pick a new name. There were other considerations too, one notable being that we were concerned that if we continued to call the desktop project “TrueOS Desktop”, it would prevent people from considering TrueOS as the basis for their distribution because of misconceptions that TrueOS was a desktop-focused OS. It also helps to “level the playing field” for other desktop distributions like GhostBSD so that TrueOS is not viewed as having a single “blessed” desktop version.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: What features will TrueOS add to the FreeBSD base?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: TrueOS has already added a number of features to FreeBSD:<br>\nOpenRC replaces rc.d for service management<br>\nLibreSSL in base<br>\nRoot NSS certificates out-of-box<br>\nScriptable installations (pc-sysinstall)<br>\nThe full list of changes can be seen on the TrueOS repository (<a href=\"https://github.com/trueos/trueos/blob/trueos-master/README.md\">https://github.com/trueos/trueos/blob/trueos-master/README.md</a>). This list does change quite regularly as FreeBSD development itself changes.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: I understand that TrueOS will have a new feature that will make creating a desktop spin of TrueOS very easy. Could you explain that new feature?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Historically, one of the biggest hurdles for creating a desktop version of FreeBSD is that the build options for packages are tuned for servers rather than desktops. This means a desktop distribution cannot use the pre-built packages from FreeBSD and must build, use, and maintain a custom package repository. Maintaining a fork of the FreeBSD ports tree is no trivial task. TrueOS has created a full distribution framework so now all it takes to create a custom build of FreeBSD is a single JSON manifest file. There is now a single “source of truth” for the source and ports repositories that is maintained by the TrueOS team and regularly tagged with “stable” build markers. All projects can use this framework, which makes updates trivial.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: Do you think that the new focus of TrueOS will lead to the creation of more desktop-centered BSDs?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: That is the hope. Historically, creating a desktop-centered BSD has required a lot of specialized knowledge. Not only do most people not have this knowledge, but many do not even know what they need to learn until they start troubleshooting. TrueOS is trying to drastically simplify this process to enable the wider Open Source community to experiment, contribute, and enjoy BSD-based projects.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: What is going to happen to TrueOS Pico? Will Project Trident have ARM support?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Project Trident will be dependent on TrueOS for ARM support. The developers have talked about the possibility of supporting ARM64 and RISC-V architectures, but it is not possible at the current time. If more Open Source contributors want to help develop ARM and RISC-V support, the TrueOS project is definitely willing to help test and integrate that code.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: What does this change (splitting Trus OS into Project Trident) mean for the Lumina desktop environment?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Long-term, almost nothing. Lumina is still the desktop environment for Project Trident and will continue to be developed and enhanced alongside Project Trident just as it was for TrueOS. Short-term, we will be delaying the release of Lumina 2.0 and will release an updated version of the 1.x branch (1.5.0) instead. This is simply due to all the extra overhead to get Project Trident up and running. When things settle down into a rhythm, the development of Lumina will pick up once again.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: Are you planning on including any desktop environments besides Lumina?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: While Lumina is included by default, all of the other popular desktop environments will be available in the package repo exactly as they had been before.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: Any plans to include Steam to increase the userbase?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Steam is still unavailable natively on FreeBSD, so we do not have any plans to ship it out of the box currently. In the meantime, we highly recommend installing the Windows version of Steam through the PlayOnBSD utility.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: What will happen to the AppCafe?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: The AppCafe is the name of the graphical interface for the “pkg” utility integrated into the SysAdm client created by TrueOS. This hasn’t changed. SysAdm, the graphical client, and by extension AppCafe are still available for all TrueOS-based distributions to use.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: Does Project Trident have any corporate sponsors lined up? If not, would you be open to it or would you prefer that it be community supported?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: iXsystems is the first corporate sponsor of Project Trident and we are always open to other sponsorships as well. We would prefer smaller individual contributions from the community, but we understand that larger project needs or special-purpose goals are much more difficult to achieve without allowing larger corporate sponsorships as well. In either case, Project Trident is always looking out for the best interests of the community and will not allow intrusive or harmful code to enter the project even if a company or individual tries to make that code part of a sponsorship deal.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: BSD always seems to be lagging in terms of support for newer devices. Will TrueOS be able to remedy that with a quicker release cycle?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Yes! That was a primary reason for TrueOS to start tracking the CURRENT branch of FreeBSD in 2016. This allows for the changes that FreeBSD developers are making, including new hardware support, to be available much sooner than if we followed the FreeBSD release cycle.</p>\n</blockquote>\n\n<ul>\n<li>It’s FOSS: Do you have any idea when Project Trident will have its first release?</li>\n</ul>\n\n<blockquote>\n<p>Project Trident: Right now we are targeting a late August release date. This is because Project Trident is “kicking the wheels” on the new TrueOS distribution system. We want to ensure everything is working smoothly before we release. Going forward, we plan on having regular package updates every week or two for the end-user packages and a new release of Trident with an updated OS version every 6 months. This will follow the TrueOS release schedule with a small time offset.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.geoghegan.ca/pfbadhost.html\">pf-badhost: Stop the evil doers in their tracks!</a></p>\n\n<blockquote>\n<p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet’s biggest irritants. Annoyances such as ssh bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.<br>\nFiltering performance is exceptional, as the badhost list is stored in a pf table. To quote the OpenBSD FAQ page regarding tables: “the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses.”<br>\npf-badhost is simple and powerful. The blocklists are pulled from quality, trusted sources. The ‘Firehol’, ‘Emerging Threats’ and ‘Binary Defense’ block lists are used as they are popular, regularly updated lists of the internet’s most egregious offenders. The <a href=\"http://pf-badhost.sh\">pf-badhost.sh</a> script can easily be expanded to use additional or alternate blocklists.<br>\npf-badhost works best when used in conjunction with unbound-adblock for the ultimate badhost blocking.</p>\n</blockquote>\n\n<ul>\n<li>Notes:</li>\n<li>If you are trying to run pf-badhost on a LAN or are using NAT, you will want to add a rule to your pf.conf appearing BEFORE the pf-badhost rules allowing traffic to and from your local subnet so that you can still access your gateway and any DNS servers.</li>\n<li>Conversely, adding a line to <a href=\"http://pf-badhost.sh\">pf-badhost.sh</a> that removes your subnet range from the &lt;pfbadhost&gt; table should also work. Just make sure you choose a subnet range / CIDR block that is actually in the list. 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are the most common home/office subnet ranges.</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>DigitalOcean</strong><br>\n<a href=\"https://do.co/bsdnow\">https://do.co/bsdnow</a></p>\n\n<p>###<a href=\"http://edition.cnn.com/TECH/computing/9911/01/freebsd.con99.idg/\">FLASHBACK: FreeBSDCon’99: Fans of Linux’s lesser-known sibling gather for the first time</a></p>\n\n<blockquote>\n<p>FreeBSD, a port of BSD Unix to Intel, has been around almost as long as Linux has – but without the media hype. Its developer and user community recently got a chance to get together for the first time, and they did it in the city where BSD – the Berkeley Software Distribution – was born some 25 years ago.<br>\nOctober 17, 1999 marked a milestone in the history of FreeBSD – the first FreeBSD conference was held in the city where it all began, Berkeley, CA. Over 300 developers, users, and interested parties attended from around the globe.<br>\nThis was easily 50 percent more people than the conference organizers had expected. This first conference was meant to be a gathering mostly for developers and FreeBSD advocates. The turnout was surprisingly (and gratifyingly) large.<br>\nIn fact, attendance exceeded expectations so much that, for instance, Kirk McKusick had to add a second, identical tutorial on FreeBSD internals, because it was impossible for everyone to attend the first!<br>\nBut for a first-ever conference, I was impressed by how smoothly everything seemed to go. Sessions started on time, and the sessions I attended were well-run; nothing seemed to be too cold, dark, loud, late, or off-center.<br>\nOf course, the best part about a conference such as this one is the opportunity to meet with other people who share similar interests. Lunches and breaks were a good time to meet people, as was the Tuesday night beer bash.<br>\nThe Wednesday night reception was of a type unusual for the technical conferences I usually attend – a three-hour Hornblower dinner cruise on San Francisco Bay. Not only did we all enjoy excellent food and company, but we all got to go up on deck and watch the lights of San Francisco and Berkeley as we drifted by. Although it’s nice when a conference attracts thousands of attendees, there are some things that can only be done with smaller groups of people; this was one of them.<br>\nIn short, this was a tiny conference, but a well-run one.</p>\n</blockquote>\n\n<ul>\n<li>Sessions</li>\n</ul>\n\n<blockquote>\n<p>Although it was a relatively small conference, the number and quality of the sessions belied the size. Each of the three days of the conference featured a different keynote speaker. In addition to Jordan Hubbard, Jeremy Allison spoke on “Samba Futures” on day two, and Brian Behlendorf gave a talk on “FreeBSD and Apache: A Perfect Combo” to start off the third day.<br>\nThe conference sessions themselves were divided into six tracks: advocacy, business, development, networking, security, and panels. The panels track featured three different panels, made up of three different slices of the community: the FreeBSD core team, a press panel, and a prominent user panel with representatives from such prominent commercial users as Yahoo! and USWest.<br>\nI was especially interested in Apple Computer’s talk in the development track. Wilfredo Sanchez, technical lead for open source projects at Apple (no, that’s not an oxymoron!) spoke about Apple’s Darwin project, the company’s operating system road map, and the role of BSD (and, specifically, FreeBSD) in Apple’s plans.<br>\nApple and Unix have had a long and uneasy history, from the Lisa through the A/UX project to today. Personally, I’m very optimistic about the chances for the Darwin project to succeed. Apple’s core OS kernel team has chosen FreeBSD as its reference platform. I’m looking forward to what this partnership will bring to both sides.<br>\nOther development track sessions included in-depth tutorials on writing device drivers, basics of the Vinum Volume Manager, Fibre Channel, development models (the open repository model), and the FreeBSD Documentation Project (FDP). If you’re interested in contributing to the FreeBSD project, the FDP is a good place to start.<br>\nAdvocacy sessions included “How One Person Can Make a Difference” (a timeless topic that would find a home at any technical conference!) and “Starting and Managing A User Group” (trials and tribulations as well as rewards).<br>\nThe business track featured speakers from three commercial users of FreeBSD: Cybernet, USWest, and Applix. Applix presented its port of Applixware Office for FreeBSD and explained how Applix has taken the core services of Applixware into open source.<br>\nCommercial applications and open source were once a rare combination; we can only hope the trend away from that state of affairs will continue.</p>\n</blockquote>\n\n<ul>\n<li>Commercial use of FreeBSD</li>\n</ul>\n\n<blockquote>\n<p>The use of FreeBSD in embedded applications is increasing as well – and it is increasing at the same rate that hardware power is. These days, even inexpensive systems are able to run a BSD kernel.<br>\nThe BSD license and the solid TCP/IP stack prove significant enticements to this market as well. (Unlike the GNU Public License, the BSD license does not require that vendors make derivative works open source.)<br>\nCompanies such as USWest and Verio use FreeBSD for a wide variety of different Internet services.<br>\nYahoo! and Hotmail are examples of companies that use FreeBSD extensively for more specific purposes. Yahoo!, for example, has many hundreds of FreeBSD boxes, and Hotmail has almost 2000 FreeBSD machines at its data center in the San Francisco Bay area.<br>\nHotmail is owned by Microsoft, so the fact that it runs FreeBSD is a secret. Don’t tell anyone…<br>\nWhen asked to comment on the increasing commercial interest in BSD, Hubbard said that FreeBSD is learning the Red Hat lesson. “Walnut Creek and others with business interests in FreeBSD have learned a few things from the Red Hat IPO,” he said, “and nobody is just sitting around now, content with business as usual. It’s clearly business as unusual in the open source world today.”<br>\nHubbard had also singled out some of BSD’s commercial partners, such as Whistle Communications, for praise in his opening day keynote. These partners play a key role in moving the project forward, he said, by contributing various enhancements and major new systems, such as Netgraph, as well as by contributing paid employee time spent on FreeBSD.<br>\nEven short FreeBSD-related contacts can yield good results, Hubbard said. An example of this is the new jail() security code introduced in FreeBSD 3.x and 4.0, which was contributed by R &amp; D Associates. A number of ISPs are also now donating the hardware and bandwidth that allows the project to provide more resource mirrors and experimental development sites.</p>\n</blockquote>\n\n<ul>\n<li>See you next year</li>\n</ul>\n\n<blockquote>\n<p>And speaking of corporate sponsors, thanks go to Walnut Creek for sponsoring the conference, and to Yahoo! for covering all the expenses involved in bringing the entire FreeBSD core team to Berkeley.<br>\nAs a fan of FreeBSD, I’m happy to see that the project has finally produced a conference. It was time: many of the 16 core team members had been working together on a regular basis for nearly seven years without actually meeting face to face.<br>\nIt’s been an interesting year for open source projects. I’m looking forward to the next year – and the next BSD conference – to be even better.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://marc.info/?l=openbsd-tech&amp;m=153504937925732&amp;w=2\">OpenBSD Recommends: Disable SMT/Hyperthreading in all Intel BIOSes</a></p>\n\n<pre><code>Two recently disclosed hardware bugs affected Intel cpus:\n\n     - TLBleed\n\n     - T1TF (the name &quot;Foreshadow&quot; refers to 1 of 3 aspects of this\n             bug, more aspects are surely on the way)\n\nSolving these bugs requires new cpu microcode, a coding workaround,\n*AND* the disabling of SMT / Hyperthreading.\n\nSMT is fundamentally broken because it shares resources between the two\ncpu instances and those shared resources lack security differentiators.\nSome of these side channel attacks aren't trivial, but we can expect\nmost of them to eventually work and leak kernel or cross-VM memory in\ncommon usage circumstances, even such as javascript directly in a\nbrowser.\n\nThere will be more hardware bugs and artifacts disclosed.  Due to the\nway SMT interacts with speculative execution on Intel cpus, I expect SMT\nto exacerbate most of the future problems.\n\nA few months back, I urged people to disable hyperthreading on all\nIntel cpus.  I need to repeat that:\n\n    DISABLE HYPERTHREADING ON ALL YOUR INTEL MACHINES IN THE BIOS.\n\nAlso, update your BIOS firmware, if you can.\n\nOpenBSD -current (and therefore 6.4) will not use hyperthreading if it\nis enabled, and will update the cpu microcode if possible.\n\nBut what about 6.2 and 6.3?\n\nThe situation is very complex, continually evolving, and is taking too\nmuch manpower away from other tasks.  Furthermore, Intel isn't telling\nus what is coming next, and are doing a terrible job by not publically\ndocumenting what operating systems must do to resolve the problems.  We\nare having to do research by reading other operating systems.  There is\nno time left to backport the changes -- we will not be issuing a\ncomplete set of errata and syspatches against 6.2 and 6.3 because it is\nturning into a distraction.\n\nRather than working on every required patch for 6.2/6.3, we will\nre-focus manpower and make sure 6.4 contains the best solutions\npossible.\n\nSo please try take responsibility for your own machines: Disable SMT in\nthe BIOS menu, and upgrade your BIOS if you can.\n\nI'm going to spend my money at a more trustworthy vendor in the future.\n</code></pre>\n\n<p><hr></p>\n\n<p>###<a href=\"https://medium.com/@enzuru/get-morrowind-running-on-openbsd-in-5-simple-steps-b65e20f3f0c\">Get Morrowind running on OpenBSD in 5 simple steps</a></p>\n\n<blockquote>\n<p>This article contains brief instructions on how to get one of the greatest Western RPGs of all time, The Elder Scrolls III: Morrowind, running on OpenBSD using the OpenMW open source engine recreation. These instructions were tested on a ThinkPad X1 Carbon Gen 3. The information was adapted from this OpenMW forum thread: <a href=\"https://forum.openmw.org/viewtopic.php?t=3510\">https://forum.openmw.org/viewtopic.php?t=3510</a></p>\n</blockquote>\n\n<ul>\n<li>\n<ol>\n<li>Purchase and download the DRM-free version from GOG (also considered the best version due to the high quality PDF guide that it comes with): <a href=\"https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition\">https://www.gog.com/game/the_elder_scrolls_iii_morrowind_goty_edition</a></li>\n</ol>\n</li>\n<li>\n<ol start=\"2\">\n<li>Install the required packages built from the ports tree as root. openmw is the recreated game engine, and innoextract is how we will get the game data files out of the win32 executable.</li>\n</ol>\n</li>\n</ul>\n\n<p><code>pkg_add openmw innoextract</code></p>\n\n<ul>\n<li>\n<ol start=\"3\">\n<li>Move the file from GOG setup_tes_morrowind_goty_2.0.0.7.exe into its own directory morrowind/ due to innoextract’s default behaviour of extracting into the current directory. Then type:</li>\n</ol>\n</li>\n</ul>\n\n<p><code>innoextract setup_tes_morrowind_goty_2.0.0.7.exe</code></p>\n\n<ul>\n<li>\n<ol start=\"4\">\n<li>Type openmw-wizard and follow the straightforward instructions. Note that you have a pre-existing installation, and select the morrowind/app/Data Files folder that innoextract extracted.</li>\n</ol>\n</li>\n<li>\n<ol start=\"5\">\n<li>Type in openmw-launcher, toggle the settings to your preferences, and then hit play!</li>\n</ol>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong><br>\n<a href=\"https://twitter.com/allanjude/status/1034647571124367360\">https://twitter.com/allanjude/status/1034647571124367360</a></p>\n\n<p>###<a href=\"https://euroquis.nl/bobulate/?p=1937\">My First Clang Bug</a></p>\n\n<blockquote>\n<p>Part of the role of being a packager is compiling lots (and lots) of packages. That means compiling lots of code from interesting places and in a variety of styles. In my opinion, being a good packager also means providing feedback to upstream when things are bad. That means filing upstream bugs when possible, and upstreaming patches.<br>\nOne of the “exciting” moments in packaging is when tools change. So each and every major CMake update is an exercise in recompiling 2400 or more packages and adjusting bits and pieces. When a software project was last released in 2013, adjusting it to modern tools can become quite a chore (e.g. Squid Report Generator). CMake is excellent for maintaining backwards compatibility, generally accommodating old software with new policies. The most recent 3.12 release candidate had three issues filed from the FreeBSD side, all from fallout with older software.  I consider the hours put into good bug reports, part of being a good citizen of the Free Software world.<br>\nMy most interesting bug this week, though, came from one line of code somewhere in Kleopatra: Q_UNUSED(gpgagent_data);<br>\nThat one line triggered a really peculiar link error in KDE’s FreeBSD CI system. Yup … telling the compiler something is unused made it fall over. Commenting out that line got rid of the link error, but introduced a warning about an unused function. Working with KDE-PIM’s Volker Krause, we whittled the problem down to a six-line example program — two lines if you don’t care much for coding style. I’m glad, at that point, that I could throw it over the hedge to the LLVM team with some explanatory text. Watching the process on their side reminds me ever-so-strongly of how things work in KDE (or FreeBSD for that matter): Bugzilla, Phabricator, and git combine to be an effective workflow for developers (perhaps less so for end-users).<br>\nToday I got a note saying that the issue had been resolved. So brief a time for a bug. Live fast. Get squashed young.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.phoronix.com/scan.php?page=news_item&amp;px=Threadripper-2990WX-DragonFly\">DragonFlyBSD Now Runs On The Threadripper 2990WX, Developer Shocked At Performance</a></p>\n\n<blockquote>\n<p>Last week I carried out some tests of BSD vs. Linux on the new 32-core / 64-thread Threadripper 2990WX. I tested FreeBSD 11, FreeBSD 12, and TrueOS – those benchmarks will be published in the next few days. I tried DragonFlyBSD, but at the time it wouldn’t boot with this AMD HEDT processor. But now the latest DragonFlyBSD development kernel can handle the 2990WX and the lead DragonFly developer calls this new processor “a real beast” and is stunned by its performance potential.</p>\n</blockquote>\n\n<blockquote>\n<p>When I tried last week, the DragonFlyBSD 5.2.2 stable release nor DragonFlyBSD 5.3 daily snapshot would boot on the 2990WX. But it turns out Matthew Dillon, the lead developer of DragonFlyBSD, picked up a rig and has it running now. So in time for the next 5.4 stable release or those using the daily snapshots can have this 32-core / 64-thread Zen+ CPU running on this operating system long ago forked from FreeBSD.</p>\n</blockquote>\n\n<blockquote>\n<p>In announcing his success in bringing up the 2990WX under DragonFlyBSD, which required a few minor changes, he shared his performance thoughts and hopes for the rig. “The cpu is a real beast, packing 32 cores and 64 threads. It blows away our dual-core Xeon to the tune of being +50% faster in concurrent compile tests, and it also blows away our older 4-socket Opteron (which we call ‘Monster’) by about the same margin. It’s an impressive CPU. For now the new beast is going to be used to help us improve I/O performance through the filesystem, further SMP work (but DFly scales pretty well to 64 threads already), and perhaps some driver to work to support the 10gbe on the mobo.”</p>\n</blockquote>\n\n<blockquote>\n<p>Dillon shared some results on the system as well. &quot; The Threadripper 2990WX is a beast. It is at <em>least</em> 50% faster than both the quad socket opteron and the dual socket Xeon system I tested against. The primary limitation for the 2990WX is likely its 4 channels of DDR4 memory, and like all Zen and Zen+ CPUs, memory performance matters more than CPU frequency (and costs almost no power to pump up the performance). That said, it still blow away a dual-socket Xeon with 3x the number of memory channels. That is impressive!&quot;</p>\n</blockquote>\n\n<blockquote>\n<p>The well known BSD developer also added, “This puts the 2990WX at par efficiency vs a dual-socket Xeon system, and better than the dual-socket Xeon with slower memory and a power cap. This is VERY impressive. I should note that the 2990WX is more specialized with its asymetric NUMA architecture and 32 cores. I think the sweet spot in terms of CPU pricing and efficiency is likely going to be with the 2950X (16-cores/32-threads). It is clear that the 2990WX (32-cores/64-threads) will max out 4-channel memory bandwidth for many workloads, making it a more specialized part. But still awesome…This thing is an incredible beast, I’m glad I got it.”</p>\n</blockquote>\n\n<blockquote>\n<p>While I have the FreeBSD vs. Linux benchmarks from a few days ago, it looks like now on my ever growing TODO list will be re-trying out the newest DragonFlyBSD daily snapshot for seeing how the performance compares in the mix. Stay tuned for the numbers that should be in the next day or two.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180810075449\">X11 on really small devices</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180810131231\">mandoc-1.14.4 released</a></li>\n<li><a href=\"https://www.netgate.com/blog/pfSense-book-available-to-everyone.html\">The pfSense Book is now available to everyone</a></li>\n<li><a href=\"https://mwl.io/archives/3619\">MWL: Burn it down! Burn it all down!</a></li>\n<li><a href=\"https://github.com/begriffs/obsd\">Configuring OpenBSD: System and user config files for a more pleasant laptop</a></li>\n<li><a href=\"https://www.freebsd.org/security/advisories/FreeBSD-SA-18:08.tcp.asc\">FreeBSD Security Advisory: Resource exhaustion in TCP reassembly</a></li>\n<li><a href=\"https://discoverbsd.com/p/92d80d1497\">OpenBSD Foundation gets first 2018 Iridium donation</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=337653\">New ZFS commit solves issue a few users reported in the feedback segment</a></li>\n<li><a href=\"https://twitter.com/TridentProject/status/1034620476553867264\">Project Trident should have a beta release by the end of next week</a></li>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/253447019/\">Reminder about Stockholm BUG: September 5, 17:30-22:00</a></li>\n<li><a href=\"https://bsd-pl.org/en\">BSD-PL User Group: September 13, 18:30-21:00</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Malcom - <a href=\"http://dpaste.com/15VVVCP\">Having different routes per interface</a></li>\n<li>Bostjan - <a href=\"http://dpaste.com/1Q14C6H#wrap\">ZFS and integrity of data</a></li>\n<li>Michael - <a href=\"http://dpaste.com/2JD17BP#wrap\">Suggestion for Monitoring</a></li>\n<li>Barry - <a href=\"http://dpaste.com/2GJ3RMG#wrap\">Feedback</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"Insight into TrueOS and Trident, stop evildoers with pf-badhost, Flashback to FreeBSDcon ‘99, OpenBSD’s measures against TLBleed, play Morrowind on OpenBSD in 5 steps, DragonflyBSD developers shocked at Threadripper performance, and more.","date_published":"2018-08-30T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9bf2ff39-f045-4c19-8416-f1a6da6d3f84.mp3","mime_type":"audio/mp3","size_in_bytes":65719133,"duration_in_seconds":6553}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2463","title":"Episode 260: Hacking Tour of Europe | BSD Now 260","url":"https://www.bsdnow.tv/260","content_text":"Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.\n\n##Headlines\n###Essen Hackathon &amp; BSDCam 2018 trip report\n\n\nAllan and Benedict met at FRA airport and then headed to the Air Rail terminal for our train to Essen where the Hackathon would happen over the weekend of Aug 10 - 12, 2018. Once there, we did not have to wait long until other early-arrivals would show up and soon we had about 10 people gathered for lunch. After buying some take-out pizzas and bringing it back to the Linuxhotel (there was a training still going on there so we could not get into our rooms yet), we sat in the sunny park and talked. More and more people arrived and soon, people started hacking on their laptops. Some people would not arrive until a few hours before midnight, but we already had a record appearance of 20 people in total.\nOn Saturday, we gathered everyone in one of the seminar rooms that had rooms and chairs for us. After some organizational infos, we did an introductory round and Benedict wrote down on the whiteboard what people were interested in. It was not long until groups formed to talk about SSL in base, weird ZFS scrubs that would go over 100% completion (fixed now). Other people started working on ports, fixing bugs, or wrote documentation. The day ended in a BBQ in the Linuxhotel park, which was well received by everyone.\nOn Sunday, after attendees packed up their luggage and stored it in the seminar room, we continued hacking until lunchtime. After a quick group picture, we headed to a local restaurant for the social event (which was not open on Saturday, otherwise we would have had it then). In the afternoon, most people departed, a good half of them were heading for BSDCam.\nCommits from the hackathon (the ones from 2018)\nOverall, the hackathon was well received by attendees and a lot of them liked the fact that it was close to another BSD gathering so they could nicely combine the two. Also, people thought about doing their own hackathon in the future, which is an exciting prospect. Thanks to all who attended, helped out here and there when needed. Special Thanks to Netzkommune GmbH for sponsoring the social event and the Linuxhotel for having us.\nBenedict was having a regular work day on Monday after coming back from the hackathon, but flew out to Heathrow on Tuesday. Allan was in London a day earlier and arrived a couple of hours before Benedict in Cambridge. He headed for the Computer Lab even though the main event would not start until Wednesday. Most people gathered at the Maypole pub on Tuesday evening for welcomes, food and drinks.\nOn Wednesday, a lot of people met in the breakfast room of Churchill College where most people were staying and went to the Computer Lab, which served as the main venue for BSDCam, together. The morning was spend with introductions and collecting what most people were interested in talking. This unconference style has worked well in the past and soon we had 10 main sessions together for the rest of this and the following two days (full schedule).\nMost sessions took notes, which you can find on the FreeBSD wiki.\nOn Thursday evening, we had a nice formal dinner at Trinity Hall.\nBSDCam 2018 was a great success with a lot of fruitful discussions and planning sessions. We thank the organizers for BSDCam for making it happen.\nA special mentions goes out to Robert Watson and his family. Even though he was not there, he had a good reason to miss it: they had their first child born at the beginning of the week. Congratulations and best wishes to all three of them!\n\n\n\n\n###Call for Testing: ZFS Native Encryption for FreeBSD\n\n\nA port of the ZoL (ZFS-on-Linux) feature that provides native crypto support for ZFS is ready for testing on FreeBSD\nMost of the porting was done by sef@freebsd.org (Sean Eric Fagan)\nThe original ZoL commit is here: https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49\nFor an overview, see Tom Caputi’s presentation from the OpenZFS Developers Summit in 2016\nVideo: https://youtu.be/frnLiXclAMo\nSlides: https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing\nWARNING: test in VMs or with spare disks etc, pools created with this code, or upgraded to this version, will no longer be importable on systems that do not support this feature. The on-disk format or other things may change before the final version, so you will likely have to ‘zfs send | zfs recv’ the data on to a new pool\nThanks for testing to help this feature land in FreeBSD\n\n\n\n\niXsystems\n\n###Call for Testing: UFS TRIM Consolidation\n\n\nKirk Mckusick posts to the FreeBSD mailing list looking for testers for the new UFS TRIM Consolidation code\n\n\n\nWhen deleting files on filesystems that are stored on flash-memory (solid-state) disk drives, the filesystem notifies the underlying disk of the blocks that it is no longer using. The notification allows the drive to avoid saving these blocks when it needs to flash (zero out) one of its flash pages. These notifications of no-longer-being-used blocks are referred to as TRIM notifications. In FreeBSD these TRIM notifications are sent from the filesystem to the drive using the BIO_DELETE command.\nUntil now, the filesystem would send a separate message to the drive for each block of the file that was deleted. Each Gigabyte of file size resulted in over 3000 TRIM messages being sent to the drive. This burst of messages can overwhelm the drive’s task queue causing multiple second delays for read and write requests.\nThis implementation collects runs of contiguous blocks in the file and then consolodates them into a single BIO_DELETE command to the drive. The BIO_DELETE command describes the run of blocks as a single large block being deleted. Each Gigabyte of file size can result in as few as two BIO_DELETE commands and is typically less than ten.  Though these larger BIO_DELETE commands take longer to run, they do not clog the drive task queue, so read and write commands can intersperse effectively with them.\nThough this new feature has been throughly reviewed and tested, it is being added disabled by default so as to minimize the possibility of disrupting the upcoming 12.0 release. It can be enabled by running ``sysctl vfs.ffs.dotrimcons=1’’. Users are encouraged to test it. If no problems arise, we will consider requesting that it be enabled by default for 12.0.\nThis support is off by default, but I am hoping that I can get enough testing to ensure that it (a) works, and (b) is helpful that it will be reasonable to have it turned on by default in 12.0. The cutoff for turning it on by default in 12.0 is September 19th. So I am requesting your testing feedback in the near-term. Please let me know if you have managed to use it successfully (or not) and also if it provided any performance difference (good or bad).\n\n\n\nTo enable TRIM consolidation use `sysctl vfs.ffs.dotrimcons=1’\nThere is also a diff that adds additional statistics: https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html\nYou can also watch the volume and latency of BIO_DELETE commands by running gstat with the -d flag\n\n\n\n\n##News Roundup\n###ZFS performance\n\n\nAravindh Sampathkumar, a Performance Engineer and Sysadmin posts some simple benchmarks he did on a new ZFS server\n\n\n\nThis is NOT an all-in post about ZFS performance. I built a FreeBSD+ZFS file server recently at work to serve as an offsite backup server. I wanted to run a few synthetic workloads on it and look at how it fares from performance perspective. Mostly for curiosity and learning purposes.\nAs stated in the notes about building this server, performance was not one of the priorities, as this server will never face our active workload. What I care about from this server is its ability to work with rsync and keep the data synchronised with our primary storage server. With that context, I ran a few write tests to see how good our solution is and what to expect from it in terms of performance.\n\n\n\nThe article then uses FIO to do some benchmarks.\nAs the author did, make sure you match the FIO block size to the ZFS record size to avoid write amplification. Either tune FIO or adjust the recordsize property in ZFS\nYou also want to consider compression and cache effects\n\n\n\nWrite Performance: Incompressible: 1600-2600 MB/s, Compressible: 2500-6600 MB/s\nAnother over 1200 MB/s is enough to keep your 10 gigabit network saturated\n\n\n\nThe increased latency that is seen with higher number of writers working, may be the result of the ZFS backpressure system (the write throttle). There is some tuning that can be done there. Specifically, since this machine has 768 GB of ram, you might allow more than 4GB of dirty data, which would mean you’d be able to write larger batches and not have to push back while you wait for a transaction group to flush when dealing with gigabytes/sec of writes\n\n\n\n\n###How to port your OS to EC2\n\n\nColin Percival reflects on his FreeBSD on EC2 maintainership efforts in his blog:\n\n\n\nI’ve been the maintainer of the FreeBSD/EC2 platform for about 7.5 years now, and as far as “running things in virtual machines” goes, that remains the only operating system and the only cloud which I work on. That said, from time to time I get questions from people who want to port other operating systems into EC2, and being a member of the open source community, I do my best to help them. I realized a few days ago that rather than replying to emails one by one it would be more efficient to post something publicly; so — for the benefit of the dozen or so people who want to port operating systems to run in EC2, and the curiosity of maybe a thousand more people who use EC2 but will never build AMIs themselves — here’s a rough guide to building EC2 images.\nBefore we can talk about building images, there are some things you need:\nYour OS needs to run on x86 hardware. 64-bit (“amd64”, “x86-64”) is ideal, but I’ve managed to run 32-bit FreeBSD on “64-bit” EC2 instances so at least in some cases that’s not strictly necessary.\nYou almost certainly want to have drivers for Xen block devices (for all of the pre-Nitro EC2 instances) or for NVMe disks (for the most recent EC2 instances). Theoretically you could make do without these since there’s some ATA emulation available for bootstrapping, but if you want to do any disk I/O after the kernel finishes booting you’ll want to have a disk driver.\nSimilarly, you need support for the Xen network interface (older instances), Intel 10 GbE SR-IOV networking (some newer but pre-Nitro instances), or Amazon’s “ENA” network adapters (on Nitro instances), unless you plan on having instances which don’t communicate over the network. The ENA driver is probably the hardest thing to port, since as far as I know there’s no way to get your hands on the hardware directly, and it’s very difficult to do any debugging in EC2 without having a working network.\nFinally, the obvious: You need to have an AWS account, and appropriate API access keys.\nBuilding a disk image\nBuilding an AMI\nI wrote a simple tool for converting disk images into EC2 instances: bsdec2-image-upload. It uploads a disk image to Amazon S3; makes an API call to import that disk image into an EBS volume; creates a snapshot of that volume; then registers an EC2 AMI using that snapshot.\nTo use bsdec2-image-upload, you’ll first need to create an S3 bucket for it to use as a staging area. You can call it anything you like, but I recommend that you\n\n\n\nCreate it in a “nearby” region (for performance reasons), and\nSet an S3 “lifecycle policy” which deletes objects automatically after 1 day (since bsdec2-image-upload doesn’t clean up the S3 bucket, and those objects are useless once you’ve finished creating an AMI).\n\n\n\nBoot configuration\nOdds are that your instance started booting and got as far as the boot loader launching the kernel, but at some point after that things went sideways. Now we start the iterative process of building disk images, turning them into AMIs, launching said AMIs, and seeing where they break. Some things you’ll probably run into here:\nEC2 instances have two types of console available to them: A serial console and an VGA console. (Or rather, emulated serial and emulated VGA.) If you can have your kernel output go to both consoles, I recommend doing that. If you have to pick one, the serial console (which shows up as the “System Log” in EC2) is probably more useful than the VGA console (which shows up as “instance screenshot”) since it lets you see more than one screen of logs at once; but there’s a catch: Due to some bizarre breakage in EC2 — which I’ve been complaining about for ten years — the serial console is very “laggy”. If you find that you’re not getting any output, wait five minutes and try again.\nYou may need to tell your kernel where to find the root filesystem. On FreeBSD we build our disk images using GPT labels, so we simply need to specify in /etc/fstab that the root filesystem is on /dev/gpt/rootfs; but if you can’t do this, you’ll probably need to have different AMIs for Nitro instances vs. non-Nitro instances since Xen block devices will typically show up with different device names from NVMe disks. On FreeBSD, I also needed to set the vfs.root.mountfrom kernel environment variable for a while; this also is no longer needed on FreeBSD but something similar may be needed on other systems.\nYou’ll need to enable networking, using DHCP. On FreeBSD, this means placing ifconfig_DEFAULT=“SYNCDHCP” into /etc/rc.conf; other systems will have other ways of specifying network parameters, and it may be necessary to specify a setting for the Xen network device, Intel SR-IOV network, and the Amazon ENA interface so that you’ll have the necessary configuration across all EC2 instance types. (On FreeBSD, ifconfig_DEFAULT takes care of specifying the network settings which should apply for whatever network interface the kernel finds at boot time.)\nYou’ll almost certainly want to turn on SSH, so that you can connect into newly launched instances and make use of them. Don’t worry about setting a password or creating a user to SSH into yet — we’ll take care of that later.\nEC2 configuration\nNow it’s time to make the AMI behave like an EC2 instance. To this end, I prepared a set of rc.d scripts for FreeBSD. Most importantly, they\nPrint the SSH host keys to the console, so that you can veriy that they are correct when you first SSH in. (Remember, Verifying SSH host keys is more important than flossing every day.)\nDownload the SSH public key you want to use for logging in, and create an account (by default, “ec2-user”) with that key set up for you.\nFetch EC2 user-data and process it via configinit to allow you to configure the system as part of the process of launching it.\nIf your OS has an rc system derived from NetBSD’s rc.d, you may be able to use these scripts without any changes by simply installing them and enabling them in /etc/rc.conf; otherwise you may need to write your own scripts using mine as a model.\nFirstboot scripts\nA feature I added to FreeBSD a few years ago is the concept of “firstboot” scripts: These startup scripts are only run the first time a system boots. The aforementioned configinit and SSH key fetching scripts are flagged this way — so if your OS doesn’t support the “firstboot” keyword on rc.d scripts you’ll need to hack around that — but EC2 instances also ship with other scripts set to run on the first boot:\nFreeBSD Update will fetch and install security and critical errata updates, and then reboot the system if necessary.\nThe UFS filesystem on the “boot disk” will be automatically expanded to the full size of the disk — this makes it possible to specify a larger size of disk at EC2 instance launch time.\nThird-party packages will be automatically fetched and installed, according to a list in /etc/rc.conf. This is most useful if configinit is used to edit /etc/rc.conf, since it allows you to specify packages to install via the EC2 user-data.\nWhile none of these are strictly necessary, I find them to be extremely useful and highly recommend implementing similar functionality in your systems.\nSupport my work!\nI hope you find this useful, or at very least interesting. Please consider supporting my work in this area; while I’m happy to contribute my time to supporting open source software, it would be nice if I had money coming in which I could use to cover incidental expenses (e.g., conference travel) so that I didn’t end up paying to contribute to FreeBSD.\n\n\n\n\nDigital Ocean\nhttps://do.co/bsdnow\n\n###Traceability, by Vint Cerf\n\n\nA recent article from the August issue of the Communications of the ACM, for your contemplation:\n\n\n\nAt a recent workshop on cybersecurity in the U.K., a primary topic of consideration was how to preserve the freedom and openness of the Internet while protecting against the harmful behaviors that have emerged in this global medium. That this is a significant challenge cannot be overstated. The bad behaviors range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills requiring a wide range of technical and legal considerations. That these harmful behaviors can and do cross international boundaries only makes it more difficult to fashion effective responses.\nIn other columns, I have argued for better software development tools to reduce the common mistakes that lead to vulnerabilities that are exploited. Here, I want to focus on another aspect of response related to law enforcement and tracking down perpetrators. Of course, not all harms are (or perhaps are not yet) illegal, but discovering those who cause them may still be warranted. The recent adoption and implementation of the General Data Protection Regulation (GDPR) in the European Union creates an interesting tension because it highlights the importance and value of privacy while those who do direct or indirect harm must be tracked down and their identities discovered.\nIn passing, I mention that cryptography has sometimes been blamed for protecting the identity or actions of criminals but it is also a tool for protecting privacy. Arguments have been made for “back doors” to cryptographic systems but I am of the opinion that such proposals carry extremely high risk to privacy and safety. It is not my intent to argue this question in this column.\nWhat is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: “Cerfsup”). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.\nIn the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.\nThis suggests to me that the notion of traceability under (internationally?) agreed circumstances (that is, differential traceability) might be a fruitful concept to explore. In most societies today, it is accepted that we must be identifiable to appropriate authorities under certain conditions (consider border crossings, traffic violation stops as examples). While there are conditions under which apparent anonymity is desirable and even justifiable (whistle-blowing, for example) absolute anonymity is actually quite difficult to achieve (another point made at the Ditchley workshop) and might not be absolutely desirable given the misbehaviors apparent anonymity invites. I expect this is a controversial conclusion and I look forward to subsequent discussion.\n\n\n\n\n###Remote Access Console using FreeBSD on an RPi3\n\n\nOur friend, and FOSDEM Booth Neighbour, Jorge, has posted a tutorial on how he created a remote access console for his SmartOS server and other machines in his homelab\nParts:\nRaspberry Pi 3 B+\nNavoLabs micro POE Hat\nFT4232H  based USB-to-RS232 (4x) adapter\nOfficial Raspberry Pi case (optional)\nHeat-sink kit (optional)\nUSB-to-TTL adaptor (optional)\nSandisk 16Gb microSD\n\n\n\nFor the software I ended up using conserver. Below is a very brief tutorial on how to set everything up. I assume you have basic unix skills.\n\n\n\nGet an RPi3 image, make some minor modifications for RPi3+, and write it to the USB stick\nConfigure FreeBSD on the RPi3\n\nLoad the ‘muge’ Ethernet Driver\nLoad USB serial support\nLoad the FTDI driver\nEnable SSHd and Conserver\nConfigure Conserver\nSetup log rotation\nStart Conserver\n\n\n\nAnd you’re good to go\n\n\n\nA small bonus script I wrote to turn on the 2nd LED on the rPI once the system is booted, it will then blink the LED if someone is connected to any of the consoles.\n\n\n\nThere is also a followup post with some additional tips: https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/\n\n\n\n\n##Beastie Bits\n\n\nAnnual Penguin Races\nMscgen - Message Sequence Chart generator\nThis patch makes FreeBSD boot 500 - 800ms faster, please test on your hardware\nFreeBSD’s arc4random() replaced with OpenBSD ChaCha20 implementation\nMeetBSD Devsummit open for registrations\nNew Podcast interview with Michael W. Lucas\n\n\n\n\nTarsnap\n\n##Feedback/Questions\nWe need more feedback emails. Please write to feedback@bsdnow.tv\n\nAdditionally, we are considering a new segment to be added to the end of the show (to make it skippable), where we have a ~15 minute deep dive on a topic. Some initial ideas are on the Virtual Memory subsystem, the Scheduler, Capsicum, and GEOM. What topics would you like to get very detailed explanations of? Many of the explanations may have accompanying graphics, and not be very suitable for audio only listeners, that is why we are planning to put it at the very end of the episode.\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://wiki.freebsd.org/DevSummit/201808Hackathon\">Essen Hackathon &amp; BSDCam 2018 trip report</a></p>\n\n<ul>\n<li>Allan and Benedict met at FRA airport and then headed to the Air Rail terminal for our train to Essen where the Hackathon would happen over the weekend of Aug 10 - 12, 2018. Once there, we did not have to wait long until other early-arrivals would show up and soon we had about 10 people gathered for lunch. After buying some take-out pizzas and bringing it back to the Linuxhotel (there was a training still going on there so we could not get into our rooms yet), we sat in the sunny park and talked. More and more people arrived and soon, people started hacking on their laptops. Some people would not arrive until a few hours before midnight, but we already had a record appearance of 20 people in total.</li>\n<li>On Saturday, we gathered everyone in one of the seminar rooms that had rooms and chairs for us. After some organizational infos, we did an introductory round and Benedict wrote down on the whiteboard what people were interested in. It was not long until groups formed to talk about SSL in base, weird ZFS scrubs that would go over 100% completion (fixed now). Other people started working on ports, fixing bugs, or wrote documentation. The day ended in a <a href=\"https://twitter.com/bsdbcr\">BBQ in the Linuxhotel park</a>, which was well received by everyone.</li>\n<li>On Sunday, after attendees packed up their luggage and stored it in the seminar room, we continued hacking until lunchtime. After a quick group picture, we headed to a local restaurant for the social event (which was not open on Saturday, otherwise we would have had it then). In the afternoon, most people departed, a good half of them were heading for BSDCam.</li>\n<li><a href=\"http://freshbsd.org/search?q=Essen+hackathon\">Commits from the hackathon (the ones from 2018)</a></li>\n<li>Overall, the hackathon was well received by attendees and a lot of them liked the fact that it was close to another BSD gathering so they could nicely combine the two. Also, people thought about doing their own hackathon in the future, which is an exciting prospect. Thanks to all who attended, helped out here and there when needed. Special Thanks to <a href=\"https://www.netzkommune.de/\">Netzkommune GmbH</a> for sponsoring the social event and the <a href=\"http://linuxhotel.de/\">Linuxhotel</a> for having us.</li>\n<li>Benedict was having a regular work day on Monday after coming back from the hackathon, but flew out to Heathrow on Tuesday. Allan was in London a day earlier and arrived a couple of hours before Benedict in Cambridge. He headed for the Computer Lab even though the main event would not start until Wednesday. Most people gathered at the Maypole pub on Tuesday evening for welcomes, food and drinks.</li>\n<li>On Wednesday, a lot of people met in the breakfast room of Churchill College where most people were staying and went to the Computer Lab, which served as the main venue for BSDCam, together. The morning was spend with introductions and collecting what most people were interested in talking. This unconference style has worked well in the past and soon we had 10 main sessions together for the rest of this and the following two days (<a href=\"https://bsdcam.cl.cam.ac.uk/\">full schedule</a>).</li>\n<li>Most sessions took notes, which you can find on the <a href=\"https://wiki.freebsd.org/DevSummit/201808\">FreeBSD wiki</a>.</li>\n<li>On Thursday evening, we had a nice formal dinner at Trinity Hall.</li>\n<li>BSDCam 2018 was a great success with a lot of fruitful discussions and planning sessions. We thank the organizers for BSDCam for making it happen.</li>\n<li>A special mentions goes out to Robert Watson and his family. Even though he was not there, he had a good reason to miss it: they had their first child born at the beginning of the week. Congratulations and best wishes to all three of them!</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070832.html\">Call for Testing: ZFS Native Encryption for FreeBSD</a></p>\n\n<ul>\n<li>A port of the ZoL (ZFS-on-Linux) feature that provides native crypto support for ZFS is ready for testing on FreeBSD</li>\n<li>Most of the porting was done by <a href=\"mailto:sef@freebsd.org\">sef@freebsd.org</a> (Sean Eric Fagan)</li>\n<li>The original ZoL commit is here: <a href=\"https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49\">https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49</a></li>\n<li>For an overview, see Tom Caputi’s presentation from the OpenZFS Developers Summit in 2016</li>\n<li>Video: <a href=\"https://youtu.be/frnLiXclAMo\">https://youtu.be/frnLiXclAMo</a></li>\n<li>Slides: <a href=\"https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing\">https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=sharing</a></li>\n<li>WARNING: test in VMs or with spare disks etc, pools created with this code, or upgraded to this version, will no longer be importable on systems that do not support this feature. The on-disk format or other things may change before the final version, so you will likely have to ‘zfs send | zfs recv’ the data on to a new pool</li>\n<li>Thanks for testing to help this feature land in FreeBSD</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###<a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070797.html\">Call for Testing: UFS TRIM Consolidation</a></p>\n\n<ul>\n<li>Kirk Mckusick posts to the FreeBSD mailing list looking for testers for the new UFS TRIM Consolidation code</li>\n</ul>\n\n<blockquote>\n<p>When deleting files on filesystems that are stored on flash-memory (solid-state) disk drives, the filesystem notifies the underlying disk of the blocks that it is no longer using. The notification allows the drive to avoid saving these blocks when it needs to flash (zero out) one of its flash pages. These notifications of no-longer-being-used blocks are referred to as TRIM notifications. In FreeBSD these TRIM notifications are sent from the filesystem to the drive using the BIO_DELETE command.<br>\nUntil now, the filesystem would send a separate message to the drive for each block of the file that was deleted. Each Gigabyte of file size resulted in over 3000 TRIM messages being sent to the drive. This burst of messages can overwhelm the drive’s task queue causing multiple second delays for read and write requests.<br>\nThis implementation collects runs of contiguous blocks in the file and then consolodates them into a single BIO_DELETE command to the drive. The BIO_DELETE command describes the run of blocks as a single large block being deleted. Each Gigabyte of file size can result in as few as two BIO_DELETE commands and is typically less than ten.  Though these larger BIO_DELETE commands take longer to run, they do not clog the drive task queue, so read and write commands can intersperse effectively with them.<br>\nThough this new feature has been throughly reviewed and tested, it is being added disabled by default so as to minimize the possibility of disrupting the upcoming 12.0 release. It can be enabled by running ``sysctl vfs.ffs.dotrimcons=1’’. Users are encouraged to test it. If no problems arise, we will consider requesting that it be enabled by default for 12.0.<br>\nThis support is off by default, but I am hoping that I can get enough testing to ensure that it (a) works, and (b) is helpful that it will be reasonable to have it turned on by default in 12.0. The cutoff for turning it on by default in 12.0 is September 19th. So I am requesting your testing feedback in the near-term. Please let me know if you have managed to use it successfully (or not) and also if it provided any performance difference (good or bad).</p>\n</blockquote>\n\n<ul>\n<li>To enable TRIM consolidation use `sysctl vfs.ffs.dotrimcons=1’</li>\n<li>There is also a diff that adds additional statistics: <a href=\"https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html\">https://lists.freebsd.org/pipermail/freebsd-current/2018-August/070798.html</a></li>\n<li>You can also watch the volume and latency of BIO_DELETE commands by running <code>gstat</code> with the -d flag</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://aravindh.net/post/zfs_performance/\">ZFS performance</a></p>\n\n<ul>\n<li>Aravindh Sampathkumar, a Performance Engineer and Sysadmin posts some simple benchmarks he did on a new ZFS server</li>\n</ul>\n\n<blockquote>\n<p>This is NOT an all-in post about ZFS performance. I built a FreeBSD+ZFS file server recently at work to serve as an offsite backup server. I wanted to run a few synthetic workloads on it and look at how it fares from performance perspective. Mostly for curiosity and learning purposes.<br>\nAs stated in the notes about building this server, performance was not one of the priorities, as this server will never face our active workload. What I care about from this server is its ability to work with rsync and keep the data synchronised with our primary storage server. With that context, I ran a few write tests to see how good our solution is and what to expect from it in terms of performance.</p>\n</blockquote>\n\n<ul>\n<li>The article then uses FIO to do some benchmarks.</li>\n<li>As the author did, make sure you match the FIO block size to the ZFS record size to avoid write amplification. Either tune FIO or adjust the recordsize property in ZFS</li>\n<li>You also want to consider compression and cache effects</li>\n</ul>\n\n<blockquote>\n<p>Write Performance: Incompressible: 1600-2600 MB/s, Compressible: 2500-6600 MB/s<br>\nAnother over 1200 MB/s is enough to keep your 10 gigabit network saturated</p>\n</blockquote>\n\n<ul>\n<li>The increased latency that is seen with higher number of writers working, may be the result of the ZFS backpressure system (the write throttle). There is some tuning that can be done there. Specifically, since this machine has 768 GB of ram, you might allow more than 4GB of dirty data, which would mean you’d be able to write larger batches and not have to push back while you wait for a transaction group to flush when dealing with gigabytes/sec of writes</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"http://www.daemonology.net/blog/2018-07-14-port-OS-to-EC2.html\">How to port your OS to EC2</a></p>\n\n<ul>\n<li>Colin Percival reflects on his FreeBSD on EC2 maintainership efforts in his blog:</li>\n</ul>\n\n<blockquote>\n<p>I’ve been the maintainer of the FreeBSD/EC2 platform for about 7.5 years now, and as far as “running things in virtual machines” goes, that remains the only operating system and the only cloud which I work on. That said, from time to time I get questions from people who want to port other operating systems into EC2, and being a member of the open source community, I do my best to help them. I realized a few days ago that rather than replying to emails one by one it would be more efficient to post something publicly; so — for the benefit of the dozen or so people who want to port operating systems to run in EC2, and the curiosity of maybe a thousand more people who use EC2 but will never build AMIs themselves — here’s a rough guide to building EC2 images.<br>\nBefore we can talk about building images, there are some things you need:<br>\nYour OS needs to run on x86 hardware. 64-bit (“amd64”, “x86-64”) is ideal, but I’ve managed to run 32-bit FreeBSD on “64-bit” EC2 instances so at least in some cases that’s not strictly necessary.<br>\nYou almost certainly want to have drivers for Xen block devices (for all of the pre-Nitro EC2 instances) or for NVMe disks (for the most recent EC2 instances). Theoretically you could make do without these since there’s some ATA emulation available for bootstrapping, but if you want to do any disk I/O after the kernel finishes booting you’ll want to have a disk driver.<br>\nSimilarly, you need support for the Xen network interface (older instances), Intel 10 GbE SR-IOV networking (some newer but pre-Nitro instances), or Amazon’s “ENA” network adapters (on Nitro instances), unless you plan on having instances which don’t communicate over the network. The ENA driver is probably the hardest thing to port, since as far as I know there’s no way to get your hands on the hardware directly, and it’s very difficult to do any debugging in EC2 without having a working network.<br>\nFinally, the obvious: You need to have an AWS account, and appropriate API access keys.<br>\nBuilding a disk image</p>\n<p>Building an AMI<br>\nI wrote a simple tool for converting disk images into EC2 instances: bsdec2-image-upload. It uploads a disk image to Amazon S3; makes an API call to import that disk image into an EBS volume; creates a snapshot of that volume; then registers an EC2 AMI using that snapshot.<br>\nTo use bsdec2-image-upload, you’ll first need to create an S3 bucket for it to use as a staging area. You can call it anything you like, but I recommend that you</p>\n</blockquote>\n\n<blockquote>\n<p>Create it in a “nearby” region (for performance reasons), and<br>\nSet an S3 “lifecycle policy” which deletes objects automatically after 1 day (since bsdec2-image-upload doesn’t clean up the S3 bucket, and those objects are useless once you’ve finished creating an AMI).</p>\n</blockquote>\n\n<blockquote>\n<p>Boot configuration<br>\nOdds are that your instance started booting and got as far as the boot loader launching the kernel, but at some point after that things went sideways. Now we start the iterative process of building disk images, turning them into AMIs, launching said AMIs, and seeing where they break. Some things you’ll probably run into here:<br>\nEC2 instances have two types of console available to them: A serial console and an VGA console. (Or rather, emulated serial and emulated VGA.) If you can have your kernel output go to both consoles, I recommend doing that. If you have to pick one, the serial console (which shows up as the “System Log” in EC2) is probably more useful than the VGA console (which shows up as “instance screenshot”) since it lets you see more than one screen of logs at once; but there’s a catch: Due to some bizarre breakage in EC2 — which I’ve been complaining about for ten years — the serial console is very “laggy”. If you find that you’re not getting any output, wait five minutes and try again.<br>\nYou may need to tell your kernel where to find the root filesystem. On FreeBSD we build our disk images using GPT labels, so we simply need to specify in /etc/fstab that the root filesystem is on /dev/gpt/rootfs; but if you can’t do this, you’ll probably need to have different AMIs for Nitro instances vs. non-Nitro instances since Xen block devices will typically show up with different device names from NVMe disks. On FreeBSD, I also needed to set the vfs.root.mountfrom kernel environment variable for a while; this also is no longer needed on FreeBSD but something similar may be needed on other systems.<br>\nYou’ll need to enable networking, using DHCP. On FreeBSD, this means placing ifconfig_DEFAULT=“SYNCDHCP” into /etc/rc.conf; other systems will have other ways of specifying network parameters, and it may be necessary to specify a setting for the Xen network device, Intel SR-IOV network, and the Amazon ENA interface so that you’ll have the necessary configuration across all EC2 instance types. (On FreeBSD, ifconfig_DEFAULT takes care of specifying the network settings which should apply for whatever network interface the kernel finds at boot time.)<br>\nYou’ll almost certainly want to turn on SSH, so that you can connect into newly launched instances and make use of them. Don’t worry about setting a password or creating a user to SSH into yet — we’ll take care of that later.<br>\nEC2 configuration<br>\nNow it’s time to make the AMI behave like an EC2 instance. To this end, I prepared a set of rc.d scripts for FreeBSD. Most importantly, they<br>\nPrint the SSH host keys to the console, so that you can veriy that they are correct when you first SSH in. (Remember, Verifying SSH host keys is more important than flossing every day.)<br>\nDownload the SSH public key you want to use for logging in, and create an account (by default, “ec2-user”) with that key set up for you.<br>\nFetch EC2 user-data and process it via configinit to allow you to configure the system as part of the process of launching it.<br>\nIf your OS has an rc system derived from NetBSD’s rc.d, you may be able to use these scripts without any changes by simply installing them and enabling them in /etc/rc.conf; otherwise you may need to write your own scripts using mine as a model.<br>\nFirstboot scripts<br>\nA feature I added to FreeBSD a few years ago is the concept of “firstboot” scripts: These startup scripts are only run the first time a system boots. The aforementioned configinit and SSH key fetching scripts are flagged this way — so if your OS doesn’t support the “firstboot” keyword on rc.d scripts you’ll need to hack around that — but EC2 instances also ship with other scripts set to run on the first boot:<br>\nFreeBSD Update will fetch and install security and critical errata updates, and then reboot the system if necessary.<br>\nThe UFS filesystem on the “boot disk” will be automatically expanded to the full size of the disk — this makes it possible to specify a larger size of disk at EC2 instance launch time.<br>\nThird-party packages will be automatically fetched and installed, according to a list in /etc/rc.conf. This is most useful if configinit is used to edit /etc/rc.conf, since it allows you to specify packages to install via the EC2 user-data.<br>\nWhile none of these are strictly necessary, I find them to be extremely useful and highly recommend implementing similar functionality in your systems.<br>\nSupport my work!<br>\nI hope you find this useful, or at very least interesting. Please consider supporting my work in this area; while I’m happy to contribute my time to supporting open source software, it would be nice if I had money coming in which I could use to cover incidental expenses (e.g., conference travel) so that I didn’t end up paying to contribute to FreeBSD.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong><br>\n<a href=\"https://do.co/bsdnow\">https://do.co/bsdnow</a></p>\n\n<p>###<a href=\"https://cacm.acm.org/magazines/2018/8/229771-traceability/fulltext\">Traceability, by Vint Cerf</a></p>\n\n<ul>\n<li>A recent article from the August issue of the Communications of the ACM, for your contemplation:</li>\n</ul>\n\n<blockquote>\n<p>At a recent workshop on cybersecurity in the U.K., a primary topic of consideration was how to preserve the freedom and openness of the Internet while protecting against the harmful behaviors that have emerged in this global medium. That this is a significant challenge cannot be overstated. The bad behaviors range from social network bullying and misinformation to email spam, distributed denial of service attacks, direct cyberattacks against infrastructure, malware propagation, identity theft, and a host of other ills requiring a wide range of technical and legal considerations. That these harmful behaviors can and do cross international boundaries only makes it more difficult to fashion effective responses.<br>\nIn other columns, I have argued for better software development tools to reduce the common mistakes that lead to vulnerabilities that are exploited. Here, I want to focus on another aspect of response related to law enforcement and tracking down perpetrators. Of course, not all harms are (or perhaps are not yet) illegal, but discovering those who cause them may still be warranted. The recent adoption and implementation of the General Data Protection Regulation (GDPR) in the European Union creates an interesting tension because it highlights the importance and value of privacy while those who do direct or indirect harm must be tracked down and their identities discovered.<br>\nIn passing, I mention that cryptography has sometimes been blamed for protecting the identity or actions of criminals but it is also a tool for protecting privacy. Arguments have been made for “back doors” to cryptographic systems but I am of the opinion that such proposals carry extremely high risk to privacy and safety. It is not my intent to argue this question in this column.<br>\nWhat is of interest to me is a concept to which I was introduced at the Ditchley workshop, specifically, differential traceability. The ability to trace bad actors to bring them to justice seems to me an important goal in a civilized society. The tension with privacy protection leads to the idea that only under appropriate conditions can privacy be violated. By way of example, consider license plates on cars. They are usually arbitrary identifiers and special authority is needed to match them with the car owners (unless, of course, they are vanity plates like mine: “Cerfsup”). This is an example of differential traceability; the police department has the authority to demand ownership information from the Department of Motor Vehicles that issues the license plates. Ordinary citizens do not have this authority.<br>\nIn the Internet environment there are a variety of identifiers associated with users (including corporate users). Domain names, IP addresses, email addresses, and public cryptography keys are examples among many others. Some of these identifiers are dynamic and thus ambiguous. For example, IP addresses are not always permanent and may change (for example, temporary IP addresses assigned at Wi-Fi hotspots) or may be ambiguous in the case of Network Address Translation. Information about the time of assignment and the party to whom an IP address was assigned may be needed to identify an individual user. There has been considerable debate and even a recent court case regarding requirements to register users in domain name WHOIS databases in the context of the adoption of GDPR. If we are to accomplish the simultaneous objectives of protecting privacy while apprehending those engaged in harmful or criminal behavior on the Internet, we must find some balance between conflicting but desirable outcomes.<br>\nThis suggests to me that the notion of traceability under (internationally?) agreed circumstances (that is, differential traceability) might be a fruitful concept to explore. In most societies today, it is accepted that we must be identifiable to appropriate authorities under certain conditions (consider border crossings, traffic violation stops as examples). While there are conditions under which apparent anonymity is desirable and even justifiable (whistle-blowing, for example) absolute anonymity is actually quite difficult to achieve (another point made at the Ditchley workshop) and might not be absolutely desirable given the misbehaviors apparent anonymity invites. I expect this is a controversial conclusion and I look forward to subsequent discussion.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blackdot.be/2018/08/remote-access-console-using-raspberry-pi-3b-and-freebsd/\">Remote Access Console using FreeBSD on an RPi3</a></p>\n\n<ul>\n<li>Our friend, and FOSDEM Booth Neighbour, Jorge, has posted a tutorial on how he created a remote access console for his SmartOS server and other machines in his homelab</li>\n<li>Parts:</li>\n<li>Raspberry Pi 3 B+</li>\n<li>NavoLabs micro POE Hat</li>\n<li>FT4232H  based USB-to-RS232 (4x) adapter</li>\n<li>Official Raspberry Pi case (optional)</li>\n<li>Heat-sink kit (optional)</li>\n<li>USB-to-TTL adaptor (optional)</li>\n<li>Sandisk 16Gb microSD</li>\n</ul>\n\n<blockquote>\n<p>For the software I ended up using conserver. Below is a very brief tutorial on how to set everything up. I assume you have basic unix skills.</p>\n</blockquote>\n\n<ul>\n<li>Get an RPi3 image, make some minor modifications for RPi3+, and write it to the USB stick</li>\n<li>Configure FreeBSD on the RPi3\n<ul>\n<li>Load the ‘muge’ Ethernet Driver</li>\n<li>Load USB serial support</li>\n<li>Load the FTDI driver</li>\n<li>Enable SSHd and Conserver</li>\n<li>Configure Conserver</li>\n<li>Setup log rotation</li>\n<li>Start Conserver</li>\n</ul>\n\n<p></li><br>\n<li>And you’re good to go</li><br>\n</ul></p>\n\n<blockquote>\n<p>A small bonus script I wrote to turn on the 2nd LED on the rPI once the system is booted, it will then blink the LED if someone is connected to any of the consoles.</p>\n</blockquote>\n\n<ul>\n<li>There is also a followup post with some additional tips: <a href=\"https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/\">https://blackdot.be/2018/08/freebsd-uart-and-raspberry-pi-3-b/</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://twitter.com/ungleich/status/1031501391792156673\">Annual Penguin Races</a></li>\n<li><a href=\"http://www.mcternan.me.uk/mscgen/\">Mscgen - Message Sequence Chart generator</a></li>\n<li><a href=\"https://reviews.freebsd.org/D16723\">This patch makes FreeBSD boot 500 - 800ms faster, please test on your hardware</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=338059\">FreeBSD’s arc4random() replaced with OpenBSD ChaCha20 implementation</a></li>\n<li><a href=\"https://twitter.com/freebsdfndation/status/1031590348768915456\">MeetBSD Devsummit open for registrations</a></li>\n<li><a href=\"https://mwl.io/archives/3654\">New Podcast interview with Michael W. Lucas</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions<br>\nWe need more feedback emails. Please write to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></p>\n\n<p>Additionally, we are considering a new segment to be added to the end of the show (to make it skippable), where we have a ~15 minute deep dive on a topic. Some initial ideas are on the Virtual Memory subsystem, the Scheduler, Capsicum, and GEOM. What topics would you like to get very detailed explanations of? Many of the explanations may have accompanying graphics, and not be very suitable for audio only listeners, that is why we are planning to put it at the very end of the episode.</p>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"Trip reports from the Essen Hackathon and BSDCam, CfT: ZFS native encryption and UFS trim consolidation, ZFS performance benchmarks on a FreeBSD server, how to port your OS to EC2, Vint Cerf about traceability, Remote Access console to an RPi3 running FreeBSD, and more.","date_published":"2018-08-23T05:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a3504e6e-2e15-4430-8917-d6a8782b461e.mp3","mime_type":"audio/mp3","size_in_bytes":48332197,"duration_in_seconds":4814}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2433","title":"Episode 259: Long Live Unix | BSD Now 259","url":"https://www.bsdnow.tv/259","content_text":"The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.\n\nPicking the contest winner\n\n\nVincent\nBostjan\nAndrew\nKlaus-Hendrik\nWill\nToby\nJohnny\nDavid\nmanfrom\nNiclas\nGary\nEddy\nBruce\nLizz\nJim\n\n\nRandom number generator\n\n##Headlines\n###The Strange Birth and Long Life of Unix\n\n\nThey say that when one door closes on you, another opens. People generally offer this bit of wisdom just to lend some solace after a misfortune. But sometimes it’s actually true. It certainly was for Ken Thompson and the late Dennis Ritchie, two of the greats of 20th-century information technology, when they created the Unix operating system, now considered one of the most inspiring and influential pieces of software ever written.\nA door had slammed shut for Thompson and Ritchie in March of 1969, when their employer, the American Telephone &amp; Telegraph Co., withdrew from a collaborative project with the Massachusetts Institute of Technology and General Electric to create an interactive time-sharing system called Multics, which stood for “Multiplexed Information and Computing Service.” Time-sharing, a technique that lets multiple people use a single computer simultaneously, had been invented only a decade earlier. Multics was to combine time-sharing with other technological advances of the era, allowing users to phone a computer from remote terminals and then read e-mail, edit documents, run calculations, and so forth. It was to be a great leap forward from the way computers were mostly being used, with people tediously preparing and submitting batch jobs on punch cards to be run one by one.\nOver five years, AT&amp;T invested millions in the Multics project, purchasing a GE-645 mainframe computer and dedicating to the effort many of the top researchers at the company’s renowned Bell Telephone Laboratories—­including Thompson and Ritchie, Joseph F. Ossanna, Stuart Feldman, M. Douglas McIlroy, and the late Robert Morris. But the new system was too ambitious, and it fell troublingly behind schedule. In the end, AT&amp;T’s corporate leaders decided to pull the plug.\nAfter AT&amp;T’s departure from the Multics project, managers at Bell Labs, in Murray Hill, N.J., became reluctant to allow any further work on computer operating systems, leaving some researchers there very frustrated. Although Multics hadn’t met many of its objectives, it had, as Ritchie later recalled, provided them with a “convenient interactive computing service, a good environment in which to do programming, [and] a system around which a fellowship could form.” Suddenly, it was gone.\nWith heavy hearts, the researchers returned to using their old batch system. At such an inauspicious moment, with management dead set against the idea, it surely would have seemed foolhardy to continue designing computer operating systems. But that’s exactly what Thompson, Ritchie, and many of their Bell Labs colleagues did. Now, some 40 years later, we should be thankful that these programmers ignored their bosses and continued their labor of love, which gave the world Unix, one of the greatest computer operating systems of all time.\nThe rogue project began in earnest when Thompson, Ritchie, and a third Bell Labs colleague, Rudd Canaday, began to sketch out on paper the design for a file system. Thompson then wrote the basics of a new operating system for the lab’s GE-645 mainframe. But with the Multics project ended, so too was the need for the GE-645. Thompson realized that any further programming he did on it was likely to go nowhere, so he dropped the effort.\nThompson had passed some of his time after the demise of Multics writing a computer game called Space Travel, which simulated all the major bodies in the solar system along with a spaceship that could fly around them. Written for the GE-645, Space Travel was clunky to play—and expensive: roughly US $75 a game for the CPU time. Hunting around, Thompson came across a dusty PDP-7, a minicomputer built by Digital Equipment Corp. that some of his Bell Labs colleagues had purchased earlier for a circuit-analysis project. Thompson rewrote Space Travel to run on it.\nAnd with that little programming exercise, a second door cracked ajar. It was to swing wide open during the summer of 1969 when Thompson’s wife, Bonnie, spent a month visiting his parents to show off their newborn son. Thompson took advantage of his temporary bachelor existence to write a good chunk of what would become the Unix operating system for the discarded PDP‑7. The name Unix stems from a joke one of Thompson’s colleagues made: Because the new operating system supported only one user (Thompson), he saw it as an emasculated version of Multics and dubbed it “Un-multiplexed Information and Computing Service,” or Unics. The name later morphed into Unix.\nInitially, Thompson used the GE-645 to compose and compile the software, which he then downloaded to the PDP‑7. But he soon weaned himself from the mainframe, and by the end of 1969 he was able to write operating-system code on the PDP-7 itself. That was a step in the right direction. But Thompson and the others helping him knew that the PDP‑7, which was already obsolete, would not be able to sustain their skunkworks for long. They also knew that the lab’s management wasn’t about to allow any more research on operating systems.\nSo Thompson and Ritchie got crea­tive. They formulated a proposal to their bosses to buy one of DEC’s newer minicomputers, a PDP-11, but couched the request in especially palatable terms. They said they were aiming to create tools for editing and formatting text, what you might call a word-processing system today. The fact that they would also have to write an operating system for the new machine to support the editor and text formatter was almost a footnote.\nManagement took the bait, and an order for a PDP-11 was placed in May 1970. The machine itself arrived soon after, although the disk drives for it took more than six months to appear. During the interim, Thompson, Ritchie, and others continued to develop Unix on the PDP-7. After the PDP-11’s disks were installed, the researchers moved their increasingly complex operating system over to the new machine. Next they brought over the roff text formatter written by Ossanna and derived from the runoff program, which had been used in an earlier time-sharing system.\nUnix was put to its first real-world test within Bell Labs when three typists from AT&amp;T’s patents department began using it to write, edit, and format patent applications. It was a hit. The patent department adopted the system wholeheartedly, which gave the researchers enough credibility to convince management to purchase another machine—a newer and more powerful PDP-11 model—allowing their stealth work on Unix to continue.\nDuring its earliest days, Unix evolved constantly, so the idea of issuing named versions or releases seemed inappropriate. But the researchers did issue new editions of the programmer’s manual periodically, and the early Unix systems were named after each such edition. The first edition of the manual was completed in November 1971.\nSo what did the first edition of Unix offer that made it so great? For one thing, the system provided a hierarchical file system, which allowed something we all now take for granted: Files could be placed in directories—or equivalently, folders—that in turn could be put within other directories. Each file could contain no more than 64 kilobytes, and its name could be no more than six characters long. These restrictions seem awkwardly limiting now, but at the time they appeared perfectly adequate.\nAlthough Unix was ostensibly created for word processing, the only editor available in 1971 was the line-oriented ed. Today, ed is still the only editor guaranteed to be present on all Unix systems. Apart from the text-processing and general system applications, the first edition of Unix included games such as blackjack, chess, and tic-tac-toe. For the system administrator, there were tools to dump and restore disk images to magnetic tape, to read and write paper tapes, and to create, check, mount, and unmount removable disk packs.\nMost important, the system offered an interactive environment that by this time allowed time-sharing, so several people could use a single machine at once. Various programming languages were available to them, including BASIC, Fortran, the scripting of Unix commands, assembly language, and B. The last of these, a descendant of a BCPL (Basic Combined Programming Language), ultimately evolved into the immensely popular C language, which Ritchie created while also working on Unix.\nThe first edition of Unix let programmers call 34 different low-level routines built into the operating system. It’s a testament to the system’s enduring nature that nearly all of these system calls are still available—and still heavily used—on modern Unix and Linux systems four decades on. For its time, first-­edition Unix provided a remarkably powerful environment for software development. Yet it contained just 4200 lines of code at its heart and occupied a measly 16 KB of main memory when it ran.\nUnix’s great influence can be traced in part to its elegant design, simplicity, portability, and serendipitous timing. But perhaps even more important was the devoted user community that soon grew up around it. And that came about only by an accident of its unique history.\nThe story goes like this: For years Unix remained nothing more than a Bell Labs research project, but by 1973 its authors felt the system was mature enough for them to present a paper on its design and implementation at a symposium of the Association for Computing Machinery. That paper was published in 1974 in the Communications of the ACM. Its appearance brought a flurry of requests for copies of the software.\nThis put AT&amp;T in a bind. In 1956, AT&amp;T had agreed to a U.S government consent decree that prevented the company from selling products not directly related to telephones and telecommunications, in return for its legal monopoly status in running the country’s long-distance phone service. So Unix could not be sold as a product. Instead, AT&amp;T released the Unix source code under license to anyone who asked, charging only a nominal fee. The critical wrinkle here was that the consent decree prevented AT&amp;T from supporting Unix. Indeed, for many years Bell Labs researchers proudly displayed their Unix policy at conferences with a slide that read, “No advertising, no support, no bug fixes, payment in advance.”\nWith no other channels of support available to them, early Unix adopters banded together for mutual assistance, forming a loose network of user groups all over the world. They had the source code, which helped. And they didn’t view Unix as a standard software product, because nobody seemed to be looking after it. So these early Unix users themselves set about fixing bugs, writing new tools, and generally improving the system as they saw fit.\nThe Usenix user group acted as a clearinghouse for the exchange of Unix software in the United States. People could send in magnetic tapes with new software or fixes to the system and get back tapes with the software and fixes that Usenix had received from others. In Australia, the University of New South Wales and the University of Sydney produced a more robust version of Unix, the Australian Unix Share Accounting Method, which could cope with larger numbers of concurrent users and offered better performance.\nBy the mid-1970s, the environment of sharing that had sprung up around Unix resembled the open-source movement so prevalent today. Users far and wide were enthusiastically enhancing the system, and many of their improvements were being fed back to Bell Labs for incorporation in future releases. But as Unix became more popular, AT&amp;T’s lawyers began looking harder at what various licensees were doing with their systems.\nOne person who caught their eye was John Lions, a computer scientist then teaching at the University of New South Wales, in Australia. In 1977, he published what was probably the most famous computing book of the time, A Commentary on the Unix Operating System, which contained an annotated listing of the central source code for Unix.\nUnix’s licensing conditions allowed for the exchange of source code, and initially, Lions’s book was sold to licensees. But by 1979, AT&amp;T’s lawyers had clamped down on the book’s distribution and use in academic classes. The anti­authoritarian Unix community reacted as you might expect, and samizdat copies of the book spread like wildfire. Many of us have nearly unreadable nth-­generation photocopies of the original book.\nEnd runs around AT&amp;T’s lawyers indeed became the norm—even at Bell Labs. For example, between the release of the sixth edition of Unix in 1975 and the seventh edition in 1979, Thompson collected dozens of important bug fixes to the system, coming both from within and outside of Bell Labs. He wanted these to filter out to the existing Unix user base, but the company’s lawyers felt that this would constitute a form of support and balked at their release. Nevertheless, those bug fixes soon became widely distributed through unofficial channels. For instance, Lou Katz, the founding president of Usenix, received a phone call one day telling him that if he went down to a certain spot on Mountain Avenue (where Bell Labs was located) at 2 p.m., he would find something of interest. Sure enough, Katz found a magnetic tape with the bug fixes, which were rapidly in the hands of countless users.\nBy the end of the 1970s, Unix, which had started a decade earlier as a reaction against the loss of a comfortable programming environment, was growing like a weed throughout academia and the IT industry. Unix would flower in the early 1980s before reaching the height of its popularity in the early 1990s.\nFor many reasons, Unix has since given way to other commercial and noncommercial systems. But its legacy, that of an elegant, well-designed, comfortable environment for software development, lives on. In recognition of their accomplishment, Thompson and Ritchie were given the Japan Prize earlier this year, adding to a collection of honors that includes the United States’ National Medal of Technology and Innovation and the Association of Computing Machinery’s Turing Award. Many other, often very personal, tributes to Ritchie and his enormous influence on computing were widely shared after his death this past October.\nUnix is indeed one of the most influential operating systems ever invented. Its direct descendants now number in the hundreds. On one side of the family tree are various versions of Unix proper, which began to be commercialized in the 1980s after the Bell System monopoly was broken up, freeing AT&amp;T from the stipulations of the 1956 consent decree. On the other side are various Unix-like operating systems derived from the version of Unix developed at the University of California, Berkeley, including the one Apple uses today on its computers, OS X. I say “Unix-like” because the developers of the Berkeley Software Distribution (BSD) Unix on which these systems were based worked hard to remove all the original AT&amp;T code so that their software and its descendants would be freely distributable.\nThe effectiveness of those efforts were, however, called into question when the AT&amp;T subsidiary Unix System Laboratories filed suit against Berkeley Software Design and the Regents of the University of California in 1992 over intellectual property rights to this software. The university in turn filed a counterclaim against AT&amp;T for breaches to the license it provided AT&amp;T for the use of code developed at Berkeley. The ensuing legal quagmire slowed the development of free Unix-like clones, including 386BSD, which was designed for the Intel 386 chip, the CPU then found in many IBM PCs.\nHad this operating system been available at the time, Linus Torvalds says he probably wouldn’t have created Linux, an open-source Unix-like operating system he developed from scratch for PCs in the early 1990s. Linux has carried the Unix baton forward into the 21st century, powering a wide range of digital gadgets including wireless routers, televisions, desktop PCs, and Android smartphones. It even runs some supercomputers.\nAlthough AT&amp;T quickly settled its legal disputes with Berkeley Software Design and the University of California, legal wrangling over intellectual property claims to various parts of Unix and Linux have continued over the years, often involving byzantine corporate relations. By 2004, no fewer than five major lawsuits had been filed. Just this past August, a software company called the TSG Group (formerly known as the SCO Group), lost a bid in court to claim ownership of Unix copyrights that Novell had acquired when it purchased the Unix System Laboratories from AT&amp;T in 1993.\nAs a programmer and Unix historian, I can’t help but find all this legal sparring a bit sad. From the very start, the authors and users of Unix worked as best they could to build and share, even if that meant defying authority. That outpouring of selflessness stands in sharp contrast to the greed that has driven subsequent legal battles over the ownership of Unix.\nThe world of computer hardware and software moves forward startlingly fast. For IT professionals, the rapid pace of change is typically a wonderful thing. But it makes us susceptible to the loss of our own history, including important lessons from the past. To address this issue in a small way, in 1995 I started a mailing list of old-time Unix ­aficionados. That effort morphed into the Unix Heritage Society. Our goal is not only to save the history of Unix but also to collect and curate these old systems and, where possible, bring them back to life. With help from many talented members of this society, I was able to restore much of the old Unix software to working order, including Ritchie’s first C compiler from 1972 and the first Unix system to be written in C, dating from 1973.\nOne holy grail that eluded us for a long time was the first edition of Unix in any form, electronic or otherwise. Then, in 2006, Al Kossow from the Computer History Museum, in Mountain View, Calif., unearthed a printed study of Unix dated 1972, which not only covered the internal workings of Unix but also included a complete assembly listing of the kernel, the main component of this operating system. This was an amazing find—like discovering an old Ford Model T collecting dust in a corner of a barn. But we didn’t just want to admire the chrome work from afar. We wanted to see the thing run again.\nIn 2008, Tim Newsham, an independent programmer in Hawaii, and I assembled a team of like-minded Unix enthusiasts and set out to bring this ancient system back from the dead. The work was technically arduous and often frustrating, but in the end, we had a copy of the first edition of Unix running on an emulated PDP-11/20. We sent out messages announcing our success to all those we thought would be interested. Thompson, always succinct, simply replied, “Amazing.” Indeed, his brainchild was amazing, and I’ve been happy to do what I can to make it, and the story behind it, better known.\n\n\n\n\nDigital Ocean\nhttp://do.co/bsdnow\n\n###FreeBSD jails with a single public IP address\n\n\nJails in FreeBSD provide a simple yet flexible way to set up a proper server layout. In the most setups the actual server only acts as the host system for the jails while the applications themselves run within those independent containers. Traditionally every jail has it’s own IP for the user to be able to address the individual services. But if you’re still using IPv4 this might get you in trouble as the most hosters don’t offer more than one single public IP address per server.\n\n\n\nCreate the internal network\n\n\n\nIn this case NAT (“Network Address Translation”) is a good way to expose services in different jails using the same IP address.\nFirst, let’s create an internal network (“NAT network”) at 192.168.0.0/24. You could generally use any private IPv4 address space as specified in RFC 1918. Here’s an overview: https://en.wikipedia.org/wiki/Private_network. Using pf, FreeBSD’s firewall, we will map requests on different ports of the same public IP address to our individual jails as well as provide network access to the jails themselves.\nFirst let’s check which network devices are available. In my case there’s em0 which provides connectivity to the internet and lo0, the local loopback device.\n\n\n  options=209b&lt;RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC&gt;\n  [...]\n  inet 172.31.1.100 netmask 0xffffff00 broadcast 172.31.1.255\n  nd6 options=23&lt;PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL&gt;\n  media: Ethernet autoselect (1000baseT &lt;full-duplex&gt;)\n  status: active\n\nlo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384\n  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;\n  inet6 ::1 prefixlen 128\n  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2\n  inet 127.0.0.1 netmask 0xff000000\n  nd6 options=21&lt;PERFORMNUD,AUTO_LINKLOCAL&gt;```\n\n&gt; For our internal network, we create a cloned loopback device called lo1. Therefore we need to customize the /etc/rc.conf file, adding the following two lines:\n\n```cloned_interfaces=\"lo1\"\nipv4_addrs_lo1=\"192.168.0.1-9/29\"```\n\n&gt; This defines a /29 network, offering IP addresses for a maximum of 6 jails:\n\n```ipcalc 192.168.0.1/29\nAddress:   192.168.0.1          11000000.10101000.00000000.00000 001\nNetmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000\nWildcard:  0.0.0.7              00000000.00000000.00000000.00000 111\n=&gt;\nNetwork:   192.168.0.0/29       11000000.10101000.00000000.00000 000\nHostMin:   192.168.0.1          11000000.10101000.00000000.00000 001\nHostMax:   192.168.0.6          11000000.10101000.00000000.00000 110\nBroadcast: 192.168.0.7          11000000.10101000.00000000.00000 111\nHosts/Net: 6                     Class C, Private Internet```\n\n&gt; Then we need to restart the network. Please be aware of currently active SSH sessions as they might be dropped during restart. It’s a good moment to ensure you have KVM access to that server ;-)\n\n```service netif restart```\n\n&gt; After reconnecting, our newly created loopback device is active:\n\n```lo1: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384\n  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;\n  inet 192.168.0.1 netmask 0xfffffff8\n  inet 192.168.0.2 netmask 0xffffffff\n  inet 192.168.0.3 netmask 0xffffffff\n  inet 192.168.0.4 netmask 0xffffffff\n  inet 192.168.0.5 netmask 0xffffffff\n  inet 192.168.0.6 netmask 0xffffffff\n  inet 192.168.0.7 netmask 0xffffffff\n  inet 192.168.0.8 netmask 0xffffffff\n  inet 192.168.0.9 netmask 0xffffffff\n  nd6 options=29&lt;PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL&gt;```\n\n+ Setting up\n\n&gt; pf part of the FreeBSD base system, so we only have to configure and enable it. By this moment you should already have a clue of which services you want to expose. If this is not the case, just fix that file later on. In my example configuration, I have a jail running a webserver and another jail running a mailserver:\n\n +  Public IP address\n```IP_PUB=\"1.2.3.4\"```\n\n +  Packet normalization\n```scrub in all```\n\n +  Allow outbound connections from within the jails\n```nat on em0 from lo1:network to any -&gt; (em0)```\n\n +  webserver jail at 192.168.0.2\n```rdr on em0 proto tcp from any to $IP_PUB port 443 -&gt; 192.168.0.2```\n\n + just an example in case you want to redirect to another port within your jail\n```rdr on em0 proto tcp from any to $IP_PUB port 80 -&gt; 192.168.0.2 port 8080```\n\n + mailserver jail at 192.168.0.3\n```rdr on em0 proto tcp from any to $IP_PUB port 25 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 587 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 143 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 993 -&gt; 192.168.0.3```\n\n&gt; Now just enable pf like this (which is the equivalent of adding pf_enable=YES to /etc/rc.conf):\n\n```sysrc pf_enable=\"YES\"```\n\n&gt; and start it:\n\n```service pf start```\n\n+ Install ezjail\n\n&gt; Ezjail is a collection of scripts by erdgeist that allow you to easily manage your jails.\n\n```pkg install ezjail```\n\n&gt; As an alternative, you could install ezjail from the ports tree. Now we need to set up the basejail which contains the shared base system for our jails. In fact, every jail that you create get’s will use that basejail to symlink directories related to the base system like /bin and /sbin. This can be accomplished by running\n\n```ezjail-admin install```\n\n&gt; In the next step, we’ll copy the /etc/resolv.conf file from our host to the newjail, which is the template for newly created jails (the parts that are not provided by basejail), to ensure that domain resolution will work properly within our jails later on:\n\n```cp /etc/resolv.conf /usr/jails/newjail/etc/```\n\n&gt; Last but not least, we enable ezjail and start it:\n\n```sysrc ezjail_enable=\"YES\"```\n```service ezjail start```\n\n+ Create a jail\n\n&gt; Creating a jail is as easy as it could probably be:\n\n```ezjail-admin create webserver 192.168.0.2```\n```ezjail-admin start webserver```\n\n&gt; Now you can access your jail using:\n\n```ezjail-admin console webserver```\n\n&gt; Each jail contains a vanilla FreeBSD installation.\n\n+ Deploy services\n\n&gt; Now you can spin up as many jails as you want to set up your services like web, mail or file shares. You should take care not to enable sshd within your jails, because that would cause problems with the service’s IP bindings. But this is not a problem, just SSH to the host and enter your jail using ezjail-admin console.\n***\n\n###[EuroBSDcon 2018 Talks &amp; Schedule](https://2018.eurobsdcon.org/talks-schedule/)\n***\n\n\n\n\n##News Roundup\n###[OpenBSD on an iBook G4](https://bobstechsite.com/openbsd-on-an-ibook-g4/)\n&gt; I've mentioned on social media and on the BTS podcast a few times that I wanted to try installing OpenBSD onto an old \"snow white\" iBook G4 I acquired last summer to see if I could make it a useful machine again in the year 2018.  This particular eBay purchase came with a 14\" 1024x768 TFT screen, 1.07GHz PowerPC G4 processor, 1.5GB RAM, 100GB of HDD space and an ATI Radeon 9200 graphics card with 32 MB of SDRAM. The optical drive, ethernet port, battery &amp; USB slots are also fully-functional. The only thing that doesn't work is the CMOS battery, but that's not unexpected for a device that was originally released in 2004.\n\n+ Initial experiments\n\n&gt; This iBook originally arrived at my door running Apple Mac OSX Leopard and came with the original install disk, the iLife &amp; iWork suites for 2008, various instruction manuals, a working power cable and a spare keyboard. As you'll see in the pictures I took for this post the characters on the buttons have started to wear away from 14 years of intensive use, but the replacement needs a very good clean before I decide to swap it in!\n\n&gt; After spending some time exploring the last version of OSX to support the IBM PowerPC processor architecture I tried to see if the hardware was capable of modern computing with Linux. Something I knew ahead of trying this was that the WiFi adapter was unlikely to work because it's a highly proprietary component designed by Apple to work specifically with OSX and nothing else, but I figured I could probably use a wireless USB dongle later to get around this limitation.\n\n&gt; Unfortunately I found that no recent versions of mainstream Linux distributions would boot off this machine. Debian has dropped support 32-bit PowerPC architectures and the PowerPC variants of Ubuntu 16.04 LTS (vanilla, MATE and Lubuntu) wouldn't even boot the installer! The only distribution I could reliably install on the hardware was Lubuntu 14.04 LTS.\n\n&gt; Unfortunately I'm not the biggest fan of the LXDE desktop for regular work and a lot of ported applications were old and broken because it clearly wasn't being maintained by people that use the hardware anymore. Ubuntu 14.04 is also approaching the end of its support life in early 2019, so this limited solution also has a limited shelf-life.\n\n+ Over to BSD\n\n&gt; I discussed this problem with a few people on Mastodon and it was pointed out to me that OSX is built on the Darwin kernel, which happens to be a variant of BSD. NetBSD and OpenBSD fans in particular convinced me that their communities still saw the value of supporting these old pieces of kit and that I should give BSD a try.\n\n&gt; So yesterday evening I finally downloaded the \"macppc\" version of OpenBSD 6.3 with no idea what to expect. I hoped for the best but feared the worst because my last experience with this operating system was trying out PC-BSD in 2008 and discovering with disappointment that it didn't support any of the hardware on my Toshiba laptop.\n\n&gt; When I initially booted OpenBSD I was a little surprised to find the login screen provided no visual feedback when I typed in my password, but I can understand the security reasons for doing that. The initial desktop environment that was loaded was very basic. All I could see was a console output window, a terminal and a desktop switcher in the X11 environment the system had loaded.\n\n&gt; After a little Googling I found this blog post had some fantastic instructions to follow for the post-installation steps: https://sohcahtoa.org.uk/openbsd.html. I did have to adjust them slightly though because my iBook only has 1.5GB RAM and not every package that page suggests is available on macppc by default. You can see a full list here: https://ftp.openbsd.org/pub/OpenBSD/6.3/packages/powerpc/.\n\n+ Final thoughts\n\n&gt; I was really impressed with the performance of OpenBSD's \"macppc\" port. It boots much faster than OSX Leopard on the same hardware and unlike Lubuntu 14.04 it doesn't randomly hang for no reason or crash if you launch something demanding like the GIMP.\n\n&gt; I was pleased to see that the command line tools I'm used to using on Linux have been ported across too. OpenBSD also had no issues with me performing basic desktop tasks on XFCE like browsing the web with NetSurf, playing audio files with VLC and editing images with the GIMP. Limited gaming is also theoretically possible if you're willing to build them (or an emulator) from source with SDL support.\n\n&gt; If I wanted to use this system for heavy duty work then I'd probably be inclined to run key applications like LibreOffice on a Raspberry Pi and then connect my iBook G4 to those using VNC or an SSH connection with X11 forwarding. BSD is UNIX after all, so using my ancient laptop as a dumb terminal should work reasonably well.\n\n&gt; In summary I was impressed with OpenBSD and its ability to breathe new life into this old Apple Mac. I'm genuinely excited about the idea of trying BSD with other devices on my network such as an old Asus Eee PC 900 netbook and at least one of the many Raspberry Pi devices I use. Whether I go the whole hog and replace Fedora on my main production laptop though remains to be seen!\n\n***\n\n###[The template user with PAM and login(1)](http://oshogbo.vexillium.org/blog/48)\n&gt; When you build a new service (or an appliance) you need your users to be able to configure it from the command line. To accomplish this you can create system accounts for all registered users in your service and assign them a special login shell which provides such limited functionality. This can be painful if you have a dynamic user database.\n&gt; Another challenge is authentication via remote services such as RADIUS. How can we implement  services when we authenticate through it and log into it as a different user? Furthermore, imagine a scenario when RADIUS decides on which account we have the right to access by sending an additional attribute.\n&gt; To address these two problems we can use a \"template\" user. Any of the PAM modules can set the value of the PAM_USER item. The value of this item will be used to determine which account we want to login. Only the \"template\" user must exist on the local password database, but the credential check can be omitted by the module.\n&gt; This functionality exists in the login(1) used by FreeBSD, HardenedBSD, DragonFlyBSD and illumos. The functionality doesn't exist in the login(1) used in NetBSD, and OpenBSD doesn't support PAM modules at all. In addition what  is also noteworthy is that such functionality was also in the OpenSSH but they decided to remove it and call it a security vulnerability (CVE 2015-6563). I can see how some people may have seen it that way, that’s why I recommend reading this article from an OpenPAM author and a FreeBSD security officer at the time.\n&gt; Knowing the background let's take a look at an example.\n\n```PAM_EXTERN int\npam_sm_authenticate(pam_handle_t *pamh, int flags __unused,\n    int argc __unused, const char *argv[] __unused)\n{\n        const char *user, *password;\n        int err;\n\n        err = pam_get_user(pamh, &amp;user, NULL);\n        if (err != PAM_SUCCESS)\n                return (err);\n\n        err = pam_get_authtok(pamh, PAM_AUTHTOK, &amp;password, NULL);\n        if (err == PAM_CONV_ERR)\n                return (err);\n        if (err != PAM_SUCCESS)\n                return (PAM_AUTH_ERR);\n\n        err = authenticate(user, password);\n        if (err != PAM_SUCCESS) {\n                return (err);\n        }\n\n        return (pam_set_item(pamh, PAM_USER, \"template\"));\n}\n\n\n\nIn the listing above we have an example of a PAM module. The pam_get_user(3) provides a username. The pam_get_authtok(3) shows us a secret given by the user. Both functions allow us to give an optional prompt which should be shown to the user. The authenticate function is our crafted function which authenticates the user. In our first scenario we wanted to keep all users in an external database. If authentication is successful we then switch to a template user which has  a shell set up for a script allowing us to configure the machine. In our second scenario the authenticate function authenticates the user in RADIUS.\n\n\n\nAnother step is to add our PAM module to the /etc/pam.d/system or to the /etc/pam.d/login configuration:\n\n\nauth sufficient pam_template.so no_warn allow_local\n\n\nUnfortunately the description of all these options goes beyond this article - if you would like to know more about it you can find them in the PAM manual. The last thing we need to do is to add our template user to the system which  you can do by the adduser(8) command or just simply modifying the /etc/master.passwd file and use pwd_mkdb(8) program:\n\n\n$ tail -n /etc/master.passwd\ntemplate:*:1000:1000::0:0:User &amp;:/:/usr/local/bin/templatesh\n$ sudo pwd_mkdb /etc/master.passwd\n\n\nAs you can see,the template user can be locked and we still can use it in our PAM module (the * character after login).\nI would like to thank Dag-Erling Smørgrav for pointing this functionality out to me when I was looking for it some time ago.\n\n\n\n\niXsystems\niXsystems @ VMWorld\n\n###ZFS file server\n\n\nWhat is the need?\n\n\n\nAt work, we run a compute cluster that uses an Isilon cluster as primary NAS storage. Excluding snapshots, we have about 200TB of research data, some of them in compressed formats, and others not. We needed an offsite backup file server that would constantly mirror our primary NAS and serve as a quick recovery source in case of a data loss in the the primary NAS. This offsite file server would be passive - will never face the wrath of the primary cluster workload.\nIn addition to the role of a passive backup server, this solution would take on some passive report generation workloads as an ideal way of offloading some work from the primary NAS. The passive work is read-only.\nThe backup server would keep snapshots in a best effort basis dating back to 10 years. However, this data on this backup server would be archived to tapes periodically.\n\n\n\n\nA simple guidance of priorities:\n\n\nData integrity &gt; Cost of solution &gt; Storage capacity &gt; Performance.\n\n\nWhy not enterprise NAS? NetApp FAS or EMC Isilon or the like?\n\n\n\n\nWe decided that enterprise grade NAS like NetAPP FAS or EMC Isilon are prohibitively expensive and an overkill for our needs.\nAn open source &amp; cheaper alternative to enterprise grade filesystem with the level of durability we expect turned up to be ZFS. We’re already spoilt from using snapshots by a clever Copy-on-Write Filesystem(WAFL) by NetApp. ZFS providing snapshots in almost identical way was a big influence in the choice. This is also why we did not consider just a CentOS box with the default XFS filesystem.\n\n\n\nFreeBSD vs Debian for ZFS\n\n\n\nThis is a backup server, a long-term solution. Stability and reliability are key requirements. ZFS on Linux may be popular at this time, but there is a lot of churn around its development, which means there is a higher probability of bugs like this to occur. We’re not looking for cutting edge features here. Perhaps, Linux would be considered in the future.\n\n\n\nFreeBSD + ZFS\n\n\n\nWe already utilize FreeBSD and OpenBSD for infrastructure services and we have nothing but praises for the stability that the BSDs have provided us. We’d gladly use FreeBSD and OpenBSD wherever possible.\n\n\n\nOkay, ZFS, but why not FreeNAS?\n\n\n\nIMHO, FreeNAS provides a integrated GUI management tool over FreeBSD for a novice user to setup and configure FreeBSD, ZFS, Jails and many other features. But, this user facing abstraction adds an extra layer of complexity to maintain that is just not worth it in simpler use cases like ours. For someone that appreciates the commandline interface, and understands FreeBSD enough to administer it, plain FreeBSD + ZFS is simpler and more robust than FreeNAS.\n\n\n\nSpecifications\nLenovo SR630 Rackserver\n2 X Intel Xeon silver 4110 CPUs\n768 GB of DDR4 ECC 2666 MHz RAM\n4 port SAS card configured in passthrough mode(JBOD)\nIntel network card with 10 Gb SFP+ ports\n128GB M.2 SSD for use as boot drive\n2 X HGST 4U60 JBOD\n120(2 X 60) X 10TB SAS disks\n\n\n\n\n###Reflection on one-year usage of OpenBSD\n\n\nI have used OpenBSD for more than one year, and it is time to give a summary of the experience:\n\n\n\n(1) What do I get from OpenBSD?\n\n\n\na) A good UNIX tutorial. When I am curious about some UNIXcommands’ implementation, I will refer to OpenBSD source code, and I actually gain something every time. E.g., refresh socket programming skills from nc; know how to process file efficiently from cat.\n\n\n\nb) A better test bed. Although my work focus on developing programs on Linux, I will try to compile and run applications on OpenBSD if it is possible. One reason is OpenBSD usually gives more helpful warnings. E.g., hint like this:\n\n\n......\nwarning: sprintf() is often misused, please use snprintf()\n......\n\n\nOr you can refer this post which I wrote before. The other is sometimes program run well on Linux may crash on OpenBSD, and OpenBSD can help you find hidden bugs.\n\n\n\nc) Some handy tools. E.g. I find tcpbench is useful, so I ported it into Linux for my own usage (project is here).\n\n\n\n(2) What I give back to OpenBSD?\n\n\n\na) Patches. Although most of them are trivial modifications, they are still my contributions.\n\n\n\nb) Write blog posts to share experience about using OpenBSD.\n\n\n\nc) Develop programs for OpenBSD/*BSD: lscpu and free.\n\n\n\nd) Porting programs into OpenBSD: E.g., I find google/benchmark is a nifty tool, but lacks OpenBSD support, I submitted PR and it is accepted. So you can use google/benchmark on OpenBSD now.\n\n\n\nGenerally speaking, the time invested on OpenBSD is rewarding. If you are still hesitating, why not give a shot?\n\n\n\n\n##Beastie Bits\n\n\nBSD Users Stockholm Meetup\nBSDCan 2018 Playlist\nOPNsense 18.7 released\nTesting TrueOS (FreeBSD derivative) on real hardware ThinkPad T410\nKernel Hacker Wanted!\nReplace a pair of 8-bit writes to VGA memory with a single 16-bit write\nReduce taskq and context-switch cost of zio pipe\nProposed FreeBSD Memory Management change, expected to improve ZFS ARC interactions\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nAnian_Z - Question\nRobert - Pool question\nLain - Congratulations\nThomas - L2arc\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.</p>\n\n<h3><a id=\"Picking_the_contest_winner_0\"></a>Picking the contest winner</h3>\n\n<ol>\n<li>Vincent</li>\n<li>Bostjan</li>\n<li>Andrew</li>\n<li>Klaus-Hendrik</li>\n<li>Will</li>\n<li>Toby</li>\n<li>Johnny</li>\n<li>David</li>\n<li>manfrom</li>\n<li>Niclas</li>\n<li>Gary</li>\n<li>Eddy</li>\n<li>Bruce</li>\n<li>Lizz</li>\n<li>Jim</li>\n</ol>\n\n<p><a href=\"https://www.random.org/integers/?num=1&amp;min=0&amp;max=15&amp;col=1&amp;base=10&amp;format=html&amp;rnd=new\">Random number generator</a></p>\n\n<p>##Headlines<br>\n###<a href=\"https://spectrum.ieee.org/tech-history/cyberspace/the-strange-birth-and-long-life-of-unix\">The Strange Birth and Long Life of Unix</a></p>\n\n<blockquote>\n<p>They say that when one door closes on you, another opens. People generally offer this bit of wisdom just to lend some solace after a misfortune. But sometimes it’s actually true. It certainly was for Ken Thompson and the late Dennis Ritchie, two of the greats of 20th-century information technology, when they created the Unix operating system, now considered one of the most inspiring and influential pieces of software ever written.<br>\nA door had slammed shut for Thompson and Ritchie in March of 1969, when their employer, the American Telephone &amp; Telegraph Co., withdrew from a collaborative project with the Massachusetts Institute of Technology and General Electric to create an interactive time-sharing system called Multics, which stood for “Multiplexed Information and Computing Service.” Time-sharing, a technique that lets multiple people use a single computer simultaneously, had been invented only a decade earlier. Multics was to combine time-sharing with other technological advances of the era, allowing users to phone a computer from remote terminals and then read e-mail, edit documents, run calculations, and so forth. It was to be a great leap forward from the way computers were mostly being used, with people tediously preparing and submitting batch jobs on punch cards to be run one by one.<br>\nOver five years, AT&amp;T invested millions in the Multics project, purchasing a GE-645 mainframe computer and dedicating to the effort many of the top researchers at the company’s renowned Bell Telephone Laboratories—­including Thompson and Ritchie, Joseph F. Ossanna, Stuart Feldman, M. Douglas McIlroy, and the late Robert Morris. But the new system was too ambitious, and it fell troublingly behind schedule. In the end, AT&amp;T’s corporate leaders decided to pull the plug.<br>\nAfter AT&amp;T’s departure from the Multics project, managers at Bell Labs, in Murray Hill, N.J., became reluctant to allow any further work on computer operating systems, leaving some researchers there very frustrated. Although Multics hadn’t met many of its objectives, it had, as Ritchie later recalled, provided them with a “convenient interactive computing service, a good environment in which to do programming, [and] a system around which a fellowship could form.” Suddenly, it was gone.<br>\nWith heavy hearts, the researchers returned to using their old batch system. At such an inauspicious moment, with management dead set against the idea, it surely would have seemed foolhardy to continue designing computer operating systems. But that’s exactly what Thompson, Ritchie, and many of their Bell Labs colleagues did. Now, some 40 years later, we should be thankful that these programmers ignored their bosses and continued their labor of love, which gave the world Unix, one of the greatest computer operating systems of all time.<br>\nThe rogue project began in earnest when Thompson, Ritchie, and a third Bell Labs colleague, Rudd Canaday, began to sketch out on paper the design for a file system. Thompson then wrote the basics of a new operating system for the lab’s GE-645 mainframe. But with the Multics project ended, so too was the need for the GE-645. Thompson realized that any further programming he did on it was likely to go nowhere, so he dropped the effort.<br>\nThompson had passed some of his time after the demise of Multics writing a computer game called Space Travel, which simulated all the major bodies in the solar system along with a spaceship that could fly around them. Written for the GE-645, Space Travel was clunky to play—and expensive: roughly US $75 a game for the CPU time. Hunting around, Thompson came across a dusty PDP-7, a minicomputer built by Digital Equipment Corp. that some of his Bell Labs colleagues had purchased earlier for a circuit-analysis project. Thompson rewrote Space Travel to run on it.<br>\nAnd with that little programming exercise, a second door cracked ajar. It was to swing wide open during the summer of 1969 when Thompson’s wife, Bonnie, spent a month visiting his parents to show off their newborn son. Thompson took advantage of his temporary bachelor existence to write a good chunk of what would become the Unix operating system for the discarded PDP‑7. The name Unix stems from a joke one of Thompson’s colleagues made: Because the new operating system supported only one user (Thompson), he saw it as an emasculated version of Multics and dubbed it “Un-multiplexed Information and Computing Service,” or Unics. The name later morphed into Unix.<br>\nInitially, Thompson used the GE-645 to compose and compile the software, which he then downloaded to the PDP‑7. But he soon weaned himself from the mainframe, and by the end of 1969 he was able to write operating-system code on the PDP-7 itself. That was a step in the right direction. But Thompson and the others helping him knew that the PDP‑7, which was already obsolete, would not be able to sustain their skunkworks for long. They also knew that the lab’s management wasn’t about to allow any more research on operating systems.<br>\nSo Thompson and Ritchie got crea­tive. They formulated a proposal to their bosses to buy one of DEC’s newer minicomputers, a PDP-11, but couched the request in especially palatable terms. They said they were aiming to create tools for editing and formatting text, what you might call a word-processing system today. The fact that they would also have to write an operating system for the new machine to support the editor and text formatter was almost a footnote.<br>\nManagement took the bait, and an order for a PDP-11 was placed in May 1970. The machine itself arrived soon after, although the disk drives for it took more than six months to appear. During the interim, Thompson, Ritchie, and others continued to develop Unix on the PDP-7. After the PDP-11’s disks were installed, the researchers moved their increasingly complex operating system over to the new machine. Next they brought over the roff text formatter written by Ossanna and derived from the runoff program, which had been used in an earlier time-sharing system.<br>\nUnix was put to its first real-world test within Bell Labs when three typists from AT&amp;T’s patents department began using it to write, edit, and format patent applications. It was a hit. The patent department adopted the system wholeheartedly, which gave the researchers enough credibility to convince management to purchase another machine—a newer and more powerful PDP-11 model—allowing their stealth work on Unix to continue.<br>\nDuring its earliest days, Unix evolved constantly, so the idea of issuing named versions or releases seemed inappropriate. But the researchers did issue new editions of the programmer’s manual periodically, and the early Unix systems were named after each such edition. The first edition of the manual was completed in November 1971.<br>\nSo what did the first edition of Unix offer that made it so great? For one thing, the system provided a hierarchical file system, which allowed something we all now take for granted: Files could be placed in directories—or equivalently, folders—that in turn could be put within other directories. Each file could contain no more than 64 kilobytes, and its name could be no more than six characters long. These restrictions seem awkwardly limiting now, but at the time they appeared perfectly adequate.<br>\nAlthough Unix was ostensibly created for word processing, the only editor available in 1971 was the line-oriented ed. Today, ed is still the only editor guaranteed to be present on all Unix systems. Apart from the text-processing and general system applications, the first edition of Unix included games such as blackjack, chess, and tic-tac-toe. For the system administrator, there were tools to dump and restore disk images to magnetic tape, to read and write paper tapes, and to create, check, mount, and unmount removable disk packs.<br>\nMost important, the system offered an interactive environment that by this time allowed time-sharing, so several people could use a single machine at once. Various programming languages were available to them, including BASIC, Fortran, the scripting of Unix commands, assembly language, and B. The last of these, a descendant of a BCPL (Basic Combined Programming Language), ultimately evolved into the immensely popular C language, which Ritchie created while also working on Unix.<br>\nThe first edition of Unix let programmers call 34 different low-level routines built into the operating system. It’s a testament to the system’s enduring nature that nearly all of these system calls are still available—and still heavily used—on modern Unix and Linux systems four decades on. For its time, first-­edition Unix provided a remarkably powerful environment for software development. Yet it contained just 4200 lines of code at its heart and occupied a measly 16 KB of main memory when it ran.<br>\nUnix’s great influence can be traced in part to its elegant design, simplicity, portability, and serendipitous timing. But perhaps even more important was the devoted user community that soon grew up around it. And that came about only by an accident of its unique history.<br>\nThe story goes like this: For years Unix remained nothing more than a Bell Labs research project, but by 1973 its authors felt the system was mature enough for them to present a paper on its design and implementation at a symposium of the Association for Computing Machinery. That paper was published in 1974 in the Communications of the ACM. Its appearance brought a flurry of requests for copies of the software.<br>\nThis put AT&amp;T in a bind. In 1956, AT&amp;T had agreed to a U.S government consent decree that prevented the company from selling products not directly related to telephones and telecommunications, in return for its legal monopoly status in running the country’s long-distance phone service. So Unix could not be sold as a product. Instead, AT&amp;T released the Unix source code under license to anyone who asked, charging only a nominal fee. The critical wrinkle here was that the consent decree prevented AT&amp;T from supporting Unix. Indeed, for many years Bell Labs researchers proudly displayed their Unix policy at conferences with a slide that read, “No advertising, no support, no bug fixes, payment in advance.”<br>\nWith no other channels of support available to them, early Unix adopters banded together for mutual assistance, forming a loose network of user groups all over the world. They had the source code, which helped. And they didn’t view Unix as a standard software product, because nobody seemed to be looking after it. So these early Unix users themselves set about fixing bugs, writing new tools, and generally improving the system as they saw fit.<br>\nThe Usenix user group acted as a clearinghouse for the exchange of Unix software in the United States. People could send in magnetic tapes with new software or fixes to the system and get back tapes with the software and fixes that Usenix had received from others. In Australia, the University of New South Wales and the University of Sydney produced a more robust version of Unix, the Australian Unix Share Accounting Method, which could cope with larger numbers of concurrent users and offered better performance.<br>\nBy the mid-1970s, the environment of sharing that had sprung up around Unix resembled the open-source movement so prevalent today. Users far and wide were enthusiastically enhancing the system, and many of their improvements were being fed back to Bell Labs for incorporation in future releases. But as Unix became more popular, AT&amp;T’s lawyers began looking harder at what various licensees were doing with their systems.<br>\nOne person who caught their eye was John Lions, a computer scientist then teaching at the University of New South Wales, in Australia. In 1977, he published what was probably the most famous computing book of the time, A Commentary on the Unix Operating System, which contained an annotated listing of the central source code for Unix.<br>\nUnix’s licensing conditions allowed for the exchange of source code, and initially, Lions’s book was sold to licensees. But by 1979, AT&amp;T’s lawyers had clamped down on the book’s distribution and use in academic classes. The anti­authoritarian Unix community reacted as you might expect, and samizdat copies of the book spread like wildfire. Many of us have nearly unreadable nth-­generation photocopies of the original book.<br>\nEnd runs around AT&amp;T’s lawyers indeed became the norm—even at Bell Labs. For example, between the release of the sixth edition of Unix in 1975 and the seventh edition in 1979, Thompson collected dozens of important bug fixes to the system, coming both from within and outside of Bell Labs. He wanted these to filter out to the existing Unix user base, but the company’s lawyers felt that this would constitute a form of support and balked at their release. Nevertheless, those bug fixes soon became widely distributed through unofficial channels. For instance, Lou Katz, the founding president of Usenix, received a phone call one day telling him that if he went down to a certain spot on Mountain Avenue (where Bell Labs was located) at 2 p.m., he would find something of interest. Sure enough, Katz found a magnetic tape with the bug fixes, which were rapidly in the hands of countless users.<br>\nBy the end of the 1970s, Unix, which had started a decade earlier as a reaction against the loss of a comfortable programming environment, was growing like a weed throughout academia and the IT industry. Unix would flower in the early 1980s before reaching the height of its popularity in the early 1990s.<br>\nFor many reasons, Unix has since given way to other commercial and noncommercial systems. But its legacy, that of an elegant, well-designed, comfortable environment for software development, lives on. In recognition of their accomplishment, Thompson and Ritchie were given the Japan Prize earlier this year, adding to a collection of honors that includes the United States’ National Medal of Technology and Innovation and the Association of Computing Machinery’s Turing Award. Many other, often very personal, tributes to Ritchie and his enormous influence on computing were widely shared after his death this past October.<br>\nUnix is indeed one of the most influential operating systems ever invented. Its direct descendants now number in the hundreds. On one side of the family tree are various versions of Unix proper, which began to be commercialized in the 1980s after the Bell System monopoly was broken up, freeing AT&amp;T from the stipulations of the 1956 consent decree. On the other side are various Unix-like operating systems derived from the version of Unix developed at the University of California, Berkeley, including the one Apple uses today on its computers, OS X. I say “Unix-like” because the developers of the Berkeley Software Distribution (BSD) Unix on which these systems were based worked hard to remove all the original AT&amp;T code so that their software and its descendants would be freely distributable.<br>\nThe effectiveness of those efforts were, however, called into question when the AT&amp;T subsidiary Unix System Laboratories filed suit against Berkeley Software Design and the Regents of the University of California in 1992 over intellectual property rights to this software. The university in turn filed a counterclaim against AT&amp;T for breaches to the license it provided AT&amp;T for the use of code developed at Berkeley. The ensuing legal quagmire slowed the development of free Unix-like clones, including 386BSD, which was designed for the Intel 386 chip, the CPU then found in many IBM PCs.<br>\nHad this operating system been available at the time, Linus Torvalds says he probably wouldn’t have created Linux, an open-source Unix-like operating system he developed from scratch for PCs in the early 1990s. Linux has carried the Unix baton forward into the 21st century, powering a wide range of digital gadgets including wireless routers, televisions, desktop PCs, and Android smartphones. It even runs some supercomputers.<br>\nAlthough AT&amp;T quickly settled its legal disputes with Berkeley Software Design and the University of California, legal wrangling over intellectual property claims to various parts of Unix and Linux have continued over the years, often involving byzantine corporate relations. By 2004, no fewer than five major lawsuits had been filed. Just this past August, a software company called the TSG Group (formerly known as the SCO Group), lost a bid in court to claim ownership of Unix copyrights that Novell had acquired when it purchased the Unix System Laboratories from AT&amp;T in 1993.<br>\nAs a programmer and Unix historian, I can’t help but find all this legal sparring a bit sad. From the very start, the authors and users of Unix worked as best they could to build and share, even if that meant defying authority. That outpouring of selflessness stands in sharp contrast to the greed that has driven subsequent legal battles over the ownership of Unix.<br>\nThe world of computer hardware and software moves forward startlingly fast. For IT professionals, the rapid pace of change is typically a wonderful thing. But it makes us susceptible to the loss of our own history, including important lessons from the past. To address this issue in a small way, in 1995 I started a mailing list of old-time Unix ­aficionados. That effort morphed into the Unix Heritage Society. Our goal is not only to save the history of Unix but also to collect and curate these old systems and, where possible, bring them back to life. With help from many talented members of this society, I was able to restore much of the old Unix software to working order, including Ritchie’s first C compiler from 1972 and the first Unix system to be written in C, dating from 1973.<br>\nOne holy grail that eluded us for a long time was the first edition of Unix in any form, electronic or otherwise. Then, in 2006, Al Kossow from the Computer History Museum, in Mountain View, Calif., unearthed a printed study of Unix dated 1972, which not only covered the internal workings of Unix but also included a complete assembly listing of the kernel, the main component of this operating system. This was an amazing find—like discovering an old Ford Model T collecting dust in a corner of a barn. But we didn’t just want to admire the chrome work from afar. We wanted to see the thing run again.<br>\nIn 2008, Tim Newsham, an independent programmer in Hawaii, and I assembled a team of like-minded Unix enthusiasts and set out to bring this ancient system back from the dead. The work was technically arduous and often frustrating, but in the end, we had a copy of the first edition of Unix running on an emulated PDP-11/20. We sent out messages announcing our success to all those we thought would be interested. Thompson, always succinct, simply replied, “Amazing.” Indeed, his brainchild was amazing, and I’ve been happy to do what I can to make it, and the story behind it, better known.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong><br>\n<a href=\"http://do.co/bsdnow\">http://do.co/bsdnow</a></p>\n\n<p>###<a href=\"https://www.davd.eu/posts-freebsd-jails-with-a-single-public-ip-address/\">FreeBSD jails with a single public IP address</a></p>\n\n<blockquote>\n<p>Jails in FreeBSD provide a simple yet flexible way to set up a proper server layout. In the most setups the actual server only acts as the host system for the jails while the applications themselves run within those independent containers. Traditionally every jail has it’s own IP for the user to be able to address the individual services. But if you’re still using IPv4 this might get you in trouble as the most hosters don’t offer more than one single public IP address per server.</p>\n</blockquote>\n\n<ul>\n<li>Create the internal network</li>\n</ul>\n\n<blockquote>\n<p>In this case NAT (“Network Address Translation”) is a good way to expose services in different jails using the same IP address.<br>\nFirst, let’s create an internal network (“NAT network”) at 192.168.0.0/24. You could generally use any private IPv4 address space as specified in RFC 1918. Here’s an overview: <a href=\"https://en.wikipedia.org/wiki/Private_network\">https://en.wikipedia.org/wiki/Private_network</a>. Using pf, FreeBSD’s firewall, we will map requests on different ports of the same public IP address to our individual jails as well as provide network access to the jails themselves.<br>\nFirst let’s check which network devices are available. In my case there’s em0 which provides connectivity to the internet and lo0, the local loopback device.</p>\n</blockquote>\n\n<pre><code class=\"language-em0:\">  options=209b&lt;RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC&gt;\n  [...]\n  inet 172.31.1.100 netmask 0xffffff00 broadcast 172.31.1.255\n  nd6 options=23&lt;PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL&gt;\n  media: Ethernet autoselect (1000baseT &lt;full-duplex&gt;)\n  status: active\n\nlo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384\n  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;\n  inet6 ::1 prefixlen 128\n  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2\n  inet 127.0.0.1 netmask 0xff000000\n  nd6 options=21&lt;PERFORMNUD,AUTO_LINKLOCAL&gt;```\n\n&gt; For our internal network, we create a cloned loopback device called lo1. Therefore we need to customize the /etc/rc.conf file, adding the following two lines:\n\n```cloned_interfaces=&quot;lo1&quot;\nipv4_addrs_lo1=&quot;192.168.0.1-9/29&quot;```\n\n&gt; This defines a /29 network, offering IP addresses for a maximum of 6 jails:\n\n```ipcalc 192.168.0.1/29\nAddress:   192.168.0.1          11000000.10101000.00000000.00000 001\nNetmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000\nWildcard:  0.0.0.7              00000000.00000000.00000000.00000 111\n=&gt;\nNetwork:   192.168.0.0/29       11000000.10101000.00000000.00000 000\nHostMin:   192.168.0.1          11000000.10101000.00000000.00000 001\nHostMax:   192.168.0.6          11000000.10101000.00000000.00000 110\nBroadcast: 192.168.0.7          11000000.10101000.00000000.00000 111\nHosts/Net: 6                     Class C, Private Internet```\n\n&gt; Then we need to restart the network. Please be aware of currently active SSH sessions as they might be dropped during restart. It’s a good moment to ensure you have KVM access to that server ;-)\n\n```service netif restart```\n\n&gt; After reconnecting, our newly created loopback device is active:\n\n```lo1: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; metric 0 mtu 16384\n  options=600003&lt;RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6&gt;\n  inet 192.168.0.1 netmask 0xfffffff8\n  inet 192.168.0.2 netmask 0xffffffff\n  inet 192.168.0.3 netmask 0xffffffff\n  inet 192.168.0.4 netmask 0xffffffff\n  inet 192.168.0.5 netmask 0xffffffff\n  inet 192.168.0.6 netmask 0xffffffff\n  inet 192.168.0.7 netmask 0xffffffff\n  inet 192.168.0.8 netmask 0xffffffff\n  inet 192.168.0.9 netmask 0xffffffff\n  nd6 options=29&lt;PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL&gt;```\n\n+ Setting up\n\n&gt; pf part of the FreeBSD base system, so we only have to configure and enable it. By this moment you should already have a clue of which services you want to expose. If this is not the case, just fix that file later on. In my example configuration, I have a jail running a webserver and another jail running a mailserver:\n\n +  Public IP address\n```IP_PUB=&quot;1.2.3.4&quot;```\n\n +  Packet normalization\n```scrub in all```\n\n +  Allow outbound connections from within the jails\n```nat on em0 from lo1:network to any -&gt; (em0)```\n\n +  webserver jail at 192.168.0.2\n```rdr on em0 proto tcp from any to $IP_PUB port 443 -&gt; 192.168.0.2```\n\n + just an example in case you want to redirect to another port within your jail\n```rdr on em0 proto tcp from any to $IP_PUB port 80 -&gt; 192.168.0.2 port 8080```\n\n + mailserver jail at 192.168.0.3\n```rdr on em0 proto tcp from any to $IP_PUB port 25 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 587 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 143 -&gt; 192.168.0.3```\n```rdr on em0 proto tcp from any to $IP_PUB port 993 -&gt; 192.168.0.3```\n\n&gt; Now just enable pf like this (which is the equivalent of adding pf_enable=YES to /etc/rc.conf):\n\n```sysrc pf_enable=&quot;YES&quot;```\n\n&gt; and start it:\n\n```service pf start```\n\n+ Install ezjail\n\n&gt; Ezjail is a collection of scripts by erdgeist that allow you to easily manage your jails.\n\n```pkg install ezjail```\n\n&gt; As an alternative, you could install ezjail from the ports tree. Now we need to set up the basejail which contains the shared base system for our jails. In fact, every jail that you create get’s will use that basejail to symlink directories related to the base system like /bin and /sbin. This can be accomplished by running\n\n```ezjail-admin install```\n\n&gt; In the next step, we’ll copy the /etc/resolv.conf file from our host to the newjail, which is the template for newly created jails (the parts that are not provided by basejail), to ensure that domain resolution will work properly within our jails later on:\n\n```cp /etc/resolv.conf /usr/jails/newjail/etc/```\n\n&gt; Last but not least, we enable ezjail and start it:\n\n```sysrc ezjail_enable=&quot;YES&quot;```\n```service ezjail start```\n\n+ Create a jail\n\n&gt; Creating a jail is as easy as it could probably be:\n\n```ezjail-admin create webserver 192.168.0.2```\n```ezjail-admin start webserver```\n\n&gt; Now you can access your jail using:\n\n```ezjail-admin console webserver```\n\n&gt; Each jail contains a vanilla FreeBSD installation.\n\n+ Deploy services\n\n&gt; Now you can spin up as many jails as you want to set up your services like web, mail or file shares. You should take care not to enable sshd within your jails, because that would cause problems with the service’s IP bindings. But this is not a problem, just SSH to the host and enter your jail using ezjail-admin console.\n***\n\n###[EuroBSDcon 2018 Talks &amp; Schedule](https://2018.eurobsdcon.org/talks-schedule/)\n***\n\n\n\n\n##News Roundup\n###[OpenBSD on an iBook G4](https://bobstechsite.com/openbsd-on-an-ibook-g4/)\n&gt; I've mentioned on social media and on the BTS podcast a few times that I wanted to try installing OpenBSD onto an old &quot;snow white&quot; iBook G4 I acquired last summer to see if I could make it a useful machine again in the year 2018.  This particular eBay purchase came with a 14&quot; 1024x768 TFT screen, 1.07GHz PowerPC G4 processor, 1.5GB RAM, 100GB of HDD space and an ATI Radeon 9200 graphics card with 32 MB of SDRAM. The optical drive, ethernet port, battery &amp; USB slots are also fully-functional. The only thing that doesn't work is the CMOS battery, but that's not unexpected for a device that was originally released in 2004.\n\n+ Initial experiments\n\n&gt; This iBook originally arrived at my door running Apple Mac OSX Leopard and came with the original install disk, the iLife &amp; iWork suites for 2008, various instruction manuals, a working power cable and a spare keyboard. As you'll see in the pictures I took for this post the characters on the buttons have started to wear away from 14 years of intensive use, but the replacement needs a very good clean before I decide to swap it in!\n\n&gt; After spending some time exploring the last version of OSX to support the IBM PowerPC processor architecture I tried to see if the hardware was capable of modern computing with Linux. Something I knew ahead of trying this was that the WiFi adapter was unlikely to work because it's a highly proprietary component designed by Apple to work specifically with OSX and nothing else, but I figured I could probably use a wireless USB dongle later to get around this limitation.\n\n&gt; Unfortunately I found that no recent versions of mainstream Linux distributions would boot off this machine. Debian has dropped support 32-bit PowerPC architectures and the PowerPC variants of Ubuntu 16.04 LTS (vanilla, MATE and Lubuntu) wouldn't even boot the installer! The only distribution I could reliably install on the hardware was Lubuntu 14.04 LTS.\n\n&gt; Unfortunately I'm not the biggest fan of the LXDE desktop for regular work and a lot of ported applications were old and broken because it clearly wasn't being maintained by people that use the hardware anymore. Ubuntu 14.04 is also approaching the end of its support life in early 2019, so this limited solution also has a limited shelf-life.\n\n+ Over to BSD\n\n&gt; I discussed this problem with a few people on Mastodon and it was pointed out to me that OSX is built on the Darwin kernel, which happens to be a variant of BSD. NetBSD and OpenBSD fans in particular convinced me that their communities still saw the value of supporting these old pieces of kit and that I should give BSD a try.\n\n&gt; So yesterday evening I finally downloaded the &quot;macppc&quot; version of OpenBSD 6.3 with no idea what to expect. I hoped for the best but feared the worst because my last experience with this operating system was trying out PC-BSD in 2008 and discovering with disappointment that it didn't support any of the hardware on my Toshiba laptop.\n\n&gt; When I initially booted OpenBSD I was a little surprised to find the login screen provided no visual feedback when I typed in my password, but I can understand the security reasons for doing that. The initial desktop environment that was loaded was very basic. All I could see was a console output window, a terminal and a desktop switcher in the X11 environment the system had loaded.\n\n&gt; After a little Googling I found this blog post had some fantastic instructions to follow for the post-installation steps: https://sohcahtoa.org.uk/openbsd.html. I did have to adjust them slightly though because my iBook only has 1.5GB RAM and not every package that page suggests is available on macppc by default. You can see a full list here: https://ftp.openbsd.org/pub/OpenBSD/6.3/packages/powerpc/.\n\n+ Final thoughts\n\n&gt; I was really impressed with the performance of OpenBSD's &quot;macppc&quot; port. It boots much faster than OSX Leopard on the same hardware and unlike Lubuntu 14.04 it doesn't randomly hang for no reason or crash if you launch something demanding like the GIMP.\n\n&gt; I was pleased to see that the command line tools I'm used to using on Linux have been ported across too. OpenBSD also had no issues with me performing basic desktop tasks on XFCE like browsing the web with NetSurf, playing audio files with VLC and editing images with the GIMP. Limited gaming is also theoretically possible if you're willing to build them (or an emulator) from source with SDL support.\n\n&gt; If I wanted to use this system for heavy duty work then I'd probably be inclined to run key applications like LibreOffice on a Raspberry Pi and then connect my iBook G4 to those using VNC or an SSH connection with X11 forwarding. BSD is UNIX after all, so using my ancient laptop as a dumb terminal should work reasonably well.\n\n&gt; In summary I was impressed with OpenBSD and its ability to breathe new life into this old Apple Mac. I'm genuinely excited about the idea of trying BSD with other devices on my network such as an old Asus Eee PC 900 netbook and at least one of the many Raspberry Pi devices I use. Whether I go the whole hog and replace Fedora on my main production laptop though remains to be seen!\n\n***\n\n###[The template user with PAM and login(1)](http://oshogbo.vexillium.org/blog/48)\n&gt; When you build a new service (or an appliance) you need your users to be able to configure it from the command line. To accomplish this you can create system accounts for all registered users in your service and assign them a special login shell which provides such limited functionality. This can be painful if you have a dynamic user database.\n&gt; Another challenge is authentication via remote services such as RADIUS. How can we implement  services when we authenticate through it and log into it as a different user? Furthermore, imagine a scenario when RADIUS decides on which account we have the right to access by sending an additional attribute.\n&gt; To address these two problems we can use a &quot;template&quot; user. Any of the PAM modules can set the value of the PAM_USER item. The value of this item will be used to determine which account we want to login. Only the &quot;template&quot; user must exist on the local password database, but the credential check can be omitted by the module.\n&gt; This functionality exists in the login(1) used by FreeBSD, HardenedBSD, DragonFlyBSD and illumos. The functionality doesn't exist in the login(1) used in NetBSD, and OpenBSD doesn't support PAM modules at all. In addition what  is also noteworthy is that such functionality was also in the OpenSSH but they decided to remove it and call it a security vulnerability (CVE 2015-6563). I can see how some people may have seen it that way, that’s why I recommend reading this article from an OpenPAM author and a FreeBSD security officer at the time.\n&gt; Knowing the background let's take a look at an example.\n\n```PAM_EXTERN int\npam_sm_authenticate(pam_handle_t *pamh, int flags __unused,\n    int argc __unused, const char *argv[] __unused)\n{\n        const char *user, *password;\n        int err;\n\n        err = pam_get_user(pamh, &amp;user, NULL);\n        if (err != PAM_SUCCESS)\n                return (err);\n\n        err = pam_get_authtok(pamh, PAM_AUTHTOK, &amp;password, NULL);\n        if (err == PAM_CONV_ERR)\n                return (err);\n        if (err != PAM_SUCCESS)\n                return (PAM_AUTH_ERR);\n\n        err = authenticate(user, password);\n        if (err != PAM_SUCCESS) {\n                return (err);\n        }\n\n        return (pam_set_item(pamh, PAM_USER, &quot;template&quot;));\n}\n</code></pre>\n\n<blockquote>\n<p>In the listing above we have an example of a PAM module. The pam_get_user(3) provides a username. The pam_get_authtok(3) shows us a secret given by the user. Both functions allow us to give an optional prompt which should be shown to the user. The authenticate function is our crafted function which authenticates the user. In our first scenario we wanted to keep all users in an external database. If authentication is successful we then switch to a template user which has  a shell set up for a script allowing us to configure the machine. In our second scenario the authenticate function authenticates the user in RADIUS.</p>\n</blockquote>\n\n<blockquote>\n<p>Another step is to add our PAM module to the /etc/pam.d/system or to the /etc/pam.d/login configuration:</p>\n</blockquote>\n\n<p><code>auth sufficient pam_template.so no_warn allow_local</code></p>\n\n<blockquote>\n<p>Unfortunately the description of all these options goes beyond this article - if you would like to know more about it you can find them in the PAM manual. The last thing we need to do is to add our template user to the system which  you can do by the adduser(8) command or just simply modifying the /etc/master.passwd file and use pwd_mkdb(8) program:</p>\n</blockquote>\n\n<p><code>$ tail -n /etc/master.passwd</code><br>\n<code>template:*:1000:1000::0:0:User &amp;:/:/usr/local/bin/templatesh</code><br>\n<code>$ sudo pwd_mkdb /etc/master.passwd</code></p>\n\n<blockquote>\n<p>As you can see,the template user can be locked and we still can use it in our PAM module (the * character after login).<br>\nI would like to thank Dag-Erling Smørgrav for pointing this functionality out to me when I was looking for it some time ago.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong><br>\n<a href=\"https://www.ixsystems.com/blog/vmworld2018-countdown/\">iXsystems @ VMWorld</a></p>\n\n<p>###<a href=\"https://aravindh.net/posts/zfs_fileserver/\">ZFS file server</a></p>\n\n<ul>\n<li>What is the need?</li>\n</ul>\n\n<blockquote>\n<p>At work, we run a compute cluster that uses an Isilon cluster as primary NAS storage. Excluding snapshots, we have about 200TB of research data, some of them in compressed formats, and others not. We needed an offsite backup file server that would constantly mirror our primary NAS and serve as a quick recovery source in case of a data loss in the the primary NAS. This offsite file server would be passive - will never face the wrath of the primary cluster workload.<br>\nIn addition to the role of a passive backup server, this solution would take on some passive report generation workloads as an ideal way of offloading some work from the primary NAS. The passive work is read-only.<br>\nThe backup server would keep snapshots in a best effort basis dating back to 10 years. However, this data on this backup server would be archived to tapes periodically.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>A simple guidance of priorities:</p>\n</li>\n<li>\n<p>Data integrity &gt; Cost of solution &gt; Storage capacity &gt; Performance.</p>\n</li>\n<li>\n<p>Why not enterprise NAS? NetApp FAS or EMC Isilon or the like?</p>\n</li>\n</ul>\n\n<blockquote>\n<p>We decided that enterprise grade NAS like NetAPP FAS or EMC Isilon are prohibitively expensive and an overkill for our needs.<br>\nAn open source &amp; cheaper alternative to enterprise grade filesystem with the level of durability we expect turned up to be ZFS. We’re already spoilt from using snapshots by a clever Copy-on-Write Filesystem(WAFL) by NetApp. ZFS providing snapshots in almost identical way was a big influence in the choice. This is also why we did not consider just a CentOS box with the default XFS filesystem.</p>\n</blockquote>\n\n<ul>\n<li>FreeBSD vs Debian for ZFS</li>\n</ul>\n\n<blockquote>\n<p>This is a backup server, a long-term solution. Stability and reliability are key requirements. ZFS on Linux may be popular at this time, but there is a lot of churn around its development, which means there is a higher probability of bugs like this to occur. We’re not looking for cutting edge features here. Perhaps, Linux would be considered in the future.</p>\n</blockquote>\n\n<ul>\n<li>FreeBSD + ZFS</li>\n</ul>\n\n<blockquote>\n<p>We already utilize FreeBSD and OpenBSD for infrastructure services and we have nothing but praises for the stability that the BSDs have provided us. We’d gladly use FreeBSD and OpenBSD wherever possible.</p>\n</blockquote>\n\n<ul>\n<li>Okay, ZFS, but why not FreeNAS?</li>\n</ul>\n\n<blockquote>\n<p>IMHO, FreeNAS provides a integrated GUI management tool over FreeBSD for a novice user to setup and configure FreeBSD, ZFS, Jails and many other features. But, this user facing abstraction adds an extra layer of complexity to maintain that is just not worth it in simpler use cases like ours. For someone that appreciates the commandline interface, and understands FreeBSD enough to administer it, plain FreeBSD + ZFS is simpler and more robust than FreeNAS.</p>\n</blockquote>\n\n<ul>\n<li>Specifications</li>\n<li>Lenovo SR630 Rackserver</li>\n<li>2 X Intel Xeon silver 4110 CPUs</li>\n<li>768 GB of DDR4 ECC 2666 MHz RAM</li>\n<li>4 port SAS card configured in passthrough mode(JBOD)</li>\n<li>Intel network card with 10 Gb SFP+ ports</li>\n<li>128GB M.2 SSD for use as boot drive</li>\n<li>2 X HGST 4U60 JBOD</li>\n<li>120(2 X 60) X 10TB SAS disks</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://nanxiao.me/en/reflection-on-one-year-usage-of-openbsd/\">Reflection on one-year usage of OpenBSD</a></p>\n\n<blockquote>\n<p>I have used OpenBSD for more than one year, and it is time to give a summary of the experience:</p>\n</blockquote>\n\n<ul>\n<li>(1) What do I get from OpenBSD?</li>\n</ul>\n\n<blockquote>\n<p>a) A good UNIX tutorial. When I am curious about some UNIXcommands’ implementation, I will refer to OpenBSD source code, and I actually gain something every time. E.g., refresh socket programming skills from nc; know how to process file efficiently from cat.</p>\n</blockquote>\n\n<blockquote>\n<p>b) A better test bed. Although my work focus on developing programs on Linux, I will try to compile and run applications on OpenBSD if it is possible. One reason is OpenBSD usually gives more helpful warnings. E.g., hint like this:</p>\n</blockquote>\n\n<p><code>......</code><br>\n<code>warning: sprintf() is often misused, please use snprintf()</code><br>\n<code>......</code></p>\n\n<blockquote>\n<p>Or you can refer this post which I wrote before. The other is sometimes program run well on Linux may crash on OpenBSD, and OpenBSD can help you find hidden bugs.</p>\n</blockquote>\n\n<blockquote>\n<p>c) Some handy tools. E.g. I find tcpbench is useful, so I ported it into Linux for my own usage (project is here).</p>\n</blockquote>\n\n<ul>\n<li>(2) What I give back to OpenBSD?</li>\n</ul>\n\n<blockquote>\n<p>a) Patches. Although most of them are trivial modifications, they are still my contributions.</p>\n</blockquote>\n\n<blockquote>\n<p>b) Write blog posts to share experience about using OpenBSD.</p>\n</blockquote>\n\n<blockquote>\n<p>c) Develop programs for OpenBSD/*BSD: lscpu and free.</p>\n</blockquote>\n\n<blockquote>\n<p>d) Porting programs into OpenBSD: E.g., I find google/benchmark is a nifty tool, but lacks OpenBSD support, I submitted PR and it is accepted. So you can use google/benchmark on OpenBSD now.</p>\n</blockquote>\n\n<ul>\n<li>Generally speaking, the time invested on OpenBSD is rewarding. If you are still hesitating, why not give a shot?</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.meetup.com/BSD-Users-Stockholm/events/253447019/\">BSD Users Stockholm Meetup</a></li>\n<li><a href=\"https://www.youtube.com/playlist?list=PLeF8ZihVdpFfkICtA2HFsZecdC28_mrQh\">BSDCan 2018 Playlist</a></li>\n<li><a href=\"https://forum.opnsense.org/index.php?PHPSESSID=hvuv2kg4js2nlfpm73ut5ro8p2&amp;topic=9280.0\">OPNsense 18.7 released</a></li>\n<li><a href=\"https://youtu.be/WLgdJwd5zcQ\">Testing TrueOS (FreeBSD derivative) on real hardware ThinkPad T410</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-jobs/2018-July/000946.html\">Kernel Hacker Wanted!</a></li>\n<li><a href=\"https://svnweb.freebsd.org/changeset/base/337411\">Replace a pair of 8-bit writes to VGA memory with a single 16-bit write</a></li>\n<li><a href=\"https://svnweb.freebsd.org/changeset/base/337229\">Reduce taskq and context-switch cost of zio pipe</a></li>\n<li><a href=\"https://reviews.freebsd.org/D16606\">Proposed FreeBSD Memory Management change, expected to improve ZFS ARC interactions</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Anian_Z - <a href=\"http://dpaste.com/093FC8R#wrap\">Question</a></li>\n<li>Robert - <a href=\"http://dpaste.com/0GG7Q2A#wrap\">Pool question</a></li>\n<li>Lain - <a href=\"http://dpaste.com/2BWPX9C\">Congratulations</a></li>\n<li>Thomas - <a href=\"http://dpaste.com/25NGAP3#wrap\">L2arc</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"The strange birth and long life of Unix, FreeBSD jail with a single public IP, EuroBSDcon 2018 talks and schedule, OpenBSD on G4 iBook, PAM template user, ZFS file server, and reflections on one year of OpenBSD use.","date_published":"2018-08-16T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f1dc9150-bd92-4004-9643-095d9da96886.mp3","mime_type":"audio/mp3","size_in_bytes":64748796,"duration_in_seconds":6456}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2390","title":"Episode 258: OS Foundations | BSD Now 258","url":"https://www.bsdnow.tv/258","content_text":"FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.\n\n##Headlines\n###FreeBSD Foundation Update, July 2018\n\n\nMESSAGE FROM THE EXECUTIVE DIRECTOR\n\n\n\nWe’re in the middle of summer here, in Boulder, CO. While the days are typically hot, they can also be quite unpredictable. Thanks to the Rocky Mountains, waking up to 50-degree (~10 C) foggy weather is not surprising. In spite of the unpredictable weather, many of us took some vacation this month. Whether it was extending the Fourth of July celebration,  spending time with family, or relaxing and enjoying the summer weather, we appreciated our time off, while still managing to accomplish a lot!\nIn this newsletter, Glen Barber enlightens us about the upcoming 12.0 release. I gave a recap of OSCON, that Ed Maste and I attended, and Mark Johnston explains the work on his improved microcode loading project, that we are funding. Finally, Anne Dickison gives us a rundown on upcoming events and information on submitting a talk for MeetBSD.\nYour support helps us continue this work. Please consider making a donation today. We can’t do it without you. Happy reading!!\n\n\n\nJune 2018 Development Projects Update\nFundraising Update: Supporting the Project\nJuly 2018 Release Engineering Update\nOSCON 2018 Recap\nSubmit Your Work: MeetBSD 2018\nFreeBSD Discount for 2018 SNIA Developer Conference\nEuroBSDcon 2018 Travel Grant Application Deadline: August 2\n\n\n\n\niXsystems\n\n###BSDCan Trip Reports\n\n\nBSDCan 2018 Trip Report: Constantin Stan\nBSDCan 2018 Trip Report: Danilo G. Baio\nBSDCan 2018 Trip Report: Rodrigo Osorio\nBSDCan 2018 Trip Report: Dhananjay Balan\nBSDCan 2018 Trip Report: Kyle Evans\n\n\n\n\n##News Roundup\n###FreeBSD and OSPFd\n\n\nWith FreeBSD jails deployed around the world, static routing was getting a bit out of hand. Plus, when I needed to move a jail from one data center to another, I would have to update routing tables across multiple sites. Not ideal. Enter dynamic routing…\n\n\n\nOSPF (open shortest path first) is an internal dynamic routing protocol that provides the autonomy that I needed and it’s fairly easy to setup. This article does not cover configuration of VPN links, ZFS, or Freebsd jails, however it’s recommended that you use seperate ZFS datasets per jail so that migration between hosts can be done with zfs send &amp; receive.\n\n\n\nIn this scenario, we have five FreeBSD servers in two different data centers. Each physical server runs anywhere between three to ten jails. When jails are deployed, they are assigned a /32 IP on lo2. From here, pf handles inbound port forwarding and outbound NAT. Links between each server are provided by OpenVPN TAP interfaces. (I used TAP to pass layer 2 traffic. I seem to remember that I needed TAP interfaces due to needing GRE tunnels on top of TUN interfaces to get OSPF to communicate. I’ve heard TAP is slower than TUN so I may revisit this.)\n\n\n\nIn this example, we will use 172.16.2.0/24 as the range for OpenVPN P2P links and 172.16.3.0/24 as the range of IPs available for assignment to each jail. Previously, when deploying a jail, I assigned IPs based on the following groups:\n\n\nServer 1: 172.16.3.0/28\nServer 2: 172.16.3.16/28\nServer 3: 172.16.3.32/28\nServer 4: 172.16.3.48/28\nServer 5: 172.16.3.64/28\n\n\nWhen statically routing, this made routing tables a bit smaller and easier to manage. However, when I needed to migrate a jail to a new host, I had to add a new /32 to all routing tables. Now, with OSPF, this is no longer an issue, nor is it required.\n\n\n\n\nTo get started, first we install the Quagga package.\n\n\nThe two configuration files needed to get OSPFv2 running are /usr/local/etc/quagga/zebra.conf and /usr/local/etc/quagga/ospfd.conf.\n\n\nStarting with zebra.conf, we’ll define the hostname and a management password.\n\n\nSecond, we will populate the ospfd.conf file.\n\n\nTo break this down:\n\n\nservice advanced-vty allows you to skip the en or enable command. Since I’m the only one who uses this service, it’s one less command to type.\n\n\nip ospf authentication message-digest and ip ospf message-diget-key… ignores non-authenticated OSPF communication. This is useful when communicating over the WAN and to prevent a replay attack. Since I’m using a VPN to communicate, I could exclude these.\n\n\npassive-interface default turns off the active communication of OSPF messages on all interfaces except for the interfaces listed as no passive-interface [interface name]. Since my ospf communication needs to leverage the VPNs, this prevents the servers from trying to send ospf data out the WAN interface (a firewall would work too).\n\n\nnetwork 172.16.2.0/23 area 0.0.0.0 lists a supernet of both 172.16.2.0/24 and 172.16.3.0/24. This ensures routes for the jails are advertised along with the P2P links used by OpenVPN. The OpenVPN links are not required but can provide another IP to access your server if one of the links goes down. (See the suggested tasks below).\n\n\nAt this point, we can enable the services in rc.conf.local and start them.\n\n\nWe bind the management interface to 127.0.0.1 so that it’s only accessable to local telnet sessions. If you want to access this service remotely, you can bind to a remotely accessable IP. Remember telnet is not secure. If you need remote access, use a VPN.\n\n\nTo manage the services, you can telnet to your host’s localhost address.\n\n\nUse 2604 for the ospf service.\n\n\nRemember, this is accessible by non-root users so set a good password.\n\n\n\n\n\n###A broad overview of how ZFS is structured on disk\n\n\nWhen I wrote yesterday’s entry, it became clear that I didn’t understand as much about how ZFS is structured on disk (and that this matters, since I thought that ZFS copy on write updates updated a lot more than they do). So today I want to write down my new broad understanding of how this works. (All of this can be dug out of the old, draft ZFS on-disk format specification, but that spec is written in a very detailed way and things aren’t always immediately clear from it.)\n\n\n\nAlmost everything in ZFS is in DMU object. All objects are defined by a dnode, and object dnodes are almost always grouped together in an object set. Object sets are themselves DMU objects; they store dnodes as basically a giant array in a ‘file’, which uses data blocks and indirect blocks and so on, just like anything else. Within a single object set, dnodes have an object number, which is the index of their position in the object set’s array of dnodes. (Because an object number is just the index of the object’s dnode in its object set’s array of dnodes, object numbers are basically always going to be duplicated between object sets (and they’re always relative to an object set). For instance, pretty much every object set is going to have an object number ten, although not all object sets may have enough objects that they have an object number ten thousand. One corollary of this is that if you ask zdb to tell you about a given object number, you have to tell zdb what object set you’re talking about. Usually you do this by telling zdb which ZFS filesystem or dataset you mean.)\n\n\n\nEach ZFS filesystem has its own object set for objects (and thus dnodes) used in the filesystem. As I discovered yesterday, every ZFS filesystem has a directory hierarchy and it may go many levels deep, but all of this directory hierarchy refers to directories and files using their object number.\n\n\n\nZFS organizes and keeps track of filesystems, clones, and snapshots through the DSL (Dataset and Snapshot Layer). The DSL has all sorts of things; DSL directories, DSL datasets, and so on, all of which are objects and many of which refer to object sets (for example, every ZFS filesystem must refer to its current object set somehow). All of these DSL objects are themselves stored as dnodes in another object set, the Meta Object Set, which the uberblock points to. To my surprise, object sets are not stored in the MOS (and as a result do not have ‘object numbers’). Object sets are always referred to directly, without indirection, using a block pointer to the object set’s dnode.  (I think object sets are referred to directly so that snapshots can freeze their object set very simply.)\n\n\n\nThe DSL directories and datasets for your pool’s set of filesystems form a tree themselves (each filesystem has a DSL directory and at least one DSL dataset). However, just like in ZFS filesystems, all of the objects in this second tree refer to each other indirectly, by their MOS object number. Just as with files in ZFS filesystems, this level of indirection limits the amount of copy on write updates that ZFS had to do when something changes.\n\n\n\nPS: If you want to examine MOS objects with zdb, I think you do it with something like ‘zdb -vvv -d ssddata 1’, which will get you object number 1 of the MOS, which is the MOS object directory. If you want to ask zdb about an object in the pool’s root filesystem, use ‘zdb -vvv -d ssddata/ 1’. You can tell which one you’re getting depending on what zdb prints out. If it says ‘Dataset mos [META]’ you’re looking at objects from the MOS; if it says ‘Dataset ssddata [ZPL]’, you’re looking at the pool’s root filesystem (where object number 1 is the ZFS master node).\n\n\n\nPPS: I was going to write up what changed on a filesystem write, but then I realized that I didn’t know how blocks being allocated and freed are reflected in pool structures. So I’ll just say that I think that ignoring free space management, only four DMU objects get updated; the file itself, the filesystem’s object set, the filesystem’s DSL dataset object, and the MOS.\n\n\n\n(As usual, doing the research to write this up taught me things that I didn’t know about ZFS.)\n\n\n\n\nDigital Ocean\n\n###HardenedBSD Foundation Status\n\n\nOn 09 July 2018, the HardenedBSD Foundation Board of Directors held the kick-off meeting to start organizing the Foundation. The following people attended the kick-off meeting:\n\n\n\n\n\nShawn Webb (in person)\n\n\n\n\nGeorge Saylor (in person)\n\n\n\n\nBen Welch (in person)\n\n\n\n\nVirginia Suydan (in person)\n\n\n\n\nBen La Monica (phone)\n\n\n\n\nDean Freeman (phone)\n\n\n\n\nChristian Severt (phone)\n\n\n\n\n\nWe discussed the very first steps that need to be taken to organize the HardenedBSD Foundation as a 501©(3) not-for-profit organization in the US. We determined we could file a 1023EZ instead of the full-blown 1023. This will help speed the process up drastically.\n\n\n\nThe steps are laid out as follows:\nRegister a Post Office Box (PO Box) (completed on 10 Jul 2018).\nRegister The HardenedBSD Foundation as a tax-exempt nonstock corporation in the state of Maryland (started on 10 Jul 2018, submitted on 18 Jul 2018, granted 20 Jul 2018).\nObtain a federal tax ID (obtained 20 Jul 2018).\nClose the current bank account and create a new one using the federal tax ID (completed on 20 Jul 2018).\nFile the 1023EZ paperwork with the federal government (started on 20 Jul 2018).\nHire an attorney to help draft the organization bylaws.\nEach of the steps must be done serially and in order.\n\n\n\nWe added Christian Severt, who is on Emerald Onion’s Board of Directors, to the HardenedBSD Foundation Board of Directors as an advisor. He was foundational in getting Emerald Onion their 501©(3) tax-exempt, not-for-profit status and has really good insight. Additionally, he’s going to help HardenedBSD coordinate hosting services, figuring out the best deals for us.\n\n\n\nWe promoted George Saylor to Vice President and changed Shawn Webb’s title to President and Director. This is to help resolve potential concerns both the state and federal agencies might have with an organization having only a single President role.\n\n\n\nWe hope to be granted our 501©(3) status before the end of the year, though that may be subject to change. We are excited for the formation of the HardenedBSD Foundation, which will open up new opportunities not otherwise available to HardenedBSD.\n\n\n\n\n###More mitigations against speculative execution vulnerabilities\n\n\nPhilip Guenther (guenther@) and Bryan Steele (brynet@) have added more mitigations against speculative execution CPU vulnerabilities on the amd64 platform.\n\n\n\nCVSROOT:    /cvs\nModule name:    src\nChanges by: guenther@cvs.openbsd.org    2018/07/23 11:54:04\n\nModified files:\n    sys/arch/amd64/amd64: locore.S \n    sys/arch/amd64/include: asm.h cpufunc.h frameasm.h \n\nLog message:\nDo \"Return stack refilling\", based on the \"Return stack underflow\" discussion\nand its associated appendix at https://support.google.com/faqs/answer/7625886\nThis should address at least some cases of \"SpectreRSB\" and earlier\nSpectre variants; more commits to follow.\n\nThe refilling is done in the enter-kernel-from-userspace and\nreturn-to-userspace-from-kernel paths, making sure to do it before\nunblocking interrupts so that a successive interrupt can't get the\nCPU to C code without doing this refill.  Per the link above, it\nalso does it immediately after mwait, apparently in case the low-power\nCPU states of idle-via-mwait flush the RSB.\n\nok mlarkin@ deraadt@```\n\n+ and:\n\n```CVSROOT: /cvs\nModule name:    src\nChanges by: guenther@cvs.openbsd.org    2018/07/23 20:42:25\n\nModified files:\n    sys/arch/amd64/amd64: locore.S vector.S vmm_support.S \n    sys/arch/amd64/include: asm.h cpufunc.h \n\nLog message:\nAlso do RSB refilling when context switching, after vmexits, and\nwhen vmlaunch or vmresume fails.\n\nFollow the lead of clang and the intel recommendation and do an lfence\nafter the pause in the speculation-stop path for retpoline, RSB refill,\nand meltover ASM bits.\n\nok kettenis@ deraadt@```\n\n+ \"Mitigation G-2\" for AMD processors:\n\n```CVSROOT: /cvs\nModule name:    src\nChanges by: brynet@cvs.openbsd.org  2018/07/23 17:25:03\n\nModified files:\n    sys/arch/amd64/amd64: identcpu.c \n    sys/arch/amd64/include: specialreg.h \n\nLog message:\nAdd \"Mitigation G-2\" per AMD's Whitepaper \"Software Techniques for\nManaging Speculation on AMD Processors\"\n\nBy setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing\ninstruction.\n\nTested on AMD FX-4100 \"Bulldozer\", and Linux guest in SVM vmd(8)\n\nok deraadt@ mlarkin@```\n***\n\n\n##Beastie Bits\n+ [HardenedBSD will stop supporting 10-STABLE on 10 August 2018](https://groups.google.com/a/hardenedbsd.org/forum/#!topic/users/xvU0g-g1l5U)\n+ [GSoC 2018 Reports: Integrate libFuzzer with the Basesystem, Part 2](https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_integrate_libfuzzer1)\n+ [ZFS Boot Environments at PBUG](https://vermaden.wordpress.com/2018/07/30/zfs-boot-environments-at-pbug/)\n+ [Second Editions versus the Publishing Business](https://blather.michaelwlucas.com/archives/3229)\n+ [Theo de Raadt on \"unveil(2) usage in base\"](https://undeadly.org/cgi?action=article;sid=20180728063716)\n+ [rtadvd(8) has been replaced by rad(8)](https://undeadly.org/cgi?action=article;sid=20180724072205)\n+ [BSD Users Stockholm Meetup #3](https://www.meetup.com/BSD-Users-Stockholm/events/253447019/)\n+ [Changes to NetBSD release support policy](https://blog.netbsd.org/tnf/entry/changes_to_netbsd_release_support)\n+ [The future of HAMMER1](http://lists.dragonflybsd.org/pipermail/users/2018-July/357832.html)\n***\n\n**Tarsnap**\n\n##Feedback/Questions\n+ Rodriguez - [A Question](http://dpaste.com/0Y1B75Q#wrap)\n+ Shane - [About ZFS Mostly](http://dpaste.com/32YGNBY#wrap)\n+ Leif - [ZFS less than 8gb](http://dpaste.com/2GY6HHC#wrap)\n+ Wayne - [ZFS vs EMC](http://dpaste.com/17PSCXC#wrap)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n","content_html":"<p>FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.freebsdfoundation.org/news-and-events/newsletter/freebsd-foundation-update-july-2018/\">FreeBSD Foundation Update, July 2018</a></p>\n\n<ul>\n<li>MESSAGE FROM THE EXECUTIVE DIRECTOR</li>\n</ul>\n\n<blockquote>\n<p>We’re in the middle of summer here, in Boulder, CO. While the days are typically hot, they can also be quite unpredictable. Thanks to the Rocky Mountains, waking up to 50-degree (~10 C) foggy weather is not surprising. In spite of the unpredictable weather, many of us took some vacation this month. Whether it was extending the Fourth of July celebration,  spending time with family, or relaxing and enjoying the summer weather, we appreciated our time off, while still managing to accomplish a lot!<br>\nIn this newsletter, Glen Barber enlightens us about the upcoming 12.0 release. I gave a recap of OSCON, that Ed Maste and I attended, and Mark Johnston explains the work on his improved microcode loading project, that we are funding. Finally, Anne Dickison gives us a rundown on upcoming events and information on submitting a talk for MeetBSD.<br>\nYour support helps us continue this work. Please consider making a donation today. We can’t do it without you. Happy reading!!</p>\n</blockquote>\n\n<ul>\n<li>June 2018 Development Projects Update</li>\n<li>Fundraising Update: Supporting the Project</li>\n<li>July 2018 Release Engineering Update</li>\n<li>OSCON 2018 Recap</li>\n<li>Submit Your Work: MeetBSD 2018</li>\n<li>FreeBSD Discount for 2018 SNIA Developer Conference</li>\n<li>EuroBSDcon 2018 Travel Grant Application Deadline: August 2</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###BSDCan Trip Reports</p>\n\n<ul>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-constantin-stan/\">BSDCan 2018 Trip Report: Constantin Stan</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-danilo-g-baio/\">BSDCan 2018 Trip Report: Danilo G. Baio</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-rodrigo-osorio/\">BSDCan 2018 Trip Report: Rodrigo Osorio</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-dhananjay-balan/\">BSDCan 2018 Trip Report: Dhananjay Balan</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-kyle-evans/\">BSDCan 2018 Trip Report: Kyle Evans</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://blog.haraschak.com/freebsd-and-ospfd/\">FreeBSD and OSPFd</a></p>\n\n<blockquote>\n<p>With FreeBSD jails deployed around the world, static routing was getting a bit out of hand. Plus, when I needed to move a jail from one data center to another, I would have to update routing tables across multiple sites. Not ideal. Enter dynamic routing…</p>\n</blockquote>\n\n<blockquote>\n<p>OSPF (open shortest path first) is an internal dynamic routing protocol that provides the autonomy that I needed and it’s fairly easy to setup. This article does not cover configuration of VPN links, ZFS, or Freebsd jails, however it’s recommended that you use seperate ZFS datasets per jail so that migration between hosts can be done with zfs send &amp; receive.</p>\n</blockquote>\n\n<blockquote>\n<p>In this scenario, we have five FreeBSD servers in two different data centers. Each physical server runs anywhere between three to ten jails. When jails are deployed, they are assigned a /32 IP on lo2. From here, pf handles inbound port forwarding and outbound NAT. Links between each server are provided by OpenVPN TAP interfaces. (I used TAP to pass layer 2 traffic. I seem to remember that I needed TAP interfaces due to needing GRE tunnels on top of TUN interfaces to get OSPF to communicate. I’ve heard TAP is slower than TUN so I may revisit this.)</p>\n</blockquote>\n\n<blockquote>\n<p>In this example, we will use 172.16.2.0/24 as the range for OpenVPN P2P links and 172.16.3.0/24 as the range of IPs available for assignment to each jail. Previously, when deploying a jail, I assigned IPs based on the following groups:</p>\n</blockquote>\n\n<p><code>Server 1: 172.16.3.0/28</code><br>\n<code>Server 2: 172.16.3.16/28</code><br>\n<code>Server 3: 172.16.3.32/28</code><br>\n<code>Server 4: 172.16.3.48/28</code><br>\n<code>Server 5: 172.16.3.64/28</code></p>\n\n<blockquote>\n<p>When statically routing, this made routing tables a bit smaller and easier to manage. However, when I needed to migrate a jail to a new host, I had to add a new /32 to all routing tables. Now, with OSPF, this is no longer an issue, nor is it required.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>To get started, first we install the Quagga package.</p>\n</li>\n<li>\n<p>The two configuration files needed to get OSPFv2 running are /usr/local/etc/quagga/zebra.conf and /usr/local/etc/quagga/ospfd.conf.</p>\n</li>\n<li>\n<p>Starting with zebra.conf, we’ll define the hostname and a management password.</p>\n</li>\n<li>\n<p>Second, we will populate the ospfd.conf file.</p>\n</li>\n<li>\n<p>To break this down:</p>\n</li>\n<li>\n<p>service advanced-vty allows you to skip the en or enable command. Since I’m the only one who uses this service, it’s one less command to type.</p>\n</li>\n<li>\n<p>ip ospf authentication message-digest and ip ospf message-diget-key… ignores non-authenticated OSPF communication. This is useful when communicating over the WAN and to prevent a replay attack. Since I’m using a VPN to communicate, I could exclude these.</p>\n</li>\n<li>\n<p>passive-interface default turns off the active communication of OSPF messages on all interfaces except for the interfaces listed as no passive-interface [interface name]. Since my ospf communication needs to leverage the VPNs, this prevents the servers from trying to send ospf data out the WAN interface (a firewall would work too).</p>\n</li>\n<li>\n<p>network 172.16.2.0/23 area 0.0.0.0 lists a supernet of both 172.16.2.0/24 and 172.16.3.0/24. This ensures routes for the jails are advertised along with the P2P links used by OpenVPN. The OpenVPN links are not required but can provide another IP to access your server if one of the links goes down. (See the suggested tasks below).</p>\n</li>\n<li>\n<p>At this point, we can enable the services in rc.conf.local and start them.</p>\n</li>\n<li>\n<p>We bind the management interface to 127.0.0.1 so that it’s only accessable to local telnet sessions. If you want to access this service remotely, you can bind to a remotely accessable IP. Remember telnet is not secure. If you need remote access, use a VPN.</p>\n</li>\n<li>\n<p>To manage the services, you can telnet to your host’s localhost address.</p>\n</li>\n<li>\n<p>Use 2604 for the ospf service.</p>\n</li>\n<li>\n<p>Remember, this is accessible by non-root users so set a good password.</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBroadDiskStructure\">A broad overview of how ZFS is structured on disk</a></p>\n\n<blockquote>\n<p>When I wrote yesterday’s entry, it became clear that I didn’t understand as much about how ZFS is structured on disk (and that this matters, since I thought that ZFS copy on write updates updated a lot more than they do). So today I want to write down my new broad understanding of how this works. (All of this can be dug out of the old, draft ZFS on-disk format specification, but that spec is written in a very detailed way and things aren’t always immediately clear from it.)</p>\n</blockquote>\n\n<blockquote>\n<p>Almost everything in ZFS is in DMU object. All objects are defined by a dnode, and object dnodes are almost always grouped together in an object set. Object sets are themselves DMU objects; they store dnodes as basically a giant array in a ‘file’, which uses data blocks and indirect blocks and so on, just like anything else. Within a single object set, dnodes have an object number, which is the index of their position in the object set’s array of dnodes. (Because an object number is just the index of the object’s dnode in its object set’s array of dnodes, object numbers are basically always going to be duplicated between object sets (and they’re always relative to an object set). For instance, pretty much every object set is going to have an object number ten, although not all object sets may have enough objects that they have an object number ten thousand. One corollary of this is that if you ask zdb to tell you about a given object number, you have to tell zdb what object set you’re talking about. Usually you do this by telling zdb which ZFS filesystem or dataset you mean.)</p>\n</blockquote>\n\n<blockquote>\n<p>Each ZFS filesystem has its own object set for objects (and thus dnodes) used in the filesystem. As I discovered yesterday, every ZFS filesystem has a directory hierarchy and it may go many levels deep, but all of this directory hierarchy refers to directories and files using their object number.</p>\n</blockquote>\n\n<blockquote>\n<p>ZFS organizes and keeps track of filesystems, clones, and snapshots through the DSL (Dataset and Snapshot Layer). The DSL has all sorts of things; DSL directories, DSL datasets, and so on, all of which are objects and many of which refer to object sets (for example, every ZFS filesystem must refer to its current object set somehow). All of these DSL objects are themselves stored as dnodes in another object set, the Meta Object Set, which the uberblock points to. To my surprise, object sets are not stored in the MOS (and as a result do not have ‘object numbers’). Object sets are always referred to directly, without indirection, using a block pointer to the object set’s dnode.  (I think object sets are referred to directly so that snapshots can freeze their object set very simply.)</p>\n</blockquote>\n\n<blockquote>\n<p>The DSL directories and datasets for your pool’s set of filesystems form a tree themselves (each filesystem has a DSL directory and at least one DSL dataset). However, just like in ZFS filesystems, all of the objects in this second tree refer to each other indirectly, by their MOS object number. Just as with files in ZFS filesystems, this level of indirection limits the amount of copy on write updates that ZFS had to do when something changes.</p>\n</blockquote>\n\n<blockquote>\n<p>PS: If you want to examine MOS objects with zdb, I think you do it with something like ‘zdb -vvv -d ssddata 1’, which will get you object number 1 of the MOS, which is the MOS object directory. If you want to ask zdb about an object in the pool’s root filesystem, use ‘zdb -vvv -d ssddata/ 1’. You can tell which one you’re getting depending on what zdb prints out. If it says ‘Dataset mos [META]’ you’re looking at objects from the MOS; if it says ‘Dataset ssddata [ZPL]’, you’re looking at the pool’s root filesystem (where object number 1 is the ZFS master node).</p>\n</blockquote>\n\n<blockquote>\n<p>PPS: I was going to write up what changed on a filesystem write, but then I realized that I didn’t know how blocks being allocated and freed are reflected in pool structures. So I’ll just say that I think that ignoring free space management, only four DMU objects get updated; the file itself, the filesystem’s object set, the filesystem’s DSL dataset object, and the MOS.</p>\n</blockquote>\n\n<ul>\n<li>(As usual, doing the research to write this up taught me things that I didn’t know about ZFS.)</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong></p>\n\n<p>###<a href=\"https://hardenedbsd.org/article/shawn-webb/2018-07-11/mid-july-hardenedbsd-foundation-status\">HardenedBSD Foundation Status</a></p>\n\n<blockquote>\n<p>On 09 July 2018, the HardenedBSD Foundation Board of Directors held the kick-off meeting to start organizing the Foundation. The following people attended the kick-off meeting:</p>\n</blockquote>\n\n<ul>\n<li>\n<ol>\n<li>Shawn Webb (in person)</li>\n</ol>\n</li>\n<li>\n<ol start=\"2\">\n<li>George Saylor (in person)</li>\n</ol>\n</li>\n<li>\n<ol start=\"3\">\n<li>Ben Welch (in person)</li>\n</ol>\n</li>\n<li>\n<ol start=\"4\">\n<li>Virginia Suydan (in person)</li>\n</ol>\n</li>\n<li>\n<ol start=\"5\">\n<li>Ben La Monica (phone)</li>\n</ol>\n</li>\n<li>\n<ol start=\"6\">\n<li>Dean Freeman (phone)</li>\n</ol>\n</li>\n<li>\n<ol start=\"7\">\n<li>Christian Severt (phone)</li>\n</ol>\n</li>\n</ul>\n\n<blockquote>\n<p>We discussed the very first steps that need to be taken to organize the HardenedBSD Foundation as a 501©(3) not-for-profit organization in the US. We determined we could file a 1023EZ instead of the full-blown 1023. This will help speed the process up drastically.</p>\n</blockquote>\n\n<ul>\n<li>The steps are laid out as follows:</li>\n<li>Register a Post Office Box (PO Box) (completed on 10 Jul 2018).</li>\n<li>Register The HardenedBSD Foundation as a tax-exempt nonstock corporation in the state of Maryland (started on 10 Jul 2018, submitted on 18 Jul 2018, granted 20 Jul 2018).</li>\n<li>Obtain a federal tax ID (obtained 20 Jul 2018).</li>\n<li>Close the current bank account and create a new one using the federal tax ID (completed on 20 Jul 2018).</li>\n<li>File the 1023EZ paperwork with the federal government (started on 20 Jul 2018).</li>\n<li>Hire an attorney to help draft the organization bylaws.</li>\n<li>Each of the steps must be done serially and in order.</li>\n</ul>\n\n<blockquote>\n<p>We added Christian Severt, who is on Emerald Onion’s Board of Directors, to the HardenedBSD Foundation Board of Directors as an advisor. He was foundational in getting Emerald Onion their 501©(3) tax-exempt, not-for-profit status and has really good insight. Additionally, he’s going to help HardenedBSD coordinate hosting services, figuring out the best deals for us.</p>\n</blockquote>\n\n<blockquote>\n<p>We promoted George Saylor to Vice President and changed Shawn Webb’s title to President and Director. This is to help resolve potential concerns both the state and federal agencies might have with an organization having only a single President role.</p>\n</blockquote>\n\n<blockquote>\n<p>We hope to be granted our 501©(3) status before the end of the year, though that may be subject to change. We are excited for the formation of the HardenedBSD Foundation, which will open up new opportunities not otherwise available to HardenedBSD.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://undeadly.org/cgi?action=article;sid=20180724072257\">More mitigations against speculative execution vulnerabilities</a></p>\n\n<blockquote>\n<p>Philip Guenther (guenther@) and Bryan Steele (brynet@) have added more mitigations against speculative execution CPU vulnerabilities on the amd64 platform.</p>\n</blockquote>\n\n<pre><code class=\"language-For\">\nCVSROOT:    /cvs\nModule name:    src\nChanges by: guenther@cvs.openbsd.org    2018/07/23 11:54:04\n\nModified files:\n    sys/arch/amd64/amd64: locore.S \n    sys/arch/amd64/include: asm.h cpufunc.h frameasm.h \n\nLog message:\nDo &quot;Return stack refilling&quot;, based on the &quot;Return stack underflow&quot; discussion\nand its associated appendix at https://support.google.com/faqs/answer/7625886\nThis should address at least some cases of &quot;SpectreRSB&quot; and earlier\nSpectre variants; more commits to follow.\n\nThe refilling is done in the enter-kernel-from-userspace and\nreturn-to-userspace-from-kernel paths, making sure to do it before\nunblocking interrupts so that a successive interrupt can't get the\nCPU to C code without doing this refill.  Per the link above, it\nalso does it immediately after mwait, apparently in case the low-power\nCPU states of idle-via-mwait flush the RSB.\n\nok mlarkin@ deraadt@```\n\n+ and:\n\n```CVSROOT: /cvs\nModule name:    src\nChanges by: guenther@cvs.openbsd.org    2018/07/23 20:42:25\n\nModified files:\n    sys/arch/amd64/amd64: locore.S vector.S vmm_support.S \n    sys/arch/amd64/include: asm.h cpufunc.h \n\nLog message:\nAlso do RSB refilling when context switching, after vmexits, and\nwhen vmlaunch or vmresume fails.\n\nFollow the lead of clang and the intel recommendation and do an lfence\nafter the pause in the speculation-stop path for retpoline, RSB refill,\nand meltover ASM bits.\n\nok kettenis@ deraadt@```\n\n+ &quot;Mitigation G-2&quot; for AMD processors:\n\n```CVSROOT: /cvs\nModule name:    src\nChanges by: brynet@cvs.openbsd.org  2018/07/23 17:25:03\n\nModified files:\n    sys/arch/amd64/amd64: identcpu.c \n    sys/arch/amd64/include: specialreg.h \n\nLog message:\nAdd &quot;Mitigation G-2&quot; per AMD's Whitepaper &quot;Software Techniques for\nManaging Speculation on AMD Processors&quot;\n\nBy setting MSR C001_1029[1]=1, LFENCE becomes a dispatch serializing\ninstruction.\n\nTested on AMD FX-4100 &quot;Bulldozer&quot;, and Linux guest in SVM vmd(8)\n\nok deraadt@ mlarkin@```\n***\n\n\n##Beastie Bits\n+ [HardenedBSD will stop supporting 10-STABLE on 10 August 2018](https://groups.google.com/a/hardenedbsd.org/forum/#!topic/users/xvU0g-g1l5U)\n+ [GSoC 2018 Reports: Integrate libFuzzer with the Basesystem, Part 2](https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_integrate_libfuzzer1)\n+ [ZFS Boot Environments at PBUG](https://vermaden.wordpress.com/2018/07/30/zfs-boot-environments-at-pbug/)\n+ [Second Editions versus the Publishing Business](https://blather.michaelwlucas.com/archives/3229)\n+ [Theo de Raadt on &quot;unveil(2) usage in base&quot;](https://undeadly.org/cgi?action=article;sid=20180728063716)\n+ [rtadvd(8) has been replaced by rad(8)](https://undeadly.org/cgi?action=article;sid=20180724072205)\n+ [BSD Users Stockholm Meetup #3](https://www.meetup.com/BSD-Users-Stockholm/events/253447019/)\n+ [Changes to NetBSD release support policy](https://blog.netbsd.org/tnf/entry/changes_to_netbsd_release_support)\n+ [The future of HAMMER1](http://lists.dragonflybsd.org/pipermail/users/2018-July/357832.html)\n***\n\n**Tarsnap**\n\n##Feedback/Questions\n+ Rodriguez - [A Question](http://dpaste.com/0Y1B75Q#wrap)\n+ Shane - [About ZFS Mostly](http://dpaste.com/32YGNBY#wrap)\n+ Leif - [ZFS less than 8gb](http://dpaste.com/2GY6HHC#wrap)\n+ Wayne - [ZFS vs EMC](http://dpaste.com/17PSCXC#wrap)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n</code></pre>","summary":"FreeBSD Foundation July Newsletter, a bunch of BSDCan trip reports, HardenedBSD Foundation status, FreeBSD and OSPFd, ZFS disk structure overview, and more Spectre mitigations in OpenBSD.","date_published":"2018-08-08T01:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/2975f51c-21d4-41df-bae9-4e3616147a50.mp3","mime_type":"audio/mp3","size_in_bytes":52903277,"duration_in_seconds":5272}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2354","title":"Episode 257: Great NetBSD 8 | BSD Now 257","url":"https://www.bsdnow.tv/257","content_text":"NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.\n\n\n##Headlines\n###NetBSD v8.0 Released\n\n\nThe NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system.\n\n\n\nThis release brings stability improvements, hundreds of bug fixes, and many new features.\n\n\n\n\nSome highlights of the NetBSD 8.0 release are:\n\n\nUSB stack rework, USB3 support added.\n\n\nIn-kernel audio mixer (audio_system(9)).\n\n\nReproducible builds (MKREPRO, see mk.conf(5)).\n\n\nFull userland debug information (MKDEBUG, see mk.conf(5)) available. While most install media do not come with them (for size reasons), the debug and xdebug sets can be downloaded and extracted as needed later. They provide full symbol information for all base system and X binaries and libraries and allow better error reporting and (userland) crash analysis.\n\n\nPaX MPROTECT (W^X) memory protection enforced by default on some architectures with fine-grained memory protection and suitable ELF formats: i386, amd64, evbarm, landisk.\n\n\nPaX ASLR (Address Space Layout Randomization) enabled by default on: i386, amd64, evbarm, landisk, sparc64.\n\n\nPosition independent executables by default for userland on: i386, amd64, arm, m68k, mips, sh3, sparc64.\n\n\nA new socket layer can(4) has been added for communication of devices on a CAN bus.\n\n\nA special pseudo interface ipsecif(4) for route-based VPNs has been added.\n\n\nParts of the network stack have been made MP-safe. The kernel option NET_MPSAFE is required to enable this.\n\n\nHardening of the network stack in general.\n\n\nVarious WAPBL (the NetBSD file system “log” option) stability and performance improvements.\n\n\nSpecific to i386 and amd64 CPUs:\n\n\nMeltdown mitigation: SVS (Separate Virtual Space), enabled by default.\n\n\nSpectreV2 mitigation: retpoline (support in gcc), used by default for kernels. Other hardware mitigations are also available.\n\n\nSpectreV4 mitigations available for Intel and AMD.\n\n\nPopSS workaround: user access to debug registers is turned off by default.\n\n\nLazy FPU saving disabled on vulnerable Intel CPUs (“eagerfpu”).\n\n\nSMAP support.\n\n\nImprovement and hardening of the memory layout: W^X, fewer writable pages, better consistency, better performance.\n\n\n(U)EFI bootloader.\n\n\nMany evbarm kernels now use FDT (flat device tree) information (loadable at boot time from an external file) for device configuration, the number of kernels has decreased but the number of boards has vastly increased.\n\n\nLots of updates to 3rd party software included:\n\n\nGCC 5.5 with support for Address Sanitizer and Undefined Behavior Sanitizer\n\n\nGDB 7.12\n\n\nGNU binutils 2.27\n\n\nClang/LLVM 3.8.1\n\n\nOpenSSH 7.6\n\n\nOpenSSL 1.0.2k\n\n\nmdocml 1.14.1\n\n\nacpica 20170303\n\n\nntp 4.2.8p11-o\n\n\ndhcpcd 7.0.6\n\n\nLua 5.3.4\n\n\n\n\n\n###Running FreeBSD on the ARM64 VPS from Scaleway\n\n\nI’ve been thinking about this 6 since 2017, but only yesterday signed up for an account and played around with the ARM64 offering.\nTurns out it’s pretty great! KVM boots into UEFI, there’s a local VirtIO disk attached, no NBD junk required. So we can definitely run FreeBSD.\nI managed to “depenguinate” a running instance, the notes are below. Would be great if Scaleway offered an official image instead :wink:\nFor some reason, unlike on x86 4, mounting additional volumes is not allowed 4 on ARM64 instances. So we’ll have to move the running Linux to a ramdisk using pivot_root and then we can do whatever to our one and only disk.\nSpin up an instance with Ubuntu Zesty and ssh in.\n\n\n\nPrepare the system and change the root to a tmpfs:\n\n\napt install gdisk\nmount -t tmpfs tmpfs /tmp\ncp -r /bin /sbin /etc /dev /root /home /lib /run /usr /var /tmp\nmkdir /tmp/proc /tmp/sys /tmp/oldroot\nmount /dev/vda /tmp/oldroot\nmount --make-rprivate /\npivot_root /tmp /tmp/oldroot\nfor i in dev proc sys run; do mount --move /oldroot/$i /$i; done\nsystemctl daemon-reload\nsystemctl restart sshd\n\n\n\nNow reconnect to ssh from a second terminal (note: rm the connection file if you use ControlPersist in ssh config), then exit the old session. Kill the old sshd process, restart or stop the rest of the stuff using the old disk:\n\n\npkill -f notty\nsed -ibak 's/RefuseManualStart.*$//g' /lib/systemd/system/dbus.service\nsystemctl daemon-reload\nsystemctl restart dbus\nsystemctl daemon-reexec\nsystemctl stop user@0 ntp cron systemd-logind\nsystemctl restart systemd-journald systemd-udevd\npkill agetty\npkill rsyslogd\n\n\n\nCheck that nothing is touching /oldroot:\n\n\nlsof | grep oldroot\n\n\n\nThere will probably be an old dbus-daemon, kill it.\nAnd finally, unmount the old root and overwrite the hard disk with a memstick image:\n\n\numount -R /oldroot\nwget https://download.freebsd.org/ftp/snapshots/arm64/aarch64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz\nxzcat FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz | dd if=/dev/stdin of=/dev/vda bs=1M\n\n\n\n(Look for the newest snapshot, don’t copy paste the July 19 link above if you’re reading this in the future. Actually maybe use a release instead of CURRENT…)\nNow, fix the GPT: move the secondary table to the end of the disk and resize the table.\nIt’s important to resize here, as FreeBSD does not do that and silently creates partitions that won’t persist across reboots\n\n\ngdisk /dev/vda\nx\ne\ns\n4\nw\ny\n\n\nAnd reboot. (You might actually want to hard reboot here: for some reason on the first reboot from Linux, pressing the any-key to enter the prompt in the loader hangs the console for me.)\n\nI didn’t have to go into the ESC menu and choose the local disk in the boot manager, it seems to boot from disk automatically.\n\nNow we’re in the FreeBSD EFI loader.\nFor some reason, the (recently fixed? 2) serial autodetection from EFI is not working correctly. Or something.\nSo you don’t get console output by default.\nTo fix, you have to run these commands in the boot loader command prompt:\n\nset console=comconsole,efi\nboot\n\n\nIgnore the warning about comconsole not being a valid console.\nSince there’s at least one (efi) that the loader thinks is valid, it sets the whole variable.)\n\n(UPD: shouldn’t be necessary in the next snapshot)\n\nNow it’s a regular installation process!\nWhen asked about partitioning, choose Shell, and manually add a partition and set up a root filesystem:\n\ngpart add -t freebsd-zfs -a 4k -l zroot vtbd0\nzpool create -R /mnt -O mountpoint=none -O atime=off zroot /dev/gpt/zroot\nzfs create -o canmount=off -o mountpoint=none zroot/ROOT\nzfs create -o mountpoint=/ zroot/ROOT/default\nzfs create -o mountpoint=/usr zroot/ROOT/default/usr\nzfs create -o mountpoint=/var zroot/ROOT/default/var\nzfs create -o mountpoint=/var/log zroot/ROOT/default/var/log\nzfs create -o mountpoint=/usr/home zroot/home\nzpool set bootfs=zroot/ROOT/default zroot\nexit\n\n\n(In this example, I set up ZFS with a beadm-compatible layout which allows me to use Boot Environments.)\n\nIn the post-install chroot shell, fix some configs like so:\n\necho 'zfs_load=\"YES\"' &gt;&gt; /boot/loader.conf\necho 'console=\"comconsole,efi\"' &gt;&gt; /boot/loader.conf\necho 'vfs.zfs.arc_max=\"512M\"' &gt;&gt; /boot/loader.conf\nsysrc zfs_enable=YES\nexit\n\n\n(Yeah, for some reason, the loader does not load zfs.ko’s dependency opensolaris.ko automatically here. idk what even. It does on my desktop and laptop.)\n\nNow you can reboot into the installed system!!\n\nHere’s how you can set up IPv6 (and root’s ssh key) auto configuration on boot:\n\nPkg bootstrap\npkg install curl\ncurl https://raw.githubusercontent.com/scaleway/image-tools/master/bases/overlay-common/usr/local/bin/scw-metadata &gt; /usr/local/bin/scw-metadata\nchmod +x /usr/local/bin/scw-metadata\necho '#\\!/bin/sh' &gt; /etc/rc.local\necho 'PATH=/usr/local/bin:$PATH' &gt;&gt; /etc/rc.local\necho 'eval $(scw-metadata)' &gt;&gt; /etc/rc.local\necho 'echo $SSH_PUBLIC_KEYS_0_KEY &gt; /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local\necho 'chmod 0400 /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local\necho 'ifconfig vtnet0 inet6 $IPV6_ADDRESS/$IPV6_NETMASK' &gt;&gt; /etc/rc.local\necho 'route -6 add default $IPV6_GATEWAY' &gt;&gt; /etc/rc.local\nmkdir /run\nmkdir /root/.ssh\nsh /etc/rc.local\n\n\n\nAnd to fix incoming TCP connections, configure the DHCP client to change the broadcast address:\n\n\necho 'interface \"vtnet0\" { supersede broadcast-address 255.255.255.255; }' &gt;&gt; /etc/dhclient.conf\nkillall dhclient\ndhclient vtnet0\n\n\nOther random notes:\nkeep in mind that -CURRENT snapshots come with a debugging kernel by default, which limits syscall performance by a lot, you might want to build your own 2 with config GENERIC-NODEBUG\nalso disable heavy malloc debugging features by running ln -s ‘abort:false,junk:false’ /etc/malloc.conf (yes that’s storing config in a symlink)\nyou can reuse the installer’s partition for swap\n\n\n\n\n** Digital Ocean **\nhttp://do.co/bsdnow\n\n###Easy encrypted backups on OpenBSD with base tools\n\n\nToday’s topic is “Encrypted backups” using only OpenBSD base tools. I am planning to write a bigger article later about backups but it’s a wide topic with a lot of software to cover and a lot of explanations about the differents uses cases, needs, issues an solutions. Here I will stick on explaining how to make reliable backups for an OpenBSD system (my laptop).\nWhat we need is the dump command (see man 8 dump for its man page). It’s an utility to make a backup for a filesystem, it can only make a backup of one filesystem at a time. On my laptop I only backup /home partition so this solution is suitable for me while still being easy.\nDump can do incremental backups, it means that it will only save what changed since the last backup of lower level. If you do not understand this, please refer to the dump man page.\nWhat is very interesting with dump is that it honors nodump flag which is an extended attribute of a FFS filesystem. One can use the command chflags nodump /home/solene/Downloads to tells dump not do save that folder (under some circumstances). By default, dump will not save thoses files, EXCEPT for a level 0 backup.\n\n\n\nImportant features of this backup solution:\nsave files with attributes, permissions and flags\ncan recreate a partition from a dump, restore files interactively, from a list or from its inode number (useful when you have files in lost+found)\none dump = one file\n\n\n\nMy process is to make a huge dump of level 0 and keep it on a remote server, then, once a week I make a level 1 backup which will contain everything changed since the last dump of level 0, and everyday I do a level 2 backup of my files. The level 2 will contain latest files and the files changing a lot, which are often the most interesting. The level 1 backup is important because it will offload a lot of changes for the level 2.\nLet me explain: let says my full backup is 60 GB, full of pictures, sources files, GUI applications data files etc… A level 1 backup will contain every new picture, new projects, new GUI files etc… since the full backup, which will produce bigger and bigger dump over time, usually it is only 100 MB to 1GB. As I don’t add new pictures everyday or use new software everyday, the level 2 will take care of most littles changes to my data, like source code edited, little works on files etc… The level 2 backup is really small, I try to keep it under 50 MB so I can easily send it on my remote server everyday.\nOne could you more dump level, up to level 9, but keep in mind that those are incremental. In my case, if I need to restore all my partition, I will need to use level 0, 1 and 2 to get up to latest backup state. If you want to restore a file deleted a few days ago, you need to remember in which level its latest version is.\nHistory note: dump was designed to be used with magnetic tapes.\n\n\n\nSee the article for the remainder of the article\n\n\n\n\n##News Roundup\n###Status of DFly server storage upgrades (Matt Dillon)\n\n\nLast month we did some storage upgrades, particularly of internet-facing machines for package and OS distribution.  Yesterday we did a number of additional upgrades, described below.  All using funds generously donated by everyone!\n\n\n\nThe main repository server received a 2TB SSD to replace the HDDs it was using before.  This will improve access to a number of things maintained by this server, including the mail archives, and gives the main repo server more breathing room for repository expansion.  Space was at a premium before.  Now there’s plenty.\n\n\n\nMonster, the quad socket opteron which we currently use as the database builder and repository that we export to our public grok service (grok.dragonflybsd.org) received a 512G SSD to add swap space for swapcache, to help cache the grok meta-data.  It now has 600GB of swapcache configured.  Over the next few weeks we will also be changing the grok updates to ping-pong between the two 4TB data drives it received in the last upgrade so we can do concurrent updates and web accesses without them tripping over each other performance-wise.\n\n\n\nThe main developer box, Leaf, received a 2TB SSD and we are currently in the midst of migrating all the developer accounts in /home and /build from its old HDDs to its new SSD.  This machine serves developer repos, developer web stuff, our home page and wiki, etc, so those will become snappier as well.\n\n\n\nHard drives are becoming real dinosaurs.  We still have a few left from the old days but in terms of active use the only HDDs we feel we really need to keep now are the ones we use for backups and grok data, owing to the amount of storage needed for those functions.\n\n\n\nFive years ago when we received the blade server that now sits in the colo, we had a small 256G SSD for root on every blade, and everything else used HDDs.  To make things operate smoothly, most of that 256G root SSD was assigned to swapcache (200G of it, in fact, in most cases).  Even just 2 years ago replacing all those HDDs with SSDs, even just the ones being used to actively serve data and support developers, would have been cost prohibitive.  But today it isn’t and the only HDDs we really need anywhere are for backups or certain very large bits of bulk data (aka the grok source repository and index).  The way things are going, even the backup drives will probably become SSDs over the next two years.\n\n\n\n\n###iX ad spot\nOSCON 2018 Recap\n\n\n\n###zpool checkpoints\n\n\nIn March, to FreeBSD landed a very interesting feature called ‘zpool checkpoints’. Before we jump straight into the topic, let’s take a step back and look at another ZFS feature called ‘snapshot’. Snapshot allows us to create an image of our single file systems. This gives us the option to modify data on the dataset without the fear of losing some data.\n\n\n\nA very good example of how to use ZFS snapshot is during an upgrade of database schema. Let us consider a situation where we have a few scripts which change our schema. Sometimes we are unable to upgrade in one transaction (for example, when we attempt to alter a table and then update it in single transaction). If our database is on dataset, we can just snapshot it, and if something goes wrong, simply rollback the file system to its previous state.\n\n\n\nThe problem with snapshot is that it works only on a single dataset. If we added some dataset, we wouldn’t then be able to create the snapshot which would rollback that operation. The same with changing the attributes of a dataset. If we change the compression on the dataset, we cannot rollback it. We would need to change that manually.\n\n\n\nAnother interesting problem involves upgrading the whole operating system when we upgrade system with a new ZFS version. What if we start upgrading our dataset and our kernel begins to crash? (If you use FreeBSD, I doubt you will ever have had that experience but still…). If we rollback to the old kernel, there is a chance the dataset will stop working because the new kernel doesn’t know how to use the new features.\n\n\n\nZpool checkpoints is the solution to all those problems. Instead of taking a single snapshot of the dataset, we can now take a snapshot of the whole pool. That means we will not only rollback the data but also all the metadata. If we rewind to the checkpoint, all our ZFS properties will be rolled back; the upgrade will be rolledback, and even the creation/deletion of the dataset, and the snapshot, will be rolledback.\n\n\n\nZpool Checkpoint has introduced a few simple functions:\nFor a creating checkpoint:\n\n\nzpool checkpoint &lt;pool&gt;\n\n\nRollbacks state to checkpoint and remove the checkpoint:\n\n\nzpool import -- rewind-to-checkpoint &lt;pool&gt;\n\n\nMount the pool read only - this does not rollback the data:\n\n\nzpool import --read-only=on --rewind-to-checkpoint\n\n\nRemove the checkpoint\n\n\nzpool checkpoint --discard &lt;pool&gt; or zpool checkpoint -d &lt;pool&gt;\n\n\nWith this powerful feature we need to remember some safety rules:\nScrub will work only on data that isn’t in checkpool.\nYou can’t remove vdev if you have a checkpoint.\nYou can’t split mirror.\nReguid will not work either.\nCreate a checkpoint when one of the disks is removed…\n\n\n\nFor me, this feature is incredibly useful, especially when upgrading an operating system, or when I need to experiment with additional data sets. If you speak Polish, I have some additional information for you. During the first Polish BSD user group meeting, I had the opportunity to give a short talk about this feature. Here you find the video of that talk, and here is the slideshow.\n\n\n\nI would like to offer my thanks to Serapheim Dimitropoulos for developing this feature, and for being so kind in sharing with me so many of its intricacies. If you are interested in knowing more about the technical details of this feature, you should check out Serapheim’s blog, and his video about checkpoints.\n\n\n\n\n###g2k18 Reports\n\n\ng2k18 hackathon report: Ingo Schwarze on sed(1) bugfixing with Martijn van Duren, and about other small userland stuff\ng2k18 hackathon report: Kenneth Westerback on dhcpd(8) fixes, disklabel(8) refactoring and more\ng2k18 Hackathon Report: Marc Espie on ports and packages progress\ng2k18 hackathon report: Antoine Jacoutot on porting\ng2k18 hackathon report: Matthieu Herrb on font caches and xenodm\ng2k18 hackathon report: Florian Obser on rtadvd(8) -&gt; rad(8) progress (actually, rewrite)\ng2k18 Hackathon Report: Klemens Nanni on improvements to route(8), pfctl(8), and mount(2)\ng2k18 hackathon report: Carlos Cardenas on vmm/vmd progress, LACP\ng2k18 hackathon report: Claudio Jeker on OpenBGPD developments\nPicture of the last day of the g2k18 hackathon in Ljubljana, Slovenia\n\n\n\n\n##Beastie Bits\n\n\nSomething blogged (on pkgsrcCon 2018)\nGSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1\nThere should be a global ‘awareness’ week for developers\nPolish BSD User Group – Upcoming Meeting: Aug 9th 2018\nLondon BSD User Group – Upcoming Meeting: Aug 14th 2018\nPhillip Smith’s collection of reasons why ZFS is better so that he does not have to repeat\nhimself all the time\nEuroBSDCon 2018: Sept 20-23rd in Romania – Register NOW!\nMeetBSD 2018: Oct 19-20 in Santa Clara, California. Call for Papers closes on Aug 12\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nDale - L2ARC recommendations &amp; drive age question\nTodd - ZFS &amp; S3\nefraim - License Poem\nHenrick - Yet another ZFS question\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.<br>\n<hr></p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.netbsd.org/releases/formal-8/NetBSD-8.0.html\">NetBSD v8.0 Released</a></p>\n\n<blockquote>\n<p>The NetBSD Project is pleased to announce NetBSD 8.0, the sixteenth major release of the NetBSD operating system.</p>\n</blockquote>\n\n<blockquote>\n<p>This release brings stability improvements, hundreds of bug fixes, and many new features.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Some highlights of the NetBSD 8.0 release are:</p>\n</li>\n<li>\n<p>USB stack rework, USB3 support added.</p>\n</li>\n<li>\n<p>In-kernel audio mixer (audio_system(9)).</p>\n</li>\n<li>\n<p>Reproducible builds (MKREPRO, see mk.conf(5)).</p>\n</li>\n<li>\n<p>Full userland debug information (MKDEBUG, see mk.conf(5)) available. While most install media do not come with them (for size reasons), the debug and xdebug sets can be downloaded and extracted as needed later. They provide full symbol information for all base system and X binaries and libraries and allow better error reporting and (userland) crash analysis.</p>\n</li>\n<li>\n<p>PaX MPROTECT (W^X) memory protection enforced by default on some architectures with fine-grained memory protection and suitable ELF formats: i386, amd64, evbarm, landisk.</p>\n</li>\n<li>\n<p>PaX ASLR (Address Space Layout Randomization) enabled by default on: i386, amd64, evbarm, landisk, sparc64.</p>\n</li>\n<li>\n<p>Position independent executables by default for userland on: i386, amd64, arm, m68k, mips, sh3, sparc64.</p>\n</li>\n<li>\n<p>A new socket layer can(4) has been added for communication of devices on a CAN bus.</p>\n</li>\n<li>\n<p>A special pseudo interface ipsecif(4) for route-based VPNs has been added.</p>\n</li>\n<li>\n<p>Parts of the network stack have been made MP-safe. The kernel option NET_MPSAFE is required to enable this.</p>\n</li>\n<li>\n<p>Hardening of the network stack in general.</p>\n</li>\n<li>\n<p>Various WAPBL (the NetBSD file system “log” option) stability and performance improvements.</p>\n</li>\n<li>\n<p>Specific to i386 and amd64 CPUs:</p>\n</li>\n<li>\n<p>Meltdown mitigation: SVS (Separate Virtual Space), enabled by default.</p>\n</li>\n<li>\n<p>SpectreV2 mitigation: retpoline (support in gcc), used by default for kernels. Other hardware mitigations are also available.</p>\n</li>\n<li>\n<p>SpectreV4 mitigations available for Intel and AMD.</p>\n</li>\n<li>\n<p>PopSS workaround: user access to debug registers is turned off by default.</p>\n</li>\n<li>\n<p>Lazy FPU saving disabled on vulnerable Intel CPUs (“eagerfpu”).</p>\n</li>\n<li>\n<p>SMAP support.</p>\n</li>\n<li>\n<p>Improvement and hardening of the memory layout: W^X, fewer writable pages, better consistency, better performance.</p>\n</li>\n<li>\n<p>(U)EFI bootloader.</p>\n</li>\n<li>\n<p>Many evbarm kernels now use FDT (flat device tree) information (loadable at boot time from an external file) for device configuration, the number of kernels has decreased but the number of boards has vastly increased.</p>\n</li>\n<li>\n<p>Lots of updates to 3rd party software included:</p>\n</li>\n<li>\n<p>GCC 5.5 with support for Address Sanitizer and Undefined Behavior Sanitizer</p>\n</li>\n<li>\n<p>GDB 7.12</p>\n</li>\n<li>\n<p>GNU binutils 2.27</p>\n</li>\n<li>\n<p>Clang/LLVM 3.8.1</p>\n</li>\n<li>\n<p>OpenSSH 7.6</p>\n</li>\n<li>\n<p>OpenSSL 1.0.2k</p>\n</li>\n<li>\n<p>mdocml 1.14.1</p>\n</li>\n<li>\n<p>acpica 20170303</p>\n</li>\n<li>\n<p>ntp 4.2.8p11-o</p>\n</li>\n<li>\n<p>dhcpcd 7.0.6</p>\n</li>\n<li>\n<p>Lua 5.3.4</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://community.online.net/t/freebsd-on-arm64/6678\">Running FreeBSD on the ARM64 VPS from Scaleway</a></p>\n\n<blockquote>\n<p>I’ve been thinking about this 6 since 2017, but only yesterday signed up for an account and played around with the ARM64 offering.<br>\nTurns out it’s pretty great! KVM boots into UEFI, there’s a local VirtIO disk attached, no NBD junk required. So we can definitely run FreeBSD.<br>\nI managed to “depenguinate” a running instance, the notes are below. Would be great if Scaleway offered an official image instead :wink:<br>\nFor some reason, unlike on x86 4, mounting additional volumes is not allowed 4 on ARM64 instances. So we’ll have to move the running Linux to a ramdisk using pivot_root and then we can do whatever to our one and only disk.<br>\nSpin up an instance with Ubuntu Zesty and ssh in.</p>\n</blockquote>\n\n<ul>\n<li>Prepare the system and change the root to a tmpfs:</li>\n</ul>\n\n<pre><code>apt install gdisk\nmount -t tmpfs tmpfs /tmp\ncp -r /bin /sbin /etc /dev /root /home /lib /run /usr /var /tmp\nmkdir /tmp/proc /tmp/sys /tmp/oldroot\nmount /dev/vda /tmp/oldroot\nmount --make-rprivate /\npivot_root /tmp /tmp/oldroot\nfor i in dev proc sys run; do mount --move /oldroot/$i /$i; done\nsystemctl daemon-reload\nsystemctl restart sshd\n</code></pre>\n\n<blockquote>\n<p>Now reconnect to ssh from a second terminal (note: rm the connection file if you use ControlPersist in ssh config), then exit the old session. Kill the old sshd process, restart or stop the rest of the stuff using the old disk:</p>\n</blockquote>\n\n<pre><code>pkill -f notty\nsed -ibak 's/RefuseManualStart.*$//g' /lib/systemd/system/dbus.service\nsystemctl daemon-reload\nsystemctl restart dbus\nsystemctl daemon-reexec\nsystemctl stop user@0 ntp cron systemd-logind\nsystemctl restart systemd-journald systemd-udevd\npkill agetty\npkill rsyslogd\n</code></pre>\n\n<blockquote>\n<p>Check that nothing is touching /oldroot:</p>\n</blockquote>\n\n<pre><code>lsof | grep oldroot\n</code></pre>\n\n<blockquote>\n<p>There will probably be an old dbus-daemon, kill it.<br>\nAnd finally, unmount the old root and overwrite the hard disk with a memstick image:</p>\n</blockquote>\n\n<pre><code>umount -R /oldroot\nwget https://download.freebsd.org/ftp/snapshots/arm64/aarch64/ISO-IMAGES/12.0/FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz\nxzcat FreeBSD-12.0-CURRENT-arm64-aarch64-20180719-r336479-mini-memstick.img.xz | dd if=/dev/stdin of=/dev/vda bs=1M\n</code></pre>\n\n<blockquote>\n<p>(Look for the newest snapshot, don’t copy paste the July 19 link above if you’re reading this in the future. Actually maybe use a release instead of CURRENT…)<br>\nNow, fix the GPT: move the secondary table to the end of the disk and resize the table.<br>\nIt’s important to resize here, as FreeBSD does not do that and silently creates partitions that won’t persist across reboots</p>\n</blockquote>\n\n<pre><code>gdisk /dev/vda\nx\ne\ns\n4\nw\ny\n</code></pre>\n\n<p>And reboot. (You might actually want to hard reboot here: for some reason on the first reboot from Linux, pressing the any-key to enter the prompt in the loader hangs the console for me.)</p>\n\n<p>I didn’t have to go into the ESC menu and choose the local disk in the boot manager, it seems to boot from disk automatically.</p>\n\n<p>Now we’re in the FreeBSD EFI loader.<br>\nFor some reason, the (recently fixed? 2) serial autodetection from EFI is not working correctly. Or something.<br>\nSo you don’t get console output by default.<br>\nTo fix, you have to run these commands in the boot loader command prompt:</p>\n\n<pre><code>set console=comconsole,efi\nboot\n</code></pre>\n\n<p>Ignore the warning about comconsole not being a valid console.<br>\nSince there’s at least one (efi) that the loader thinks is valid, it sets the whole variable.)</p>\n\n<p>(UPD: shouldn’t be necessary in the next snapshot)</p>\n\n<p>Now it’s a regular installation process!<br>\nWhen asked about partitioning, choose Shell, and manually add a partition and set up a root filesystem:</p>\n\n<pre><code>gpart add -t freebsd-zfs -a 4k -l zroot vtbd0\nzpool create -R /mnt -O mountpoint=none -O atime=off zroot /dev/gpt/zroot\nzfs create -o canmount=off -o mountpoint=none zroot/ROOT\nzfs create -o mountpoint=/ zroot/ROOT/default\nzfs create -o mountpoint=/usr zroot/ROOT/default/usr\nzfs create -o mountpoint=/var zroot/ROOT/default/var\nzfs create -o mountpoint=/var/log zroot/ROOT/default/var/log\nzfs create -o mountpoint=/usr/home zroot/home\nzpool set bootfs=zroot/ROOT/default zroot\nexit\n</code></pre>\n\n<p>(In this example, I set up ZFS with a beadm-compatible layout which allows me to use Boot Environments.)</p>\n\n<p>In the post-install chroot shell, fix some configs like so:</p>\n\n<pre><code>echo 'zfs_load=&quot;YES&quot;' &gt;&gt; /boot/loader.conf\necho 'console=&quot;comconsole,efi&quot;' &gt;&gt; /boot/loader.conf\necho 'vfs.zfs.arc_max=&quot;512M&quot;' &gt;&gt; /boot/loader.conf\nsysrc zfs_enable=YES\nexit\n</code></pre>\n\n<p>(Yeah, for some reason, the loader does not load zfs.ko’s dependency opensolaris.ko automatically here. idk what even. It does on my desktop and laptop.)</p>\n\n<p>Now you can reboot into the installed system!!</p>\n\n<p>Here’s how you can set up IPv6 (and root’s ssh key) auto configuration on boot:</p>\n\n<pre><code>Pkg bootstrap\npkg install curl\ncurl https://raw.githubusercontent.com/scaleway/image-tools/master/bases/overlay-common/usr/local/bin/scw-metadata &gt; /usr/local/bin/scw-metadata\nchmod +x /usr/local/bin/scw-metadata\necho '#\\!/bin/sh' &gt; /etc/rc.local\necho 'PATH=/usr/local/bin:$PATH' &gt;&gt; /etc/rc.local\necho 'eval $(scw-metadata)' &gt;&gt; /etc/rc.local\necho 'echo $SSH_PUBLIC_KEYS_0_KEY &gt; /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local\necho 'chmod 0400 /root/.ssh/authorized_keys' &gt;&gt; /etc/rc.local\necho 'ifconfig vtnet0 inet6 $IPV6_ADDRESS/$IPV6_NETMASK' &gt;&gt; /etc/rc.local\necho 'route -6 add default $IPV6_GATEWAY' &gt;&gt; /etc/rc.local\nmkdir /run\nmkdir /root/.ssh\nsh /etc/rc.local\n</code></pre>\n\n<blockquote>\n<p>And to fix incoming TCP connections, configure the DHCP client to change the broadcast address:</p>\n</blockquote>\n\n<p><code>echo 'interface &quot;vtnet0&quot; { supersede broadcast-address 255.255.255.255; }' &gt;&gt; /etc/dhclient.conf</code><br>\n<code>killall dhclient</code><br>\n<code>dhclient vtnet0</code></p>\n\n<ul>\n<li>Other random notes:</li>\n<li>keep in mind that -CURRENT snapshots come with a debugging kernel by default, which limits syscall performance by a lot, you might want to build your own 2 with config GENERIC-NODEBUG</li>\n<li>also disable heavy malloc debugging features by running ln -s ‘abort:false,junk:false’ /etc/malloc.conf (yes that’s storing config in a symlink)</li>\n<li>you can reuse the installer’s partition for swap</li>\n</ul>\n\n<p><hr></p>\n\n<p>** Digital Ocean **<br>\n<a href=\"http://do.co/bsdnow\">http://do.co/bsdnow</a></p>\n\n<p>###<a href=\"https://dataswamp.org/~solene/2018-06-26-openbsd-easy-backup.html\">Easy encrypted backups on OpenBSD with base tools</a></p>\n\n<blockquote>\n<p>Today’s topic is “Encrypted backups” using only OpenBSD base tools. I am planning to write a bigger article later about backups but it’s a wide topic with a lot of software to cover and a lot of explanations about the differents uses cases, needs, issues an solutions. Here I will stick on explaining how to make reliable backups for an OpenBSD system (my laptop).<br>\nWhat we need is the dump command (see man 8 dump for its man page). It’s an utility to make a backup for a filesystem, it can only make a backup of one filesystem at a time. On my laptop I only backup /home partition so this solution is suitable for me while still being easy.<br>\nDump can do incremental backups, it means that it will only save what changed since the last backup of lower level. If you do not understand this, please refer to the dump man page.<br>\nWhat is very interesting with dump is that it honors nodump flag which is an extended attribute of a FFS filesystem. One can use the command chflags nodump /home/solene/Downloads to tells dump not do save that folder (under some circumstances). By default, dump will not save thoses files, EXCEPT for a level 0 backup.</p>\n</blockquote>\n\n<ul>\n<li>Important features of this backup solution:</li>\n<li>save files with attributes, permissions and flags</li>\n<li>can recreate a partition from a dump, restore files interactively, from a list or from its inode number (useful when you have files in lost+found)</li>\n<li>one dump = one file</li>\n</ul>\n\n<blockquote>\n<p>My process is to make a huge dump of level 0 and keep it on a remote server, then, once a week I make a level 1 backup which will contain everything changed since the last dump of level 0, and everyday I do a level 2 backup of my files. The level 2 will contain latest files and the files changing a lot, which are often the most interesting. The level 1 backup is important because it will offload a lot of changes for the level 2.<br>\nLet me explain: let says my full backup is 60 GB, full of pictures, sources files, GUI applications data files etc… A level 1 backup will contain every new picture, new projects, new GUI files etc… since the full backup, which will produce bigger and bigger dump over time, usually it is only 100 MB to 1GB. As I don’t add new pictures everyday or use new software everyday, the level 2 will take care of most littles changes to my data, like source code edited, little works on files etc… The level 2 backup is really small, I try to keep it under 50 MB so I can easily send it on my remote server everyday.<br>\nOne could you more dump level, up to level 9, but keep in mind that those are incremental. In my case, if I need to restore all my partition, I will need to use level 0, 1 and 2 to get up to latest backup state. If you want to restore a file deleted a few days ago, you need to remember in which level its latest version is.<br>\nHistory note: dump was designed to be used with magnetic tapes.</p>\n</blockquote>\n\n<ul>\n<li>See the article for the remainder of the article</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"http://lists.dragonflybsd.org/pipermail/users/2018-July/357809.html\">Status of DFly server storage upgrades (Matt Dillon)</a></p>\n\n<blockquote>\n<p>Last month we did some storage upgrades, particularly of internet-facing machines for package and OS distribution.  Yesterday we did a number of additional upgrades, described below.  All using funds generously donated by everyone!</p>\n</blockquote>\n\n<blockquote>\n<p>The main repository server received a 2TB SSD to replace the HDDs it was using before.  This will improve access to a number of things maintained by this server, including the mail archives, and gives the main repo server more breathing room for repository expansion.  Space was at a premium before.  Now there’s plenty.</p>\n</blockquote>\n\n<blockquote>\n<p>Monster, the quad socket opteron which we currently use as the database builder and repository that we export to our public grok service (<a href=\"http://grok.dragonflybsd.org\">grok.dragonflybsd.org</a>) received a 512G SSD to add swap space for swapcache, to help cache the grok meta-data.  It now has 600GB of swapcache configured.  Over the next few weeks we will also be changing the grok updates to ping-pong between the two 4TB data drives it received in the last upgrade so we can do concurrent updates and web accesses without them tripping over each other performance-wise.</p>\n</blockquote>\n\n<blockquote>\n<p>The main developer box, Leaf, received a 2TB SSD and we are currently in the midst of migrating all the developer accounts in /home and /build from its old HDDs to its new SSD.  This machine serves developer repos, developer web stuff, our home page and wiki, etc, so those will become snappier as well.</p>\n</blockquote>\n\n<blockquote>\n<p>Hard drives are becoming real dinosaurs.  We still have a few left from the old days but in terms of active use the only HDDs we feel we really need to keep now are the ones we use for backups and grok data, owing to the amount of storage needed for those functions.</p>\n</blockquote>\n\n<blockquote>\n<p>Five years ago when we received the blade server that now sits in the colo, we had a small 256G SSD for root on every blade, and everything else used HDDs.  To make things operate smoothly, most of that 256G root SSD was assigned to swapcache (200G of it, in fact, in most cases).  Even just 2 years ago replacing all those HDDs with SSDs, even just the ones being used to actively serve data and support developers, would have been cost prohibitive.  But today it isn’t and the only HDDs we really need anywhere are for backups or certain very large bits of bulk data (aka the grok source repository and index).  The way things are going, even the backup drives will probably become SSDs over the next two years.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###iX ad spot<br>\n<a href=\"https://www.ixsystems.com/blog/oscon2018/\">OSCON 2018 Recap</a></p>\n\n<p><hr></p>\n\n<p>###<a href=\"http://oshogbo.vexillium.org/blog/46/\">zpool checkpoints</a></p>\n\n<blockquote>\n<p>In March, to FreeBSD landed a very interesting feature called ‘zpool checkpoints’. Before we jump straight into the topic, let’s take a step back and look at another ZFS feature called ‘snapshot’. Snapshot allows us to create an image of our single file systems. This gives us the option to modify data on the dataset without the fear of losing some data.</p>\n</blockquote>\n\n<blockquote>\n<p>A very good example of how to use ZFS snapshot is during an upgrade of database schema. Let us consider a situation where we have a few scripts which change our schema. Sometimes we are unable to upgrade in one transaction (for example, when we attempt to alter a table and then update it in single transaction). If our database is on dataset, we can just snapshot it, and if something goes wrong, simply rollback the file system to its previous state.</p>\n</blockquote>\n\n<blockquote>\n<p>The problem with snapshot is that it works only on a single dataset. If we added some dataset, we wouldn’t then be able to create the snapshot which would rollback that operation. The same with changing the attributes of a dataset. If we change the compression on the dataset, we cannot rollback it. We would need to change that manually.</p>\n</blockquote>\n\n<blockquote>\n<p>Another interesting problem involves upgrading the whole operating system when we upgrade system with a new ZFS version. What if we start upgrading our dataset and our kernel begins to crash? (If you use FreeBSD, I doubt you will ever have had that experience but still…). If we rollback to the old kernel, there is a chance the dataset will stop working because the new kernel doesn’t know how to use the new features.</p>\n</blockquote>\n\n<blockquote>\n<p>Zpool checkpoints is the solution to all those problems. Instead of taking a single snapshot of the dataset, we can now take a snapshot of the whole pool. That means we will not only rollback the data but also all the metadata. If we rewind to the checkpoint, all our ZFS properties will be rolled back; the upgrade will be rolledback, and even the creation/deletion of the dataset, and the snapshot, will be rolledback.</p>\n</blockquote>\n\n<ul>\n<li>Zpool Checkpoint has introduced a few simple functions:</li>\n<li>For a creating checkpoint:</li>\n</ul>\n\n<p><code>zpool checkpoint &lt;pool&gt;</code></p>\n\n<ul>\n<li>Rollbacks state to checkpoint and remove the checkpoint:</li>\n</ul>\n\n<p><code>zpool import -- rewind-to-checkpoint &lt;pool&gt;</code></p>\n\n<ul>\n<li>Mount the pool read only - this does not rollback the data:</li>\n</ul>\n\n<p><code>zpool import --read-only=on --rewind-to-checkpoint</code></p>\n\n<ul>\n<li>Remove the checkpoint</li>\n</ul>\n\n<p><code>zpool checkpoint --discard &lt;pool&gt; or zpool checkpoint -d &lt;pool&gt;</code></p>\n\n<ul>\n<li>With this powerful feature we need to remember some safety rules:</li>\n<li>Scrub will work only on data that isn’t in checkpool.</li>\n<li>You can’t remove vdev if you have a checkpoint.</li>\n<li>You can’t split mirror.</li>\n<li>Reguid will not work either.</li>\n<li>Create a checkpoint when one of the disks is removed…</li>\n</ul>\n\n<blockquote>\n<p>For me, this feature is incredibly useful, especially when upgrading an operating system, or when I need to experiment with additional data sets. If you speak Polish, I have some additional information for you. During the first Polish BSD user group meeting, I had the opportunity to give a short talk about this feature. Here you find the video of that talk, and here is the slideshow.</p>\n</blockquote>\n\n<blockquote>\n<p>I would like to offer my thanks to Serapheim Dimitropoulos for developing this feature, and for being so kind in sharing with me so many of its intricacies. If you are interested in knowing more about the technical details of this feature, you should check out Serapheim’s blog, and his video about checkpoints.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###g2k18 Reports</p>\n\n<ul>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180728110010\">g2k18 hackathon report: Ingo Schwarze on sed(1) bugfixing with Martijn van Duren, and about other small userland stuff</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180726184322\">g2k18 hackathon report: Kenneth Westerback on dhcpd(8) fixes, disklabel(8) refactoring and more</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180716193511\">g2k18 Hackathon Report: Marc Espie on ports and packages progress</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180716202456\">g2k18 hackathon report: Antoine Jacoutot on porting</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180717074543\">g2k18 hackathon report: Matthieu Herrb on font caches and xenodm</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180718060313\">g2k18 hackathon report: Florian Obser on rtadvd(8) -&gt; rad(8) progress (actually, rewrite)</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180719100833\">g2k18 Hackathon Report: Klemens Nanni on improvements to route(8), pfctl(8), and mount(2)</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180721053002\">g2k18 hackathon report: Carlos Cardenas on vmm/vmd progress, LACP</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180721053011\">g2k18 hackathon report: Claudio Jeker on OpenBGPD developments</a></li>\n<li><a href=\"https://i.imgur.com/3t3cJF6.jpg\">Picture of the last day of the g2k18 hackathon in Ljubljana, Slovenia</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.geeklan.co.uk/?p=2266\">Something blogged (on pkgsrcCon 2018)</a></li>\n<li><a href=\"https://blog.netbsd.org/tnf/entry/gsoc_2018_reports_configuration_files\">GSoC 2018 Reports: Configuration files versioning in pkgsrc, Part 1</a></li>\n<li><a href=\"https://bsd.network/@mulander/100390180499807877\">There should be a global ‘awareness’ week for developers</a></li>\n<li><a href=\"https://bsd-pl.org/en\">Polish BSD User Group – Upcoming Meeting: Aug 9th 2018</a></li>\n<li><a href=\"http://ukopenbsdusers.saneusergroup.org.uk/pipermail/uk-openbsd-users/2018-July/000430.html\">London BSD User Group – Upcoming Meeting: Aug 14th 2018</a></li>\n<li><a href=\"http://whyzfsisbetter.com/\">Phillip Smith’s collection of reasons why ZFS is better so that he does not have to repeat<br>\nhimself all the time</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/registration-is-open/\">EuroBSDCon 2018: Sept 20-23rd in Romania – Register NOW!</a></li>\n<li><a href=\"https://www.meetbsd.com/call-for-papers/\">MeetBSD 2018: Oct 19-20 in Santa Clara, California. Call for Papers closes on Aug 12</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Dale - <a href=\"http://dpaste.com/1K452Y7#wrap\">L2ARC recommendations &amp; drive age question</a></li>\n<li>Todd - <a href=\"http://dpaste.com/0WWHZ3E#wrap\">ZFS &amp; S3</a></li>\n<li>efraim - <a href=\"http://dpaste.com/36YP39B#wrap\">License Poem</a></li>\n<li>Henrick - <a href=\"http://dpaste.com/21D1KWA#wrap\">Yet another ZFS question</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"NetBSD 8.0 available, FreeBSD on Scaleway’s ARM64 VPS, encrypted backups with OpenBSD, Dragonfly server storage upgrade, zpool checkpoints, g2k18 hackathon reports, and more.","date_published":"2018-08-02T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/7928575b-6648-4fac-ba50-4d24e56a7b9b.mp3","mime_type":"audio/mp3","size_in_bytes":50094426,"duration_in_seconds":4991}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2304","title":"Episode 256: Because Computers | BSD Now 2^8","url":"https://www.bsdnow.tv/256","content_text":"FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.\n\nWin\n\nCelebrate our 256th episode with us. You can win a Mogics Power Bagel (not sponsored).\n\nTo enter, go find the 4 episodes we did in December of 2017. In the opening, find the 4 letters in the bookshelf behind me. They spell different words in each of the 4 episodes. Send us these words in order to feedback@bsdnow.tv with the subject “bsdnow256” until August 8th, 2018 18:00 UTC and we’ll randomly draw the winner on the live show. We’ll then contact you to ship the item.\nOnly one item to win. All decisions are final. Better luck next time.\n\nHeadlines\n\nBattle of the Schedulers: FreeBSD ULE vs. Linux CFS\n\nIntroduction\nThis paper analyzes the impact on application performance of the design and implementation choices made in two widely used open-source schedulers: ULE, the default FreeBSD scheduler, and CFS, the default Linux scheduler. We compare ULE and CFS in otherwise identical circumstances. We have ported ULE to Linux, and use it to schedule all threads that are normally scheduled by CFS. We compare the performance of a large suite of applications on the modified kernel running ULE and on the standard Linux kernel running CFS. The observed performance differences are solely the result of scheduling decisions, and do not reflect differences in other subsystems between FreeBSD and Linux. There is no overall winner. On many workloads the two schedulers perform similarly, but for some workloads there are significant and even surprising differences. ULE may cause starvation, even when executing a single application with identical threads, but this starvation may actually lead to better application performance for some workloads. The more complex load balancing mechanism of CFS reacts more quickly to workload changes, but ULE achieves better load balance in the long run.\nOperating system kernel schedulers are responsible for maintaining high utilization of hardware resources (CPU cores, memory, I/O devices) while providing fast response time to latency-sensitive applications. They have to react to workload changes, and handle large numbers of cores and threads with minimal overhead [12]. This paper provides a comparison between the default schedulers of two of the most widely deployed open-source operating systems: the Completely Fair Scheduler (CFS) used in Linux, and the ULE scheduler used in FreeBSD. Our goal is not to declare an overall winner.\nIn fact, we find that for some workloads ULE is better and for others CFS is better. Instead, our goal is to illustrate how differences in the design and the implementation of the two schedulers are reflected in application performance under different workloads. ULE and CFS are both designed to schedule large numbers of threads on large multicore machines. Scalability considerations have led both schedulers to adopt per-core run-queues. On a context switch, a core accesses only its local run-queue to find the next thread to run. Periodically and at select times, e.g., when a thread wakes up, both ULE and CFS perform load balancing, i.e., they try to balance the amount of work waiting in the run-queues of different cores.\nULE and CFS, however, differ greatly in their design and implementation choices. FreeBSD ULE is a simple scheduler (2,950 lines of code in FreeBSD 11.1), while Linux CFS is much more complex (17,900 lines of code in the latest LTS Linux kernel, Linux 4.9). FreeBSD run-queues are FIFO. For load balancing, FreeBSD strives to even out the number of threads per core. In Linux, a core decides which thread to run next based on prior execution time, priority, and perceived cache behavior of the threads in its runqueue. Instead of evening out the number of threads between cores, Linux strives to even out the average amount of pending work.\n\nPerformance analysis\nWe now analyze the impact of the per-core scheduling on the performance of 37 applications. We define “performance” as follows: for database workloads and NAS applications, we compare the number of operations per second, and for the other applications we compare “execution time”. The higher the “performance”, the better a scheduler performs. Figure 5 presents the performance difference between CFS and ULE on a single core, with percentages above 0 meaning that the application executes faster with ULE than CFS.\nOverall, the scheduler has little influence on most workloads. Indeed, most applications use threads that all perform the same work, thus both CFS and ULE endup scheduling all of the threads in a round-robin fashion. The average performance difference is 1.5%, in favor of ULE. Still, scimark is 36% slower on ULE than CFS, and apache is 40% faster on ULE than CFS. Scimark is a single-threaded Java application. It launches one compute thread, and the Java runtime executes other Java system threads in the background (for the garbage collector, I/O, etc.).\nWhen the application is executed with ULE, the compute thread can be delayed, because Java system threads are considered interactive and get priority over the computation thread. The apache workload consists of two applications: the main server (httpd) running 100 threads, and ab, a single-threaded load injector.\nThe performance difference between ULE and CFS is explained by different choices regarding thread preemption. In ULE, full preemption is disabled, while CFS preempts the running thread when the thread that has just been woken up has a vruntime that is much smaller than the vruntime of the currently executing thread (1ms difference in practice). In CFS, ab is preempted 2 million times during the benchmark, while it never preempted with ULE.\nThis behavior is explained as follows: ab starts by sending 100 requests to the httpd server, and then waits for the server to answer. When ab is woken up, it checks which requests have been processed and sends new requests to the server. Since ab is single-threaded, all requests sent to the server are sent sequentially. In ULE, ab is able to send as many new requests as it has received responses. In CFS, every request sent by ab wakes up a httpd thread, which preempts ab.\n\nConclusion\nScheduling threads on a multicore machine is hard. In this paper, we perform a fair comparison of the design choices of two widely used schedulers: the ULE scheduler from FreeBSD and CFS from Linux. We show that they behave differently even on simple workloads, and that no scheduler performs better than the other on all workloads.\n\nOpenBSD 6.3 on Tuxedo InfinityBook\n\nDisclaimer:\nI came across the Tuxedo Computers InfinityBook last year at the Open! Conference where Tuxedo had a small booth. Previously they came to my attention since they’re a member of the OSB Alliance on whose board I’m a member. Furthermore Tuxedo Computers are a sponsor of the OSBAR which I’m part of the organizational team.\n\nOpenBSD on the Tuxedo InfinityBook\nI’ve asked the guys over at Tuxedo Computers whether they would be interested to have some tests with *BSD done and that I could test drive one of their machines and give feedback on what works and what does not - and possibly look into it.+\n\nWithin a few weeks they shipped me a machine and last week the InfinityBook Pro 14” arrived. Awesome. Thanks already to the folks at Tuxedo Computers. The machine arrived accompanied by lot’s of swag :)\n\nThe InfinityBook is a very nice machine and allows a wide range of configuration. The configuration that was shipped to me:\n\nIntel Core i7-8550U\n1x 16GB RAM 2400Mhz Crucial Ballistix Sport LT\n250 GB Samsung 860 EVO (M.2 SATAIII)\n\nI used a USB-stick to boot install63.fs and re-installed the machine with OpenBSD. Full dmesg.\n\nThe installation went flawlessly, the needed intel firmware is being installed after installation automatically via fw_update(1).\n\nOut of the box the graphics works and once installed the machine presents the login.\n\nVideo\nWhen X starts the display is turned off for some reason. You will need to hit fn+f12 (the key with the moon on it) then the display will go on. Aside from that little nit, X works just fine and presents one the expected resolution.\n\nExternal video is working just fine as well. Either via hdmi output or via the mini displayport connector.\n\nThe buttons for adjusting brightness (fn+f8 and fn+f9) are not working. Instead one has to use wsconsctl(8) to adjust the brightness.\n\nNetworking\nThe infinityBook has built-in ethernet, driven by re(4) And for the wireless interface the iwm(4) driver is being used. Both work as expected.\n\nACPI\nNeither suspend nor hibernate work. Reporting of battery status is bogus as well. Some of the keyboard function keys work:\n\nLCD on/off works (fn+f2)\nKeyboard backlight dimming works (fn+f4)\nVolume (fn+f5 / fn+f6) works\n\nSound\nThe azalia chipset is being used for audio processing. Works as expected, volume can be controlled via buttons (fn+f5, fn+f6) or via mixerctl.\n\nTouchpad\nCan be controlled via wsconsctl(8).\nSo far I must say, that the InfinityBook makes a nice machine - and I’m enjoying working with it.\n\niXsystems\niXsystems - Its all NAS\n\nHow ZFS makes things like ‘zfs diff’ report filenames efficiently\n\nAs a copy on write (file)system, ZFS can use the transaction group (txg) numbers that are embedded in ZFS block pointers to efficiently find the differences between two txgs; this is used in, for example, ZFS bookmarks. However, as I noted at the end of my entry on block pointers, this doesn’t give us a filesystem level difference; instead, it essentially gives us a list of inodes (okay, dnodes) that changed.\nIn theory, turning an inode or dnode number into the path to a file is an expensive operation; you basically have to search the entire filesystem until you find it. In practice, if you’ve ever run ‘zfs diff’, you’ve likely noticed that it runs pretty fast. Nor is this the only place that ZFS quickly turns dnode numbers into full paths, as it comes up in ‘zpool status’ reports about permanent errors. At one level, zfs diff and zpool status do this so rapidly because they ask the ZFS code in the kernel to do it for them. At another level, the question is how the kernel’s ZFS code can be so fast.\nThe interesting and surprising answer is that ZFS cheats, in a way that makes things very fast when it works and almost always works in normal filesystems and with normal usage patterns. The cheat is that ZFS dnodes record their parent’s object number.\nIf you’re familiar with the twists and turns of Unix filesystems, you’re now wondering how ZFS deals with hardlinks, which can cause a file to be in several directories at once and so have several parents (and then it can be removed from some of the directories). The answer is that ZFS doesn’t; a dnode only ever tracks a single parent, and ZFS accepts that this parent information can be inaccurate. I’ll quote the comment in zfs_obj_to_pobj:\nWhen a link is removed [the file’s] parent pointer is not changed and will be invalid. There are two cases where a link is removed but the file stays around, when it goes to the delete queue and when there are additional links.\nBefore I get into the details, I want to say that I appreciate the brute force elegance of this cheat. The practical reality is that most Unix files today don’t have extra hardlinks, and when they do most hardlinks are done in ways that won’t break ZFS’s parent stuff. The result is that ZFS has picked an efficient implementation that works almost all of the time; in my opinion, the great benefit we get from having it around are more than worth the infrequent cases where it fails or malfunctions. Both zfs diff and having filenames show up in zpool status permanent error reports are very useful (and there may be other cases where this gets used).\nThe current details are that any time you hardlink a file to somewhere or rename it, ZFS updates the file’s parent to point to the new directory. Often this will wind up with a correct parent even after all of the dust settles; for example, a common pattern is to write a file to an initial location, hardlink it to its final destination, and then remove the initial location version. In this case, the parent will be correct and you’ll get the right name.\n\nNews Roundup\n\nWhat is FreeBSD? Why Should You Choose It Over Linux?\n\nNot too long ago I wondered if and in what situations FreeBSD could be faster than Linux and we received a good amount of informative feedback. So far, Linux rules the desktop space and FreeBSD rules the server space.\n\nIn the meantime, though, what exactly is FreeBSD? And at what times should you choose it over a GNU/Linux installation? Let’s tackle these questions.\n\nFreeBSD is a free and open source derivative of BSD (Berkeley Software Distribution) with a focus on speed, stability, security, and consistency, among other features. It has been developed and maintained by a large community ever since its initial release many years ago on November 1, 1993.\n\nBSD is the version of UNIX® that was developed at the University of California in Berkeley. And being a free and open source version, “Free” being a prefix to BSD is a no-brainer.\n\nWhat’s FreeBSD Good For?\n\nFreeBSD offers a plethora of advanced features and even boasts some not available in some commercial Operating Systems. It makes an excellent Internet and Intranet server thanks to its robust network services that allow it to maximize memory and work with heavy loads to deliver and maintain good response times for thousands of simultaneous user processes.\n\nFreeBSD runs a huge number of applications with ease. At the moment, it has over 32,000 ported applications and libraries with support for desktop, server, and embedded environments. with that being said, let me also add that FreeBSD is excellent for working with advanced embedded platforms. Mail and web appliances, timer servers, routers, MIPS hardware platforms, etc. You name it!\n\nFreeBSD is available to install in several ways and there are directions to follow for any method you want to use; be it via CD-ROM, over a network using NFS or FTP, or DVD.\n\nFreeBSD is easy to contribute to and all you have to do is to locate the section of the FreeBSD code base to modify and carefully do a neat job. Potential contributors are also free to improve on its artwork and documentation, among other project aspects.\n\nFreeBSD is backed by the FreeBSD Foundation, a non-profit organization that you can contribute to financially and all direct contributions are tax deductible.\n\nFreeBSD’s license allows users to incorporate the use of proprietary software which is ideal for companies interested in generating revenues. Netflix, for example, could cite this as one of the reasons for using FreeBSD servers.\n\nWhy Should You Choose It over Linux?\n\nFrom what I’ve gathered about both FreeBSD and Linux, FreeBSD has a better performance on servers than Linux does. Yes, its packaged applications are configured to offer better a performance than Linux and it is usually running fewer services by default, there really isn’t a way to certify which is faster because the answer is dependent on the running hardware and applications and how the system is tuned.\n\nFreeBSD is reportedly more secure than Linux because of the way the whole project is developed and maintained.\n\nUnlike with Linux, the FreeBSD project is controlled by a large community of developers around the world who fall into any of these categories; core team, contributors, and committers.\n\nFreeBSD is much easier to learn and use because there aren’t a thousand and one distros to choose from with different package managers, DEs, etc.\n\nFreeBSD is more convenient to contribute to because it is the entire OS that is preserved and not just the kernel and a repo as is the case with Linux. You can easily access all of its versions since they are sorted by release numbers.\n\nApart from the many documentations and guides that you can find online, FreeBSD has a single official documentation wherein you can find the solution to virtually any issue you will come across. So, you’re sure to find it resourceful.\n\nFreeBSD has close to no software issues compared to Linux because it has Java, is capable of running Windows programs using Wine, and can run .NET programs using Mono.\n\nFreeBSD’s ports/packages system allows you to compile software with specific configurations, thereby avoiding conflicting dependency and version issues.\n\nBoth the FreeBSD and GNU/Linux project are always receiving updates. The platform you decide to go with is largely dependent on what you want to use it for, your technical know-how, willingness to learn new stuff, and ultimately your preference.\nWhat is your take on the topic? For what reasons would you choose FreeBSD over Linux if you would? Let us know what you think about both platforms in the comments section below.\n\nPS4 5.05 BPF Double Free Kernel Exploit Writeup\n\nIntroduction\nWelcome to the 5.0x kernel exploit write-up. A few months ago, a kernel vulnerability was discovered by qwertyoruiopz and an exploit was released for BPF which involved crafting an out-of-bounds (OOB) write via use-after-free (UAF) due to the lack of proper locking. It was a fun bug, and a very trivial exploit. Sony then removed the write functionality from BPF, so that exploit was patched. However, the core issue still remained (being the lack of locking). A very similar race condition still exists in BPF past 4.55, which we will go into detail below on. The full source of the exploit can be found here.\nThis bug is no longer accessible however past 5.05 firmware, because the BPF driver has finally been blocked from unprivileged processes - WebKit can no longer open it. Sony also introduced a new security mitigation in 5.0x firmwares to prevent the stack pointer from pointing into user space, however we’ll go more in detail on this a bit further down.\n\nAssumptions\nSome assumptions are made of the reader’s knowledge for the writeup. The avid reader should have a basic understanding of how memory allocators work - more specifically, how malloc() and free() allocate and deallocate memory respectively. They should also be aware that devices can be issued commands concurrently, as in, one command could be received while another one is being processed via threading. An understanding of C, x86, and exploitation basics is also very helpful, though not necessarily required.\n\nBackground\nThis section contains some helpful information to those newer to exploitation, or are unfamiliar with device drivers, or various exploit techniques such as heap spraying and race conditions. Feel free to skip to the “A Tale of Two Free()'s” section if you’re already familiar with this material.\n\nWhat Are Drivers?\nThere are a few ways that applications can directly communicate with the operating system. One of which is system calls, which there are over 600 of in the PS4 kernel, ~500 of which are FreeBSD - the rest are Sony-implemented. Another method is through something called “Device Drivers”. Drivers are typically used to bridge the gap between software and hardware devices (usb drives, keyboard/mouse, webcams, etc) - though they can also be used just for software purposes.\nThere are a few operations that a userland application can perform on a driver (if it has sufficient permissions) to interface with it after opening it. In some instances, one can read from it, write to it, or in some cases, issue more complex commands to it via the ioctl() system call. The handlers for these commands are implemented in kernel space - this is important, because any bugs that could be exploited in an ioctl handler can be used as a privilege escalation straight to ring0 - typically the most privileged state.\nDrivers are often the more weaker points of an operating system for attackers, because sometimes these drivers are written by developers who don’t understand how the kernel works, or the drivers are older and thus not wise to newer attack methods.\n\nThe BPF Device Driver\nIf we take a look around inside of WebKit’s sandbox, we’ll find a /dev directory. While this may seem like the root device driver path, it’s a lie. Many of the drivers that the PS4 has are not exposed to this directory, but rather only ones that are needed for WebKit’s operation (for the most part). For some reason though, BPF (aka. the “Berkely Packet Filter”) device is not only exposed to WebKit’s sandbox - it also has the privileges to open the device as R/W. This is very odd, because on most systems this driver is root-only (and for good reason). If you want to read more into this, refer to my previous write-up with 4.55FW.\n\nWhat Are Packet Filters?\nBelow is an excerpt from the 4.55 bpfwrite writeup.\nSince the bug is directly in the filter system, it is important to know the basics of what packet filters are. Filters are essentially sets of pseudo-instructions that are parsed by bpf_filter() (which are ran when packets are received). While the pseudo-instruction set is fairly minimal, it allows you to do things like perform basic arithmetic operations and copy values around inside it’s buffer. Breaking down the BPF VM in it’s entirety is far beyond the scope of this write-up, just know that the code produced by it is ran in kernel mode - this is why read/write access to /dev/bpf should be privileged.\n\nRace Conditions\nRace conditions occur when two processes/threads try to access a shared resource at the same time without mutual exclusion. The problem was ultimately solved by introducing concepts such as the “mutex” or “lock”. The idea is when one thread/process tries to access a resource, it will first acquire a lock, access it, then unlock it once it’s finished. If another thread/process tries to access it while the other has the lock, it will wait until the other thread is finished. This works fairly well - when it’s used properly.\nLocking is hard to get right, especially when you try to implement fine-grained locking for performance. One single instruction or line of code outside the locking window could introduce a race condition. Not all race conditions are exploitable, but some are (such as this one) - and they can give an attacker very powerful bugs to work with.\n\nHeap Spraying\nThe process of heap spraying is fairly simple - allocate a bunch of memory and fill it with controlled data in a loop and pray your allocation doesn’t get stolen from underneath you. It’s a very useful technique when exploiting something such as a use-after-free(), as you can use it to get controlled data into your target object’s backing memory.\nBy extension, it’s useful to do this for a double free() as well, because once we have a stale reference, we can use a heap spray to control the data. Since the object will be marked “free” - the allocator will eventually provide us with control over this memory, even though something else is still using it. That is, unless, something else has already stolen the pointer from you and corrupts it - then you’ll likely get a system crash, and that’s no fun. This is one factor that adds to the variance of exploits, and typically, the smaller the object, the more likely this is to happen.\n\nFollow the link to read more of the article\nDigitalOcean\nhttp://do.co/bsdnow\n\nOpenBSD gains Wi-Fi “auto-join”\n\nIn a change which is bound to be welcomed widely, -current has gained “auto-join” for Wi-Fi networks. Peter Hessler (phessler@) has been working on this for quite some time and he wrote about it in his p2k18 hackathon report. He has committed the work from the g2k18 hackathon in Ljubljana:\n\nCVSROOT:    /cvs\nModule name:    src\nChanges by: phessler@cvs.openbsd.org    2018/07/11 14:18:09\n\nModified files:\n    sbin/ifconfig  : ifconfig.8 ifconfig.c \n    sys/net80211   : ieee80211_ioctl.c ieee80211_ioctl.h \n                     ieee80211_node.c ieee80211_node.h \n                     ieee80211_var.h \n\nLog message:\nIntroduce 'auto-join' to the wifi 802.11 stack.\n\nThis allows a system to remember which ESSIDs it wants to connect to, any\nrelevant security configuration, and switch to it when the network we are\ncurrently connected to is no longer available.\nWorks when connecting and switching between WPA2/WPA1/WEP/clear encryptions.\n\nexample hostname.if:\njoin home wpakey password\njoin work wpakey mekmitasdigoat\njoin open-lounge\njoin cafe wpakey cafe2018\njoin \"wepnetwork\" nwkey \"12345\"\ndhcp\ninet6 autoconf\nup\n\nOK stsp@ reyk@\nand enthusiasm from every hackroom I've been in for the last 3 years\nThe usage should be clear from the commit message, but basically you ‘join’ all the networks you want to auto-join as you would previously use ‘nwid’ to connect to one specific network. Then the kernel will join the network that’s actually in range and do the rest automagically for you. When you move out of range of that network you lose connectivity until you come in range of the original (where things will continue to work as you’ve been used to) or one of the other networks (where you will associate and then get a new lease).\n\nThanks to Peter for working on this feature - something many a Wi-Fi using OpenBSD user will be able to benefit from.\n\nFreeBSD Jails the hard way\n\nThere are many great options for managing FreeBSD Jails. iocage, warden and ez-jail aim to streamline the process and make it quick an easy to get going. But sometimes the tools built right into the OS are overlooked.\n\nThis post goes over what is involved in creating and managing jails using only the tools built into FreeBSD.\n\nFor this guide, I’m going to be putting my jails in /usr/local/jails.\n\nI’ll start with a very simple, isolated jail. Then I’ll go over how to use ZFS snapshots, and lastly nullfs mounts to share the FreeBSD base files with multiple jails.\n\nI’ll also show some examples of how to use the templating power of jail.conf to apply similar settings to all your jails.\n\nFull Jail\nMake a directory for the jail, or a zfs dataset if you prefer.\nDownload the FreeBSD base files, and any other parts of FreeBSD you want. In this example I’ll include the 32 bit libraries as well.\nUpdate your FreeBSD base install.\nVerify your download. We’re downloading these archives over FTP after all, we should confirm that this download is valid and not tampered with. The freebsd-update IDS command verifies the installation using a PGP key which is in your base system, which was presumably installed with an ISO that you verified using the FreeBSD signed checksums. Admittedly this step is a bit of paranoia, but I think it’s prudent.\nMake sure you jail has the right timezone and dns servers and a hostname in rc.conf.\nEdit jail.conf with the details about your jail.\nStart and login to your jail.\n11 commands and a config file, but this is the most tedious way to make a jail. With a little bit of templating it can be even easier. So I’ll start by making a template. Making a template is basically the same as steps 1, 2 and 3 above, but with a different destination folder, I’ll condense them here.\n\nCreating a template\nCreate a template or a ZFS dataset. If you’d like to use the zfs clone method of deploying templates, you’ll need to create a zfs dataset instead of a folder.\nUpdate your template with freebsd-update.\nVerify your install\nAnd that’s it, now you have a fully up to date jail template. If you’ve made this template with zfs, you can easily deploy it using zfs snapshots.\n\nDeploying a template with ZFS snapshots\nCreate a snapshot. My last freebsd-update to my template brought it to patch level 17, so I’ll call my snapshot p10.\nClone the snapshot to a new jail.\nConfigure the jail hostname.\nAdd the jail definition to jail.conf, make sure you have the global jail settings from jail.conf listed in the fulljail example.\nStart the jail.\nThe downside with the zfs approach is that each jail is now a fully independent, and if you need to update your jails, you have to update them all individually. By sharing a template using nullfs mounts you can have only one copy of the base system that only needs to be updated once.\n\nFollow the link to see the rest of the article about\nThin jails using NullFS mounts\nSimplifying jail.conf\nHopefully this has helped you understand the process of how to create and manage FreeBSD jails without tools that abstract away all the details. Those tools are often quite useful, but there is always benefit in learning to do things the hard way. And in this case, the hard way doesn’t seem to be that hard after all.\n\nBeastie Bits\n\nMeetup in Zurich #4, July edition (July 19) – Which you likely missed, but now you know to look for the August edition!\nThe next two BSD-PL User group meetings in Warsaw have been scheduled for July 30th and Aug 9th @ 1830 CEST – Submit your topic proposals now\nLinux Geek Books - Humble Bundle\nExtend loader(8) geli support to all architectures and all disk-like devices\nUpgrading from a bootpool to a single encrypted pool – skip the gptzfsboot part, and manually update your EFI partition with loader.efi\nThe pkgsrc 2018Q2 for Illumos is available with 18500+ binary packages\nNetBSD ARM64 Images Available with SMP for RPi3 / NanoPi / Pine64 Boards\nRecently released CDE 2.3.0 running on Tribblix (Illumos)\nAn Interview With Tech &amp; Science Fiction Author Michael W Lucas\nA reminder : MeetBSD CFP\nEuroBSDCon talk acceptances have gone out, and once the tutorials are confirmed, registration will open. That will likely have happened by time you see this episode, so go register! See you in Romania\nTarsnap\n\nFeedback/Questions\n\nWilyarti - Adblocked on FreeBSD Continued…\nAndrew - A Question and a Story\nMatthew - Thanks\nBrian - PCI-E Controller\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv","content_html":"<p>FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.</p>\n\n<h2>Win</h2>\n\n<p>Celebrate our 256th episode with us. You can win a Mogics Power Bagel (not sponsored).</p>\n\n<p>To enter, go find the 4 episodes we did in December of 2017. In the opening, find the 4 letters in the bookshelf behind me. They spell different words in each of the 4 episodes. Send us these words in order to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a> with the subject “bsdnow256” until August 8th, 2018 18:00 UTC and we’ll randomly draw the winner on the live show. We’ll then contact you to ship the item.<br>\nOnly one item to win. All decisions are final. Better luck next time.</p>\n\n<h2>Headlines</h2>\n\n<h3>Battle of the Schedulers: FreeBSD ULE vs. Linux CFS</h3>\n\n<p>Introduction<br>\nThis paper analyzes the impact on application performance of the design and implementation choices made in two widely used open-source schedulers: ULE, the default FreeBSD scheduler, and CFS, the default Linux scheduler. We compare ULE and CFS in otherwise identical circumstances. We have ported ULE to Linux, and use it to schedule all threads that are normally scheduled by CFS. We compare the performance of a large suite of applications on the modified kernel running ULE and on the standard Linux kernel running CFS. The observed performance differences are solely the result of scheduling decisions, and do not reflect differences in other subsystems between FreeBSD and Linux. There is no overall winner. On many workloads the two schedulers perform similarly, but for some workloads there are significant and even surprising differences. ULE may cause starvation, even when executing a single application with identical threads, but this starvation may actually lead to better application performance for some workloads. The more complex load balancing mechanism of CFS reacts more quickly to workload changes, but ULE achieves better load balance in the long run.<br>\nOperating system kernel schedulers are responsible for maintaining high utilization of hardware resources (CPU cores, memory, I/O devices) while providing fast response time to latency-sensitive applications. They have to react to workload changes, and handle large numbers of cores and threads with minimal overhead [12]. This paper provides a comparison between the default schedulers of two of the most widely deployed open-source operating systems: the Completely Fair Scheduler (CFS) used in Linux, and the ULE scheduler used in FreeBSD. Our goal is not to declare an overall winner.<br>\nIn fact, we find that for some workloads ULE is better and for others CFS is better. Instead, our goal is to illustrate how differences in the design and the implementation of the two schedulers are reflected in application performance under different workloads. ULE and CFS are both designed to schedule large numbers of threads on large multicore machines. Scalability considerations have led both schedulers to adopt per-core run-queues. On a context switch, a core accesses only its local run-queue to find the next thread to run. Periodically and at select times, e.g., when a thread wakes up, both ULE and CFS perform load balancing, i.e., they try to balance the amount of work waiting in the run-queues of different cores.<br>\nULE and CFS, however, differ greatly in their design and implementation choices. FreeBSD ULE is a simple scheduler (2,950 lines of code in FreeBSD 11.1), while Linux CFS is much more complex (17,900 lines of code in the latest LTS Linux kernel, Linux 4.9). FreeBSD run-queues are FIFO. For load balancing, FreeBSD strives to even out the number of threads per core. In Linux, a core decides which thread to run next based on prior execution time, priority, and perceived cache behavior of the threads in its runqueue. Instead of evening out the number of threads between cores, Linux strives to even out the average amount of pending work.</p>\n\n<p>Performance analysis<br>\nWe now analyze the impact of the per-core scheduling on the performance of 37 applications. We define “performance” as follows: for database workloads and NAS applications, we compare the number of operations per second, and for the other applications we compare “execution time”. The higher the “performance”, the better a scheduler performs. Figure 5 presents the performance difference between CFS and ULE on a single core, with percentages above 0 meaning that the application executes faster with ULE than CFS.<br>\nOverall, the scheduler has little influence on most workloads. Indeed, most applications use threads that all perform the same work, thus both CFS and ULE endup scheduling all of the threads in a round-robin fashion. The average performance difference is 1.5%, in favor of ULE. Still, scimark is 36% slower on ULE than CFS, and apache is 40% faster on ULE than CFS. Scimark is a single-threaded Java application. It launches one compute thread, and the Java runtime executes other Java system threads in the background (for the garbage collector, I/O, etc.).<br>\nWhen the application is executed with ULE, the compute thread can be delayed, because Java system threads are considered interactive and get priority over the computation thread. The apache workload consists of two applications: the main server (httpd) running 100 threads, and ab, a single-threaded load injector.<br>\nThe performance difference between ULE and CFS is explained by different choices regarding thread preemption. In ULE, full preemption is disabled, while CFS preempts the running thread when the thread that has just been woken up has a vruntime that is much smaller than the vruntime of the currently executing thread (1ms difference in practice). In CFS, ab is preempted 2 million times during the benchmark, while it never preempted with ULE.<br>\nThis behavior is explained as follows: ab starts by sending 100 requests to the httpd server, and then waits for the server to answer. When ab is woken up, it checks which requests have been processed and sends new requests to the server. Since ab is single-threaded, all requests sent to the server are sent sequentially. In ULE, ab is able to send as many new requests as it has received responses. In CFS, every request sent by ab wakes up a httpd thread, which preempts ab.</p>\n\n<p>Conclusion<br>\nScheduling threads on a multicore machine is hard. In this paper, we perform a fair comparison of the design choices of two widely used schedulers: the ULE scheduler from FreeBSD and CFS from Linux. We show that they behave differently even on simple workloads, and that no scheduler performs better than the other on all workloads.</p>\n\n<h3>OpenBSD 6.3 on Tuxedo InfinityBook</h3>\n\n<p>Disclaimer:<br>\nI came across the Tuxedo Computers InfinityBook last year at the Open! Conference where Tuxedo had a small booth. Previously they came to my attention since they’re a member of the OSB Alliance on whose board I’m a member. Furthermore Tuxedo Computers are a sponsor of the OSBAR which I’m part of the organizational team.</p>\n\n<p>OpenBSD on the Tuxedo InfinityBook<br>\nI’ve asked the guys over at Tuxedo Computers whether they would be interested to have some tests with *BSD done and that I could test drive one of their machines and give feedback on what works and what does not - and possibly look into it.+</p>\n\n<p>Within a few weeks they shipped me a machine and last week the InfinityBook Pro 14” arrived. Awesome. Thanks already to the folks at Tuxedo Computers. The machine arrived accompanied by lot’s of swag :)</p>\n\n<p>The InfinityBook is a very nice machine and allows a wide range of configuration. The configuration that was shipped to me:</p>\n\n<p>Intel Core i7-8550U<br>\n1x 16GB RAM 2400Mhz Crucial Ballistix Sport LT<br>\n250 GB Samsung 860 EVO (M.2 SATAIII)</p>\n\n<p>I used a USB-stick to boot install63.fs and re-installed the machine with OpenBSD. Full dmesg.</p>\n\n<p>The installation went flawlessly, the needed intel firmware is being installed after installation automatically via fw_update(1).</p>\n\n<p>Out of the box the graphics works and once installed the machine presents the login.</p>\n\n<p>Video<br>\nWhen X starts the display is turned off for some reason. You will need to hit fn+f12 (the key with the moon on it) then the display will go on. Aside from that little nit, X works just fine and presents one the expected resolution.</p>\n\n<p>External video is working just fine as well. Either via hdmi output or via the mini displayport connector.</p>\n\n<p>The buttons for adjusting brightness (fn+f8 and fn+f9) are not working. Instead one has to use wsconsctl(8) to adjust the brightness.</p>\n\n<p>Networking<br>\nThe infinityBook has built-in ethernet, driven by re(4) And for the wireless interface the iwm(4) driver is being used. Both work as expected.</p>\n\n<p>ACPI<br>\nNeither suspend nor hibernate work. Reporting of battery status is bogus as well. Some of the keyboard function keys work:</p>\n\n<p>LCD on/off works (fn+f2)<br>\nKeyboard backlight dimming works (fn+f4)<br>\nVolume (fn+f5 / fn+f6) works</p>\n\n<p>Sound<br>\nThe azalia chipset is being used for audio processing. Works as expected, volume can be controlled via buttons (fn+f5, fn+f6) or via mixerctl.</p>\n\n<p>Touchpad<br>\nCan be controlled via wsconsctl(8).<br>\nSo far I must say, that the InfinityBook makes a nice machine - and I’m enjoying working with it.</p>\n\n<p>iXsystems<br>\niXsystems - Its all NAS</p>\n\n<h3>How ZFS makes things like ‘zfs diff’ report filenames efficiently</h3>\n\n<p>As a copy on write (file)system, ZFS can use the transaction group (txg) numbers that are embedded in ZFS block pointers to efficiently find the differences between two txgs; this is used in, for example, ZFS bookmarks. However, as I noted at the end of my entry on block pointers, this doesn’t give us a filesystem level difference; instead, it essentially gives us a list of inodes (okay, dnodes) that changed.<br>\nIn theory, turning an inode or dnode number into the path to a file is an expensive operation; you basically have to search the entire filesystem until you find it. In practice, if you’ve ever run ‘zfs diff’, you’ve likely noticed that it runs pretty fast. Nor is this the only place that ZFS quickly turns dnode numbers into full paths, as it comes up in ‘zpool status’ reports about permanent errors. At one level, zfs diff and zpool status do this so rapidly because they ask the ZFS code in the kernel to do it for them. At another level, the question is how the kernel’s ZFS code can be so fast.<br>\nThe interesting and surprising answer is that ZFS cheats, in a way that makes things very fast when it works and almost always works in normal filesystems and with normal usage patterns. The cheat is that ZFS dnodes record their parent’s object number.<br>\nIf you’re familiar with the twists and turns of Unix filesystems, you’re now wondering how ZFS deals with hardlinks, which can cause a file to be in several directories at once and so have several parents (and then it can be removed from some of the directories). The answer is that ZFS doesn’t; a dnode only ever tracks a single parent, and ZFS accepts that this parent information can be inaccurate. I’ll quote the comment in zfs_obj_to_pobj:<br>\nWhen a link is removed [the file’s] parent pointer is not changed and will be invalid. There are two cases where a link is removed but the file stays around, when it goes to the delete queue and when there are additional links.<br>\nBefore I get into the details, I want to say that I appreciate the brute force elegance of this cheat. The practical reality is that most Unix files today don’t have extra hardlinks, and when they do most hardlinks are done in ways that won’t break ZFS’s parent stuff. The result is that ZFS has picked an efficient implementation that works almost all of the time; in my opinion, the great benefit we get from having it around are more than worth the infrequent cases where it fails or malfunctions. Both zfs diff and having filenames show up in zpool status permanent error reports are very useful (and there may be other cases where this gets used).<br>\nThe current details are that any time you hardlink a file to somewhere or rename it, ZFS updates the file’s parent to point to the new directory. Often this will wind up with a correct parent even after all of the dust settles; for example, a common pattern is to write a file to an initial location, hardlink it to its final destination, and then remove the initial location version. In this case, the parent will be correct and you’ll get the right name.</p>\n\n<h2>News Roundup</h2>\n\n<h3>What is FreeBSD? Why Should You Choose It Over Linux?</h3>\n\n<p>Not too long ago I wondered if and in what situations FreeBSD could be faster than Linux and we received a good amount of informative feedback. So far, Linux rules the desktop space and FreeBSD rules the server space.</p>\n\n<p>In the meantime, though, what exactly is FreeBSD? And at what times should you choose it over a GNU/Linux installation? Let’s tackle these questions.</p>\n\n<p>FreeBSD is a free and open source derivative of BSD (Berkeley Software Distribution) with a focus on speed, stability, security, and consistency, among other features. It has been developed and maintained by a large community ever since its initial release many years ago on November 1, 1993.</p>\n\n<p>BSD is the version of UNIX® that was developed at the University of California in Berkeley. And being a free and open source version, “Free” being a prefix to BSD is a no-brainer.</p>\n\n<p>What’s FreeBSD Good For?</p>\n\n<p>FreeBSD offers a plethora of advanced features and even boasts some not available in some commercial Operating Systems. It makes an excellent Internet and Intranet server thanks to its robust network services that allow it to maximize memory and work with heavy loads to deliver and maintain good response times for thousands of simultaneous user processes.</p>\n\n<p>FreeBSD runs a huge number of applications with ease. At the moment, it has over 32,000 ported applications and libraries with support for desktop, server, and embedded environments. with that being said, let me also add that FreeBSD is excellent for working with advanced embedded platforms. Mail and web appliances, timer servers, routers, MIPS hardware platforms, etc. You name it!</p>\n\n<p>FreeBSD is available to install in several ways and there are directions to follow for any method you want to use; be it via CD-ROM, over a network using NFS or FTP, or DVD.</p>\n\n<p>FreeBSD is easy to contribute to and all you have to do is to locate the section of the FreeBSD code base to modify and carefully do a neat job. Potential contributors are also free to improve on its artwork and documentation, among other project aspects.</p>\n\n<p>FreeBSD is backed by the FreeBSD Foundation, a non-profit organization that you can contribute to financially and all direct contributions are tax deductible.</p>\n\n<p>FreeBSD’s license allows users to incorporate the use of proprietary software which is ideal for companies interested in generating revenues. Netflix, for example, could cite this as one of the reasons for using FreeBSD servers.</p>\n\n<p>Why Should You Choose It over Linux?</p>\n\n<p>From what I’ve gathered about both FreeBSD and Linux, FreeBSD has a better performance on servers than Linux does. Yes, its packaged applications are configured to offer better a performance than Linux and it is usually running fewer services by default, there really isn’t a way to certify which is faster because the answer is dependent on the running hardware and applications and how the system is tuned.</p>\n\n<p>FreeBSD is reportedly more secure than Linux because of the way the whole project is developed and maintained.</p>\n\n<p>Unlike with Linux, the FreeBSD project is controlled by a large community of developers around the world who fall into any of these categories; core team, contributors, and committers.</p>\n\n<p>FreeBSD is much easier to learn and use because there aren’t a thousand and one distros to choose from with different package managers, DEs, etc.</p>\n\n<p>FreeBSD is more convenient to contribute to because it is the entire OS that is preserved and not just the kernel and a repo as is the case with Linux. You can easily access all of its versions since they are sorted by release numbers.</p>\n\n<p>Apart from the many documentations and guides that you can find online, FreeBSD has a single official documentation wherein you can find the solution to virtually any issue you will come across. So, you’re sure to find it resourceful.</p>\n\n<p>FreeBSD has close to no software issues compared to Linux because it has Java, is capable of running Windows programs using Wine, and can run .NET programs using Mono.</p>\n\n<p>FreeBSD’s ports/packages system allows you to compile software with specific configurations, thereby avoiding conflicting dependency and version issues.</p>\n\n<p>Both the FreeBSD and GNU/Linux project are always receiving updates. The platform you decide to go with is largely dependent on what you want to use it for, your technical know-how, willingness to learn new stuff, and ultimately your preference.<br>\nWhat is your take on the topic? For what reasons would you choose FreeBSD over Linux if you would? Let us know what you think about both platforms in the comments section below.</p>\n\n<h3>PS4 5.05 BPF Double Free Kernel Exploit Writeup</h3>\n\n<p>Introduction<br>\nWelcome to the 5.0x kernel exploit write-up. A few months ago, a kernel vulnerability was discovered by qwertyoruiopz and an exploit was released for BPF which involved crafting an out-of-bounds (OOB) write via use-after-free (UAF) due to the lack of proper locking. It was a fun bug, and a very trivial exploit. Sony then removed the write functionality from BPF, so that exploit was patched. However, the core issue still remained (being the lack of locking). A very similar race condition still exists in BPF past 4.55, which we will go into detail below on. The full source of the exploit can be found here.<br>\nThis bug is no longer accessible however past 5.05 firmware, because the BPF driver has finally been blocked from unprivileged processes - WebKit can no longer open it. Sony also introduced a new security mitigation in 5.0x firmwares to prevent the stack pointer from pointing into user space, however we’ll go more in detail on this a bit further down.</p>\n\n<p>Assumptions<br>\nSome assumptions are made of the reader’s knowledge for the writeup. The avid reader should have a basic understanding of how memory allocators work - more specifically, how malloc() and free() allocate and deallocate memory respectively. They should also be aware that devices can be issued commands concurrently, as in, one command could be received while another one is being processed via threading. An understanding of C, x86, and exploitation basics is also very helpful, though not necessarily required.</p>\n\n<p>Background<br>\nThis section contains some helpful information to those newer to exploitation, or are unfamiliar with device drivers, or various exploit techniques such as heap spraying and race conditions. Feel free to skip to the “A Tale of Two Free()&#39;s” section if you’re already familiar with this material.</p>\n\n<p>What Are Drivers?<br>\nThere are a few ways that applications can directly communicate with the operating system. One of which is system calls, which there are over 600 of in the PS4 kernel, ~500 of which are FreeBSD - the rest are Sony-implemented. Another method is through something called “Device Drivers”. Drivers are typically used to bridge the gap between software and hardware devices (usb drives, keyboard/mouse, webcams, etc) - though they can also be used just for software purposes.<br>\nThere are a few operations that a userland application can perform on a driver (if it has sufficient permissions) to interface with it after opening it. In some instances, one can read from it, write to it, or in some cases, issue more complex commands to it via the ioctl() system call. The handlers for these commands are implemented in kernel space - this is important, because any bugs that could be exploited in an ioctl handler can be used as a privilege escalation straight to ring0 - typically the most privileged state.<br>\nDrivers are often the more weaker points of an operating system for attackers, because sometimes these drivers are written by developers who don’t understand how the kernel works, or the drivers are older and thus not wise to newer attack methods.</p>\n\n<p>The BPF Device Driver<br>\nIf we take a look around inside of WebKit’s sandbox, we’ll find a /dev directory. While this may seem like the root device driver path, it’s a lie. Many of the drivers that the PS4 has are not exposed to this directory, but rather only ones that are needed for WebKit’s operation (for the most part). For some reason though, BPF (aka. the “Berkely Packet Filter”) device is not only exposed to WebKit’s sandbox - it also has the privileges to open the device as R/W. This is very odd, because on most systems this driver is root-only (and for good reason). If you want to read more into this, refer to my previous write-up with 4.55FW.</p>\n\n<p>What Are Packet Filters?<br>\nBelow is an excerpt from the 4.55 bpfwrite writeup.<br>\nSince the bug is directly in the filter system, it is important to know the basics of what packet filters are. Filters are essentially sets of pseudo-instructions that are parsed by bpf_filter() (which are ran when packets are received). While the pseudo-instruction set is fairly minimal, it allows you to do things like perform basic arithmetic operations and copy values around inside it’s buffer. Breaking down the BPF VM in it’s entirety is far beyond the scope of this write-up, just know that the code produced by it is ran in kernel mode - this is why read/write access to /dev/bpf should be privileged.</p>\n\n<p>Race Conditions<br>\nRace conditions occur when two processes/threads try to access a shared resource at the same time without mutual exclusion. The problem was ultimately solved by introducing concepts such as the “mutex” or “lock”. The idea is when one thread/process tries to access a resource, it will first acquire a lock, access it, then unlock it once it’s finished. If another thread/process tries to access it while the other has the lock, it will wait until the other thread is finished. This works fairly well - when it’s used properly.<br>\nLocking is hard to get right, especially when you try to implement fine-grained locking for performance. One single instruction or line of code outside the locking window could introduce a race condition. Not all race conditions are exploitable, but some are (such as this one) - and they can give an attacker very powerful bugs to work with.</p>\n\n<p>Heap Spraying<br>\nThe process of heap spraying is fairly simple - allocate a bunch of memory and fill it with controlled data in a loop and pray your allocation doesn’t get stolen from underneath you. It’s a very useful technique when exploiting something such as a use-after-free(), as you can use it to get controlled data into your target object’s backing memory.<br>\nBy extension, it’s useful to do this for a double free() as well, because once we have a stale reference, we can use a heap spray to control the data. Since the object will be marked “free” - the allocator will eventually provide us with control over this memory, even though something else is still using it. That is, unless, something else has already stolen the pointer from you and corrupts it - then you’ll likely get a system crash, and that’s no fun. This is one factor that adds to the variance of exploits, and typically, the smaller the object, the more likely this is to happen.</p>\n\n<p>Follow the link to read more of the article<br>\nDigitalOcean<br>\n<a href=\"http://do.co/bsdnow\" rel=\"nofollow\">http://do.co/bsdnow</a></p>\n\n<h3>OpenBSD gains Wi-Fi “auto-join”</h3>\n\n<p>In a change which is bound to be welcomed widely, -current has gained “auto-join” for Wi-Fi networks. Peter Hessler (phessler@) has been working on this for quite some time and he wrote about it in his p2k18 hackathon report. He has committed the work from the g2k18 hackathon in Ljubljana:</p>\n\n<p>CVSROOT:    /cvs<br>\nModule name:    src<br>\nChanges by: <a href=\"mailto:phessler@cvs.openbsd.org\" rel=\"nofollow\">phessler@cvs.openbsd.org</a>    2018/07/11 14:18:09</p>\n\n<p>Modified files:<br>\n    sbin/ifconfig  : ifconfig.8 ifconfig.c <br>\n    sys/net80211   : ieee80211_ioctl.c ieee80211_ioctl.h <br>\n                     ieee80211_node.c ieee80211_node.h <br>\n                     ieee80211_var.h </p>\n\n<p>Log message:<br>\nIntroduce &#39;auto-join&#39; to the wifi 802.11 stack.</p>\n\n<p>This allows a system to remember which ESSIDs it wants to connect to, any<br>\nrelevant security configuration, and switch to it when the network we are<br>\ncurrently connected to is no longer available.<br>\nWorks when connecting and switching between WPA2/WPA1/WEP/clear encryptions.</p>\n\n<p>example hostname.if:<br>\njoin home wpakey password<br>\njoin work wpakey mekmitasdigoat<br>\njoin open-lounge<br>\njoin cafe wpakey cafe2018<br>\njoin &quot;wepnetwork&quot; nwkey &quot;12345&quot;<br>\ndhcp<br>\ninet6 autoconf<br>\nup</p>\n\n<p>OK stsp@ reyk@<br>\nand enthusiasm from every hackroom I&#39;ve been in for the last 3 years<br>\nThe usage should be clear from the commit message, but basically you ‘join’ all the networks you want to auto-join as you would previously use ‘nwid’ to connect to one specific network. Then the kernel will join the network that’s actually in range and do the rest automagically for you. When you move out of range of that network you lose connectivity until you come in range of the original (where things will continue to work as you’ve been used to) or one of the other networks (where you will associate and then get a new lease).</p>\n\n<p>Thanks to Peter for working on this feature - something many a Wi-Fi using OpenBSD user will be able to benefit from.</p>\n\n<h3>FreeBSD Jails the hard way</h3>\n\n<p>There are many great options for managing FreeBSD Jails. iocage, warden and ez-jail aim to streamline the process and make it quick an easy to get going. But sometimes the tools built right into the OS are overlooked.</p>\n\n<p>This post goes over what is involved in creating and managing jails using only the tools built into FreeBSD.</p>\n\n<p>For this guide, I’m going to be putting my jails in /usr/local/jails.</p>\n\n<p>I’ll start with a very simple, isolated jail. Then I’ll go over how to use ZFS snapshots, and lastly nullfs mounts to share the FreeBSD base files with multiple jails.</p>\n\n<p>I’ll also show some examples of how to use the templating power of jail.conf to apply similar settings to all your jails.</p>\n\n<p>Full Jail<br>\nMake a directory for the jail, or a zfs dataset if you prefer.<br>\nDownload the FreeBSD base files, and any other parts of FreeBSD you want. In this example I’ll include the 32 bit libraries as well.<br>\nUpdate your FreeBSD base install.<br>\nVerify your download. We’re downloading these archives over FTP after all, we should confirm that this download is valid and not tampered with. The freebsd-update IDS command verifies the installation using a PGP key which is in your base system, which was presumably installed with an ISO that you verified using the FreeBSD signed checksums. Admittedly this step is a bit of paranoia, but I think it’s prudent.<br>\nMake sure you jail has the right timezone and dns servers and a hostname in rc.conf.<br>\nEdit jail.conf with the details about your jail.<br>\nStart and login to your jail.<br>\n11 commands and a config file, but this is the most tedious way to make a jail. With a little bit of templating it can be even easier. So I’ll start by making a template. Making a template is basically the same as steps 1, 2 and 3 above, but with a different destination folder, I’ll condense them here.</p>\n\n<p>Creating a template<br>\nCreate a template or a ZFS dataset. If you’d like to use the zfs clone method of deploying templates, you’ll need to create a zfs dataset instead of a folder.<br>\nUpdate your template with freebsd-update.<br>\nVerify your install<br>\nAnd that’s it, now you have a fully up to date jail template. If you’ve made this template with zfs, you can easily deploy it using zfs snapshots.</p>\n\n<p>Deploying a template with ZFS snapshots<br>\nCreate a snapshot. My last freebsd-update to my template brought it to patch level 17, so I’ll call my snapshot p10.<br>\nClone the snapshot to a new jail.<br>\nConfigure the jail hostname.<br>\nAdd the jail definition to jail.conf, make sure you have the global jail settings from jail.conf listed in the fulljail example.<br>\nStart the jail.<br>\nThe downside with the zfs approach is that each jail is now a fully independent, and if you need to update your jails, you have to update them all individually. By sharing a template using nullfs mounts you can have only one copy of the base system that only needs to be updated once.</p>\n\n<p>Follow the link to see the rest of the article about<br>\nThin jails using NullFS mounts<br>\nSimplifying jail.conf<br>\nHopefully this has helped you understand the process of how to create and manage FreeBSD jails without tools that abstract away all the details. Those tools are often quite useful, but there is always benefit in learning to do things the hard way. And in this case, the hard way doesn’t seem to be that hard after all.</p>\n\n<h2>Beastie Bits</h2>\n\n<p>Meetup in Zurich #4, July edition (July 19) – Which you likely missed, but now you know to look for the August edition!<br>\nThe next two BSD-PL User group meetings in Warsaw have been scheduled for July 30th and Aug 9th @ 1830 CEST – Submit your topic proposals now<br>\nLinux Geek Books - Humble Bundle<br>\nExtend loader(8) geli support to all architectures and all disk-like devices<br>\nUpgrading from a bootpool to a single encrypted pool – skip the gptzfsboot part, and manually update your EFI partition with loader.efi<br>\nThe pkgsrc 2018Q2 for Illumos is available with 18500+ binary packages<br>\nNetBSD ARM64 Images Available with SMP for RPi3 / NanoPi / Pine64 Boards<br>\nRecently released CDE 2.3.0 running on Tribblix (Illumos)<br>\nAn Interview With Tech &amp; Science Fiction Author Michael W Lucas<br>\nA reminder : MeetBSD CFP<br>\nEuroBSDCon talk acceptances have gone out, and once the tutorials are confirmed, registration will open. That will likely have happened by time you see this episode, so go register! See you in Romania<br>\nTarsnap</p>\n\n<h2>Feedback/Questions</h2>\n\n<p>Wilyarti - Adblocked on FreeBSD Continued…<br>\nAndrew - A Question and a Story<br>\nMatthew - Thanks<br>\nBrian - PCI-E Controller<br>\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\" rel=\"nofollow\">feedback@bsdnow.tv</a></p>","summary":"FreeBSD ULE vs. Linux CFS, OpenBSD on Tuxedo InfinityBook, how zfs diff reports filenames efficiently, why choose FreeBSD over Linux, PS4 double free exploit, OpenBSD’s wifi autojoin, and FreeBSD jails the hard way.","date_published":"2018-07-25T01:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d5ca53c5-7144-4ce4-9189-591a8ac5767b.mp3","mime_type":"audio/mp3","size_in_bytes":63008930,"duration_in_seconds":6282}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2267","title":"Episode 255: What Are You Pointing At | BSD Now 255","url":"https://www.bsdnow.tv/255","content_text":"What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.\n\n##Headlines\n###What ZFS block pointers are and what’s in them\n\n\nI’ve mentioned ZFS block pointers in the past; for example, when I wrote about some details of ZFS DVAs, I said that DVAs are embedded in block pointers. But I’ve never really looked carefully at what is in block pointers and what that means and implies for ZFS.\n\n\n\nThe very simple way to describe a ZFS block pointer is that it’s what ZFS uses in places where other filesystems would simply put a block number. Just like block numbers but unlike things like ZFS dnodes, a block pointer isn’t a separate on-disk entity; instead it’s an on disk data format and an in memory structure that shows up in other things. To quote from the (draft and old) ZFS on-disk specification (PDF):\n\n\n\nA block pointer (blkptr_t) is a 128 byte ZFS structure used to physically locate, verify, and describe blocks of data on disk.\n\n\n\nBlock pointers are embedded in any ZFS on disk structure that points directly to other disk blocks, both for data and metadata. For instance, the dnode for a file contains block pointers that refer to either its data blocks (if it’s small enough) or indirect blocks, as I saw in this entry. However, as I discovered when I paid attention, most things in ZFS only point to dnodes indirectly, by giving their object number (either in a ZFS filesystem or in pool-wide metadata).\n\n\n\nSo what’s in a block pointer itself? You can find the technical details for modern ZFS in spa.h, so I’m going to give a sort of summary. A regular block pointer contains:\n\n\n\nvarious metadata and flags about what the block pointer is for and what parts of it mean, including what type of object it points to.\nUp to three DVAs that say where to actually find the data on disk. There can be more than one DVA because you may have set the copies property to 2 or 3, or this may be metadata (which normally has two copies and may have more for sufficiently important metadata).\nThe logical size (size before compression) and ‘physical’ size (the nominal size after compression) of the disk block. The physical size can do odd things and is not necessarily the asize (allocated size) for the DVA(s).\nThe txgs that the block was born in, both logically and physically (the physical txg is apparently for dva[0]). The physical txg was added with ZFS deduplication but apparently also shows up in vdev removal.\nThe checksum of the data the block pointer describes. This checksum implicitly covers the entire logical size of the data, and as a result you must read all of the data in order to verify it. This can be an issue on raidz vdevs or if the block had to use gang blocks.\n\n\n\nJust like basically everything else in ZFS, block pointers don’t have an explicit checksum of their contents. Instead they’re implicitly covered by the checksum of whatever they’re embedded in; the block pointers in a dnode are covered by the overall checksum of the dnode, for example. Block pointers must include a checksum for the data they point to because such data is ‘out of line’ for the containing object.\n\n\n\n(The block pointers in a dnode don’t necessarily point straight to data. If there’s more than a bit of data in whatever the dnode covers, the dnode’s block pointers will instead point to some level of indirect block, which itself has some number of block pointers.)\n\n\n\nThere is a special type of block pointer called an embedded block pointer. Embedded block pointers directly contain up to 112 bytes of data; apart from the data, they contain only the metadata fields and a logical birth txg. As with conventional block pointers, this data is implicitly covered by the checksum of the containing object.\n\n\n\nSince block pointers directly contain the address of things on disk (in the form of DVAs), they have to change any time that address changes, which means any time ZFS does its copy on write thing. This forces a change in whatever contains the block pointer, which in turn ripples up to another block pointer (whatever points to said containing thing), and so on until we eventually reach the Meta Object Set and the uberblock. How this works is a bit complicated, but ZFS is designed to generally make this a relatively shallow change with not many levels of things involved (as I discovered recently).\n\n\n\nAs far as I understand things, the logical birth txg of a block pointer is the transaction group in which the block pointer was allocated. Because of ZFS’s copy on write principle, this means that nothing underneath the block pointer has been updated or changed since that txg; if something changed, it would have been written to a new place on disk, which would have forced a change in at least one DVA and thus a ripple of updates that would update the logical birth txg.\n\n\n\nHowever, this doesn’t quite mean what I used to think it meant because of ZFS’s level of indirection. If you change a file by writing data to it, you will change some of the file’s block pointers, updating their logical birth txg, and you will change the file’s dnode. However, you won’t change any block pointers and thus any logical birth txgs for the filesystem directory the file is in (or anything else up the directory tree), because the directory refers to the file through its object number, not by directly pointing to its dnode. You can still use logical birth txgs to efficiently find changes from one txg to another, but you won’t necessarily get a filesystem level view of these changes; instead, as far as I can see, you will basically get a view of what object(s) in a filesystem changed (effectively, what inode numbers changed).\n\n\n\n(ZFS has an interesting hack to make things like ‘zfs diff’ work far more efficiently than you would expect in light of this, but that’s going to take yet another entry to cover.)\n\n\n\n\n###Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days\n\n\nExploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.\nThe offer, first advertised via Twitter earlier this week, is available as part of the company’s latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.\nThe company runs a regular zero-day acquisition program through its website, but it often holds special drives with more substantial rewards when it needs zero-days of a specific category.\n\n\n\nBSD zero-day rewards will be on par with Linux payouts\n\n\n\nThe US-based company held a previous drive with increased rewards for Linux zero-days in February, with rewards going as high as $45,000.\nIn another zero-day acquisition drive announced on Twitter this week, the company said it was looking again for Linux zero-days, but also for exploits targeting BSD systems. This time around, rewards can go up to $500,000, for the right exploit.\nZerodium told Bleeping Computer they’ll be aligning the temporary rewards for BSD systems with their usual payouts for Linux distros.\nThe company’s usual payouts for Linux privilege escalation exploits can range from $10,000 to $30,000. Local privilege escalation (LPE) rewards can even reach $100,000 for “an exploit with an exceptional quality and coverage,” such as, for example, a Linux kernel exploit affecting all major distributions.\nPayouts for Linux remote code execution (RCE) exploits can bring in from $50,000 to $500,000 depending on the targeted software/service and its market share. The highest rewards are usually awarded for LPEs and RCEs affecting CentOS and Ubuntu distros.\n\n\n\nZero-day price varies based on exploitation chain\n\n\n\nThe acquisition price of a submitted zero-day is directly tied to its requirements in terms of user interaction (no click, one click, two clicks, etc.), Zerodium said.\nOther factors include the exploit reliability, its success rate, the number of vulnerabilities chained together for the final exploit to work (more chained bugs means more chances for the exploit to break unexpectedly), and the OS configuration needed for the exploit to work (exploits are valued more if they work against default OS configs).\n\n\n\nZero-days in servers “can reach exceptional amounts”\n\n\n\n“Price difference between systems is mostly driven by market shares,” Zerodium founder Chaouki Bekrar told Bleeping Computer via email.\nAsked about the logic behind these acquisition drives that pay increased rewards, Bekrar told Bleeping Computer the following:\n\"Our aim is to always have, at any time, two or more fully functional exploits for every major software, hardware, or operating systems, meaning that from time to time we would promote a specific software/system on our social media to acquire new codes and strengthen our existing capabilities or extend them.”\n“We may also react to customers’ requests and their operational needs,” Bekrar said.\n\n\n\nIt’s becoming a crowded market\n\n\n\nSince Zerodium drew everyone’s attention to the exploit brokerage market in 2015, the market has gotten more and more crowded, but also more sleazy, with some companies being accused of selling zero-days to government agencies in countries with oppressive or dictatorial regimes, where they are often used against political oponents, journalists, and dissidents, instead of going after real criminals.\nThe latest company who broke into the zero-day brokerage market is Crowdfense, who recently launched an acquisition program with prizes of $10 million, of which it already paid $4.5 million to researchers.\n\n\nTwitter Announcement\n\n\n\nDigital Ocean\nhttp://do.co/bsdnow\n\n###KDE on FreeBSD – June 2018\n\n\nThe KDE-FreeBSD team (a half-dozen hardy individuals, with varying backgrounds and varying degrees of involvement depending on how employment is doing) has a status message in the #kde-freebsd channel on freenode. Right now it looks like this:\n\n\nhttp://FreeBSD.kde.org | Bleeding edge \nhttp://FreeBSD.kde.org/area51.php | Released: Qt 5.10.1, KDE SC 4.14.3, KF5 5.46.0, Applications 18.04.1, Plasma-5.12.5, Kdevelop-5.2.1, Digikam-5.9.0\n\n\n\nIt’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).\n\n\n\nIn no particular order:\nQt 5.10 is here, in a FrankenEngine incarnation: we still use WebEnging from Qt 5.9 because — like I’ve said before — WebEngine is such a gigantic pain in the butt to update with all the necessary patches to get it to compile.\nOur collection of downstream patches to Qt 5.10 is growing, slowly. None of them are upstreamable (e.g. libressl support) though.\nKDE Frameworks releases are generally pushed to ports within a week or two of release. Actually, now that there is a bigger stack of KDE software in FreeBSD ports the updates take longer because we have to do exp-runs.\nSimilarly, Applications and Plasma releases are reasonably up-to-date. We dodged a bullet by not jumping on Plasma 5.13 right away, I see. Tobias is the person doing almost all of the drudge-work of these updates, he deserves a pint of something in Vienna this summer.\nThe freebsd.kde.org website has been slightly updated; it was terribly out-of-date.\n\n\n\nSo we’re mostly-up-to-date, and mostly all packaged up and ready to go. Much of my day is spent in VMs packaged by other people, but it’s good to have a full KDE developer environment outside of them as well. (PS. Gotta hand it to Tomasz for the amazing application for downloading and displaying a flamingo … niche usecases FTW)\n\n\n\n\n##News Roundup\n###New FreeBSD Core Team Elected\n\n\nActive committers to the project have elected your tenth FreeBSD Core\nTeam.\n\n\n\nAllan Jude (allanjude)\nBenedict Reuschling (bcr)\nBrooks Davis (brooks)\nHiroki Sato (hrs)\nJeff Roberson (jeff)\nJohn Baldwin (jhb)\nKris Moore (kmoore)\nSean Chittenden (seanc)\nWarner Losh (imp)\n\n\n\nLet’s extend our gratitude to the outgoing Core Team members:\n\n\n\nBaptiste Daroussin (bapt)\nBenno Rice (benno)\nEd Maste (emaste)\nGeorge V. Neville-Neil (gnn)\nMatthew Seaman (matthew)\n\n\n\nMatthew, after having served as the Core Team Secretary for the past\nfour years, will be stepping down from that role.\n\n\n\nThe Core Team would also like to thank Dag-Erling Smørgrav for running a\nflawless election.\n\n\n\nTo read about the responsibilities of the Core Team, refer to https://www.freebsd.org/administration.html#t-core.\n\n\n\n\n###NetBSD WiFi refresh\n\n\nThe NetBSD Foundation is pleased to announce a summer 2018 contract with Philip Nelson (phil%NetBSD.org@localhost) to update the IEEE 802.11 stack basing the update on the FreeBSD current code.  The goals of the project are:\n\n\n\nMinimizing the differences between the FreeBSD and NetBSD IEEE 802.11 stack so future updates are easier.\nAdding support for the newer protocols 801.11/N and 802.11/AC.\nImproving SMP support in the IEEE 802.11 stack.\nAdding Virtual Access Point (VAP) support.\nUpdating as many NIC drivers as time permits for the updated IEEE 802.11 stack and VAP changes.\n\n\n\nStatus reports will be posted to tech-net%NetBSD.org@localhost every other week\nwhile the contract is active.\n\n\n\n\niXsystems\n\n###Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape\n\n\nPoor Man’s CI (PMCI - Poor Man’s Continuous Integration) is a collection of scripts that taken together work as a simple CI solution that runs on Google Cloud. While there are many advanced hosted CI systems today, and many of them are free for open source projects, none of them seem to offer a solution for the BSD operating systems (FreeBSD, NetBSD, OpenBSD, etc.)\n\n\n\nThe architecture of Poor Man’s CI is system agnostic. However in the implementation provided in this repository the only supported systems are FreeBSD and NetBSD. Support for additional systems is possible.\n\n\n\nPoor Man’s CI runs on the Google Cloud. It is possible to set it up so that the service fits within the Google Cloud “Always Free” limits. In doing so the provided CI is not only hosted, but is also free! (Disclaimer: I am not affiliated with Google and do not otherwise endorse their products.)\n\n\n\nARCHITECTURE\n\n\n\nA CI solution listens for “commit” (or more usually “push”) events, builds the associated repository at the appropriate place in its history and reports the results. Poor Man’s CI implements this very basic CI scenario using a simple architecture, which we present in this section.\n\n\n\n\nPoor Man’s CI consists of the following components and their interactions:\n\n\nController: Controls the overall process of accepting GitHub push events and starting builds. The Controller runs in the Cloud Functions environment and is implemented by the files in the controller source directory. It consists of the following components:\n\nListener: Listens for GitHub push events and posts them as work messages to the workq PubSub.\nDispatcher: Receives work messages from the workq PubSub and a free instance name from the Builder Pool. It instantiates a builder instance named name in the Compute Engine environment and passes it the link of a repository to build.\nCollector: Receives done messages from the doneq PubSub and posts the freed instance name back to the Builder Pool.\n\n\n\n\n\nPubSub Topics:\n\n\nworkq: Transports work messages that contain the link of the repository to build.\npoolq: Implements the Builder Pool, which contains the name’s of available builder instances. To acquire a builder name, pull a message from the poolq. To release a builder name, post it back into the poolq.\ndoneq: Transports done messages (builder instance terminate and delete events). These message contain the name of freed builder instances.\n\n\n\n\n\nbuilder: A builder is a Compute Engine instance that performs a build of a repository and shuts down when the build is complete. A builder is instantiated from a VM image and a startx (startup-exit) script.\n\n\n\n\nBuild Logs: A Storage bucket that contains the logs of builds performed by builder instances.\n\n\n\n\nLogging Sink: A Logging Sink captures builder instance terminate and delete events and posts them into the doneq.\n\n\n\n\nBUGS\n\n\n\n\n\nThe Builder Pool is currently implemented as a PubSub; messages in the PubSub contain the names of available builder instances. Unfortunately a PubSub retains its messages for a maximum of 7 days. It is therefore possible that messages will be discarded and that your PMCI deployment will suddenly find itself out of builder instances. If this happens you can reseed the Builder Pool by running the commands below. However this is a serious BUG that should be fixed. For a related discussion see https://tinyurl.com/ybkycuub.\n\n\n$ ./pmci queue_post poolq builder0\n# ./pmci queue_post poolq builder1\n# ... repeat for as many builders as you want\n\n\nThe Dispatcher is implemented as a Retry Background Cloud Function. It accepts work messages from the workq and attempts to pull a free name from the poolq. If that fails it returns an error, which instructs the infrastructure to retry. Because the infrastructure does not provide any retry controls, this currently happens immediately and the Dispatcher spins unproductively. This is currently mitigated by a “sleep” (setTimeout), but the Cloud Functions system still counts the Function as running and charges it accordingly. While this fits within the “Always Free” limits, it is something that should eventually be fixed (perhaps by the PubSub team). For a related discussion see https://tinyurl.com/yb2vbwfd.\n\n\n\n\n###The Power of Ctrl-T\n\n\nDid you know that you can check what a process is doing by pressing CTRL+T?\nHas it happened to you before that you were waiting for something to be finished that can take a lot of time, but there is no easy way to check the status. Like a dd, cp, mv and many others. All you have to do is press CTRL+T where the process is running.  This will output what’s happening and will not interrupt or mess with it in any way. This causes the operating system to output the SIGINFO signal.\nOn FreeBSD it looks like this:\n\n\nping pingtest.com\nPING pingtest.com (5.22.149.135): 56 data bytes\n64 bytes from 5.22.149.135: icmp_seq=0 ttl=51 time=86.232 ms\n64 bytes from 5.22.149.135: icmp_seq=1 ttl=51 time=85.477 ms\n64 bytes from 5.22.149.135: icmp_seq=2 ttl=51 time=85.493 ms\n64 bytes from 5.22.149.135: icmp_seq=3 ttl=51 time=85.211 ms\n64 bytes from 5.22.149.135: icmp_seq=4 ttl=51 time=86.002 ms\nload: 1.12 cmd: ping 94371 [select] 4.70r 0.00u 0.00s 0% 2500k\n5/5 packets received (100.0%) 85.211 min / 85.683 avg / 86.232 max\n64 bytes from 5.22.149.135: icmp_seq=5 ttl=51 time=85.725 ms\n64 bytes from 5.22.149.135: icmp_seq=6 ttl=51 time=85.510 ms\n\n\n\nAs you can see it not only outputs the name of the running command but the following parameters as well:\n\n\n94371 – PID\n4.70r – since when is the process running\n0.00u – user time\n0.00s – system time\n0% – CPU usage\n2500k – resident set size of the process or RSS\n``\n\n&gt; An even better example is with the following cp command:\n\n\n\ncp FreeBSD-11.1-RELEASE-amd64-dvd1.iso /dev/null\nload: 0.99 cmd: cp 94412 [runnable] 1.61r 0.00u 0.39s 3% 3100k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 15%\nload: 0.91 cmd: cp 94412 [runnable] 2.91r 0.00u 0.80s 6% 3104k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 32%\nload: 0.91 cmd: cp 94412 [runnable] 4.20r 0.00u 1.23s 9% 3104k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 49%\nload: 0.91 cmd: cp 94412 [runnable] 5.43r 0.00u 1.64s 11% 3104k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 64%\nload: 1.07 cmd: cp 94412 [runnable] 6.65r 0.00u 2.05s 13% 3104k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 79%\nload: 1.07 cmd: cp 94412 [runnable] 7.87r 0.00u 2.43s 15% 3104k\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 95%\n\n\n&gt; I prcessed CTRL+T six times.  Without that, all the output would have been is the first line.\n\n&gt; Another example how the process is changing states:\n\n\n\nwget https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso\n–2018-06-17 18:47:48– https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso\nResolving download.freebsd.org (download.freebsd.org)… 96.47.72.72, 2610:1c1:1:606c::15:0\nConnecting to download.freebsd.org (download.freebsd.org)|96.47.72.72|:443… connected.\nHTTP request sent, awaiting response… 200 OK\nLength: 3348465664 (3.1G) [application/octet-stream]\nSaving to: ‘FreeBSD-11.1-RELEASE-amd64-dvd1.iso’\n\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 41.04M 527KB/s eta 26m 49sload: 4.95 cmd: wget 10152 waiting 0.48u 0.72s\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 49.41M 659KB/s eta 25m 29sload: 12.64 cmd: wget 10152 waiting 0.55u 0.85s\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 75.58M 6.31MB/s eta 20m 6s load: 11.71 cmd: wget 10152 running 0.73u 1.19s\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 85.63M 6.83MB/s eta 18m 58sload: 11.71 cmd: wget 10152 waiting 0.80u 1.32s\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 14%[==============&gt; ] 460.23M 7.01MB/s eta 9m 0s 1\n\n\n&gt; The bad news is that CTRl+T doesn’t work with Linux kernel, but you can use it on MacOS/OS-X:\n\n\n\n—&gt; Fetching distfiles for gmp\n—&gt; Attempting to fetch gmp-6.1.2.tar.bz2 from https://distfiles.macports.org/gmp\n—&gt; Verifying checksums for gmp\n—&gt; Extracting gmp\n—&gt; Applying patches to gmp\n—&gt; Configuring gmp\nload: 2.81 cmd: clang 74287 running 0.31u 0.28s\n\n\n&gt; PS: If I recall correctly Feld showed me CTRL+T, thank you!\n\n***\n\n\n##Beastie Bits\n+ [Half billion tries for a HAMMER2 bug](http://lists.dragonflybsd.org/pipermail/commits/2018-May/672263.html)\n+ OpenBSD with various Desktops\n + [OpenBSD 6.3 running twm window manager](https://youtu.be/v6XeC5wU2s4)\n + [OpenBSD 6.3 jwm and rox desktop](https://youtu.be/jlSK2oi7CBc)\n + [OpenBSD 6.3 cwm youtube video](https://youtu.be/mgqNyrP2CPs)\n+ [pf: Increase default state table size](https://svnweb.freebsd.org/base?view=revision&amp;revision=336221)\n***\n\n**Tarsnap**\n\n##Feedback/Questions\n+ Ben Sims - [Full feed?](http://dpaste.com/3XVH91T#wrap)\n+ Scott - [Questions and Comments](http://dpaste.com/08P34YN#wrap)\n+ Troels - [Features of FreeBSD 11.2 that deserve a mention](http://dpaste.com/3DDPEC2#wrap)\n+ [Fred - Show Ideas](http://dpaste.com/296ZA0P#wrap)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n***\n\n***\n\niXsystems [It's all NAS](https://www.ixsystems.com/blog/its-all-nas/)\n","content_html":"<p>What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://utcc.utoronto.ca/~cks/space/blog/solaris/ZFSBlockPointers\">What ZFS block pointers are and what’s in them</a></p>\n\n<blockquote>\n<p>I’ve mentioned ZFS block pointers in the past; for example, when I wrote about some details of ZFS DVAs, I said that DVAs are embedded in block pointers. But I’ve never really looked carefully at what is in block pointers and what that means and implies for ZFS.</p>\n</blockquote>\n\n<blockquote>\n<p>The very simple way to describe a ZFS block pointer is that it’s what ZFS uses in places where other filesystems would simply put a block number. Just like block numbers but unlike things like ZFS dnodes, a block pointer isn’t a separate on-disk entity; instead it’s an on disk data format and an in memory structure that shows up in other things. To quote from the (draft and old) ZFS on-disk specification (PDF):</p>\n</blockquote>\n\n<blockquote>\n<p>A block pointer (blkptr_t) is a 128 byte ZFS structure used to physically locate, verify, and describe blocks of data on disk.</p>\n</blockquote>\n\n<blockquote>\n<p>Block pointers are embedded in any ZFS on disk structure that points directly to other disk blocks, both for data and metadata. For instance, the dnode for a file contains block pointers that refer to either its data blocks (if it’s small enough) or indirect blocks, as I saw in this entry. However, as I discovered when I paid attention, most things in ZFS only point to dnodes indirectly, by giving their object number (either in a ZFS filesystem or in pool-wide metadata).</p>\n</blockquote>\n\n<blockquote>\n<p>So what’s in a block pointer itself? You can find the technical details for modern ZFS in spa.h, so I’m going to give a sort of summary. A regular block pointer contains:</p>\n</blockquote>\n\n<ul>\n<li>various metadata and flags about what the block pointer is for and what parts of it mean, including what type of object it points to.</li>\n<li>Up to three DVAs that say where to actually find the data on disk. There can be more than one DVA because you may have set the copies property to 2 or 3, or this may be metadata (which normally has two copies and may have more for sufficiently important metadata).</li>\n<li>The logical size (size before compression) and ‘physical’ size (the nominal size after compression) of the disk block. The physical size can do odd things and is not necessarily the asize (allocated size) for the DVA(s).</li>\n<li>The txgs that the block was born in, both logically and physically (the physical txg is apparently for dva[0]). The physical txg was added with ZFS deduplication but apparently also shows up in vdev removal.</li>\n<li>The checksum of the data the block pointer describes. This checksum implicitly covers the entire logical size of the data, and as a result you must read all of the data in order to verify it. This can be an issue on raidz vdevs or if the block had to use gang blocks.</li>\n</ul>\n\n<blockquote>\n<p>Just like basically everything else in ZFS, block pointers don’t have an explicit checksum of their contents. Instead they’re implicitly covered by the checksum of whatever they’re embedded in; the block pointers in a dnode are covered by the overall checksum of the dnode, for example. Block pointers must include a checksum for the data they point to because such data is ‘out of line’ for the containing object.</p>\n</blockquote>\n\n<blockquote>\n<p>(The block pointers in a dnode don’t necessarily point straight to data. If there’s more than a bit of data in whatever the dnode covers, the dnode’s block pointers will instead point to some level of indirect block, which itself has some number of block pointers.)</p>\n</blockquote>\n\n<blockquote>\n<p>There is a special type of block pointer called an embedded block pointer. Embedded block pointers directly contain up to 112 bytes of data; apart from the data, they contain only the metadata fields and a logical birth txg. As with conventional block pointers, this data is implicitly covered by the checksum of the containing object.</p>\n</blockquote>\n\n<blockquote>\n<p>Since block pointers directly contain the address of things on disk (in the form of DVAs), they have to change any time that address changes, which means any time ZFS does its copy on write thing. This forces a change in whatever contains the block pointer, which in turn ripples up to another block pointer (whatever points to said containing thing), and so on until we eventually reach the Meta Object Set and the uberblock. How this works is a bit complicated, but ZFS is designed to generally make this a relatively shallow change with not many levels of things involved (as I discovered recently).</p>\n</blockquote>\n\n<blockquote>\n<p>As far as I understand things, the logical birth txg of a block pointer is the transaction group in which the block pointer was allocated. Because of ZFS’s copy on write principle, this means that nothing underneath the block pointer has been updated or changed since that txg; if something changed, it would have been written to a new place on disk, which would have forced a change in at least one DVA and thus a ripple of updates that would update the logical birth txg.</p>\n</blockquote>\n\n<blockquote>\n<p>However, this doesn’t quite mean what I used to think it meant because of ZFS’s level of indirection. If you change a file by writing data to it, you will change some of the file’s block pointers, updating their logical birth txg, and you will change the file’s dnode. However, you won’t change any block pointers and thus any logical birth txgs for the filesystem directory the file is in (or anything else up the directory tree), because the directory refers to the file through its object number, not by directly pointing to its dnode. You can still use logical birth txgs to efficiently find changes from one txg to another, but you won’t necessarily get a filesystem level view of these changes; instead, as far as I can see, you will basically get a view of what object(s) in a filesystem changed (effectively, what inode numbers changed).</p>\n</blockquote>\n\n<blockquote>\n<p>(ZFS has an interesting hack to make things like ‘zfs diff’ work far more efficiently than you would expect in light of this, but that’s going to take yet another entry to cover.)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.bleepingcomputer.com/news/security/rewards-of-up-to-500-000-offered-for-freebsd-openbsd-netbsd-linux-zero-days/\">Rewards of Up to $500,000 Offered for FreeBSD, OpenBSD, NetBSD, Linux Zero-Days</a></p>\n\n<blockquote>\n<p>Exploit broker Zerodium is offering rewards of up to $500,000 for zero-days in UNIX-based operating systems like OpenBSD, FreeBSD, NetBSD, but also for Linux distros such as Ubuntu, CentOS, Debian, and Tails.<br>\nThe offer, first advertised via Twitter earlier this week, is available as part of the company’s latest zero-day acquisition drive. Zerodium is known for buying zero-days and selling them to government agencies and law enforcement.<br>\nThe company runs a regular zero-day acquisition program through its website, but it often holds special drives with more substantial rewards when it needs zero-days of a specific category.</p>\n</blockquote>\n\n<ul>\n<li>BSD zero-day rewards will be on par with Linux payouts</li>\n</ul>\n\n<blockquote>\n<p>The US-based company held a previous drive with increased rewards for Linux zero-days in February, with rewards going as high as $45,000.<br>\nIn another zero-day acquisition drive announced on Twitter this week, the company said it was looking again for Linux zero-days, but also for exploits targeting BSD systems. This time around, rewards can go up to $500,000, for the right exploit.<br>\nZerodium told Bleeping Computer they’ll be aligning the temporary rewards for BSD systems with their usual payouts for Linux distros.<br>\nThe company’s usual payouts for Linux privilege escalation exploits can range from $10,000 to $30,000. Local privilege escalation (LPE) rewards can even reach $100,000 for “an exploit with an exceptional quality and coverage,” such as, for example, a Linux kernel exploit affecting all major distributions.<br>\nPayouts for Linux remote code execution (RCE) exploits can bring in from $50,000 to $500,000 depending on the targeted software/service and its market share. The highest rewards are usually awarded for LPEs and RCEs affecting CentOS and Ubuntu distros.</p>\n</blockquote>\n\n<ul>\n<li>Zero-day price varies based on exploitation chain</li>\n</ul>\n\n<blockquote>\n<p>The acquisition price of a submitted zero-day is directly tied to its requirements in terms of user interaction (no click, one click, two clicks, etc.), Zerodium said.<br>\nOther factors include the exploit reliability, its success rate, the number of vulnerabilities chained together for the final exploit to work (more chained bugs means more chances for the exploit to break unexpectedly), and the OS configuration needed for the exploit to work (exploits are valued more if they work against default OS configs).</p>\n</blockquote>\n\n<ul>\n<li>Zero-days in servers “can reach exceptional amounts”</li>\n</ul>\n\n<blockquote>\n<p>“Price difference between systems is mostly driven by market shares,” Zerodium founder Chaouki Bekrar told Bleeping Computer via email.<br>\nAsked about the logic behind these acquisition drives that pay increased rewards, Bekrar told Bleeping Computer the following:<br>\n&quot;Our aim is to always have, at any time, two or more fully functional exploits for every major software, hardware, or operating systems, meaning that from time to time we would promote a specific software/system on our social media to acquire new codes and strengthen our existing capabilities or extend them.”<br>\n“We may also react to customers’ requests and their operational needs,” Bekrar said.</p>\n</blockquote>\n\n<ul>\n<li>It’s becoming a crowded market</li>\n</ul>\n\n<blockquote>\n<p>Since Zerodium drew everyone’s attention to the exploit brokerage market in 2015, the market has gotten more and more crowded, but also more sleazy, with some companies being accused of selling zero-days to government agencies in countries with oppressive or dictatorial regimes, where they are often used against political oponents, journalists, and dissidents, instead of going after real criminals.<br>\nThe latest company who broke into the zero-day brokerage market is Crowdfense, who recently launched an acquisition program with prizes of $10 million, of which it already paid $4.5 million to researchers.</p>\n</blockquote>\n\n<p><a href=\"https://twitter.com/Zerodium/status/1012007051466162177\">Twitter Announcement</a></p>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong><br>\n<a href=\"http://do.co/bsdnow\">http://do.co/bsdnow</a></p>\n\n<p>###<a href=\"https://euroquis.nl/bobulate/?p=1915\">KDE on FreeBSD – June 2018</a></p>\n\n<blockquote>\n<p>The KDE-FreeBSD team (a half-dozen hardy individuals, with varying backgrounds and varying degrees of involvement depending on how employment is doing) has a status message in the #kde-freebsd channel on freenode. Right now it looks like this:</p>\n</blockquote>\n\n<pre><code>http://FreeBSD.kde.org | Bleeding edge \nhttp://FreeBSD.kde.org/area51.php | Released: Qt 5.10.1, KDE SC 4.14.3, KF5 5.46.0, Applications 18.04.1, Plasma-5.12.5, Kdevelop-5.2.1, Digikam-5.9.0\n</code></pre>\n\n<blockquote>\n<p>It’s been a while since I wrote about KDE on FreeBSD, what with Calamares and third-party software happening as well. We’re better at keeping the IRC topic up-to-date than a lot of other sources of information (e.g. the FreeBSD quarterly reports, or the f.k.o website, which I’ll just dash off and update after writing this).</p>\n</blockquote>\n\n<ul>\n<li>In no particular order:</li>\n<li>Qt 5.10 is here, in a FrankenEngine incarnation: we still use WebEnging from Qt 5.9 because — like I’ve said before — WebEngine is such a gigantic pain in the butt to update with all the necessary patches to get it to compile.</li>\n<li>Our collection of downstream patches to Qt 5.10 is growing, slowly. None of them are upstreamable (e.g. libressl support) though.</li>\n<li>KDE Frameworks releases are generally pushed to ports within a week or two of release. Actually, now that there is a bigger stack of KDE software in FreeBSD ports the updates take longer because we have to do exp-runs.</li>\n<li>Similarly, Applications and Plasma releases are reasonably up-to-date. We dodged a bullet by not jumping on Plasma 5.13 right away, I see. Tobias is the person doing almost all of the drudge-work of these updates, he deserves a pint of something in Vienna this summer.</li>\n<li>The <a href=\"http://freebsd.kde.org\">freebsd.kde.org</a> website has been slightly updated; it was terribly out-of-date.</li>\n</ul>\n\n<blockquote>\n<p>So we’re mostly-up-to-date, and mostly all packaged up and ready to go. Much of my day is spent in VMs packaged by other people, but it’s good to have a full KDE developer environment outside of them as well. (PS. Gotta hand it to Tomasz for <a href=\"https://www.angrycane.com.br/wp-content/uploads/2018/06/download_flamingo_and_display.txt\">the amazing application for downloading and displaying a flamingo</a> … niche usecases FTW)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://lists.freebsd.org/pipermail/freebsd-announce/2018-July/001836.html\">New FreeBSD Core Team Elected</a></p>\n\n<blockquote>\n<p>Active committers to the project have elected your tenth FreeBSD Core<br>\nTeam.</p>\n</blockquote>\n\n<ul>\n<li>Allan Jude (allanjude)</li>\n<li>Benedict Reuschling (bcr)</li>\n<li>Brooks Davis (brooks)</li>\n<li>Hiroki Sato (hrs)</li>\n<li>Jeff Roberson (jeff)</li>\n<li>John Baldwin (jhb)</li>\n<li>Kris Moore (kmoore)</li>\n<li>Sean Chittenden (seanc)</li>\n<li>Warner Losh (imp)</li>\n</ul>\n\n<blockquote>\n<p>Let’s extend our gratitude to the outgoing Core Team members:</p>\n</blockquote>\n\n<ul>\n<li>Baptiste Daroussin (bapt)</li>\n<li>Benno Rice (benno)</li>\n<li>Ed Maste (emaste)</li>\n<li>George V. Neville-Neil (gnn)</li>\n<li>Matthew Seaman (matthew)</li>\n</ul>\n\n<blockquote>\n<p>Matthew, after having served as the Core Team Secretary for the past<br>\nfour years, will be stepping down from that role.</p>\n</blockquote>\n\n<blockquote>\n<p>The Core Team would also like to thank Dag-Erling Smørgrav for running a<br>\nflawless election.</p>\n</blockquote>\n\n<ul>\n<li>To read about the responsibilities of the Core Team, refer to <a href=\"https://www.freebsd.org/administration.html#t-core\">https://www.freebsd.org/administration.html#t-core</a>.</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://mail-index.netbsd.org/tech-net/2018/06/26/msg006943.html\">NetBSD WiFi refresh</a></p>\n\n<blockquote>\n<p>The NetBSD Foundation is pleased to announce a summer 2018 contract with Philip Nelson (phil%<a href=\"http://NetBSD.org\">NetBSD.org</a>@localhost) to update the IEEE 802.11 stack basing the update on the FreeBSD current code.  The goals of the project are:</p>\n</blockquote>\n\n<ul>\n<li>Minimizing the differences between the FreeBSD and NetBSD IEEE 802.11 stack so future updates are easier.</li>\n<li>Adding support for the newer protocols 801.11/N and 802.11/AC.</li>\n<li>Improving SMP support in the IEEE 802.11 stack.</li>\n<li>Adding Virtual Access Point (VAP) support.</li>\n<li>Updating as many NIC drivers as time permits for the updated IEEE 802.11 stack and VAP changes.</li>\n</ul>\n\n<blockquote>\n<p>Status reports will be posted to tech-net%<a href=\"http://NetBSD.org\">NetBSD.org</a>@localhost every other week<br>\nwhile the contract is active.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###<a href=\"https://github.com/billziss-gh/pmci\">Poor Man’s CI - Hosted CI for BSD with shell scripting and duct tape</a></p>\n\n<blockquote>\n<p>Poor Man’s CI (PMCI - Poor Man’s Continuous Integration) is a collection of scripts that taken together work as a simple CI solution that runs on Google Cloud. While there are many advanced hosted CI systems today, and many of them are free for open source projects, none of them seem to offer a solution for the BSD operating systems (FreeBSD, NetBSD, OpenBSD, etc.)</p>\n</blockquote>\n\n<blockquote>\n<p>The architecture of Poor Man’s CI is system agnostic. However in the implementation provided in this repository the only supported systems are FreeBSD and NetBSD. Support for additional systems is possible.</p>\n</blockquote>\n\n<blockquote>\n<p>Poor Man’s CI runs on the Google Cloud. It is possible to set it up so that the service fits within the Google Cloud “Always Free” limits. In doing so the provided CI is not only hosted, but is also free! (Disclaimer: I am not affiliated with Google and do not otherwise endorse their products.)</p>\n</blockquote>\n\n<ul>\n<li>ARCHITECTURE</li>\n</ul>\n\n<blockquote>\n<p>A CI solution listens for “commit” (or more usually “push”) events, builds the associated repository at the appropriate place in its history and reports the results. Poor Man’s CI implements this very basic CI scenario using a simple architecture, which we present in this section.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Poor Man’s CI consists of the following components and their interactions:</p>\n</li>\n<li>\n<p>Controller: Controls the overall process of accepting GitHub push events and starting builds. The Controller runs in the Cloud Functions environment and is implemented by the files in the controller source directory. It consists of the following components:</p>\n<ul>\n<li>Listener: Listens for GitHub push events and posts them as work messages to the workq PubSub.</li>\n<li>Dispatcher: Receives work messages from the workq PubSub and a free instance name from the Builder Pool. It instantiates a builder instance named name in the Compute Engine environment and passes it the link of a repository to build.</li>\n<li>Collector: Receives done messages from the doneq PubSub and posts the freed instance name back to the Builder Pool.</li>\n</ul>\n\n<p></li><br>\n<li></p>\n\n<p>PubSub Topics:</p>\n\n<ul>\n<li>workq: Transports work messages that contain the link of the repository to build.</li>\n<li>poolq: Implements the Builder Pool, which contains the name’s of available builder instances. To acquire a builder name, pull a message from the poolq. To release a builder name, post it back into the poolq.</li>\n<li>doneq: Transports done messages (builder instance terminate and delete events). These message contain the name of freed builder instances.</li>\n</ul>\n\n<p></li><br>\n<li></p>\n\n<p>builder: A builder is a Compute Engine instance that performs a build of a repository and shuts down when the build is complete. A builder is instantiated from a VM image and a startx (startup-exit) script.</p>\n\n<p></li><br>\n<li></p>\n\n<p>Build Logs: A Storage bucket that contains the logs of builds performed by builder instances.</p>\n\n<p></li><br>\n<li></p>\n\n<p>Logging Sink: A Logging Sink captures builder instance terminate and delete events and posts them into the doneq.</p>\n\n<p></li><br>\n<li></p>\n\n<p>BUGS</p>\n\n<p></li><br>\n</ul></p>\n\n<blockquote>\n<p>The Builder Pool is currently implemented as a PubSub; messages in the PubSub contain the names of available builder instances. Unfortunately a PubSub retains its messages for a maximum of 7 days. It is therefore possible that messages will be discarded and that your PMCI deployment will suddenly find itself out of builder instances. If this happens you can reseed the Builder Pool by running the commands below. However this is a serious BUG that should be fixed. For a related discussion see <a href=\"https://tinyurl.com/ybkycuub\">https://tinyurl.com/ybkycuub</a>.</p>\n</blockquote>\n\n<p><code>$ ./pmci queue_post poolq builder0</code><br>\n<code># ./pmci queue_post poolq builder1</code><br>\n<code># ... repeat for as many builders as you want</code></p>\n\n<blockquote>\n<p>The Dispatcher is implemented as a Retry Background Cloud Function. It accepts work messages from the workq and attempts to pull a free name from the poolq. If that fails it returns an error, which instructs the infrastructure to retry. Because the infrastructure does not provide any retry controls, this currently happens immediately and the Dispatcher spins unproductively. This is currently mitigated by a “sleep” (setTimeout), but the Cloud Functions system still counts the Function as running and charges it accordingly. While this fits within the “Always Free” limits, it is something that should eventually be fixed (perhaps by the PubSub team). For a related discussion see <a href=\"https://tinyurl.com/yb2vbwfd\">https://tinyurl.com/yb2vbwfd</a>.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.danielisz.org/2018/06/21/the-power-of-ctrlt/\">The Power of Ctrl-T</a></p>\n\n<blockquote>\n<p>Did you know that you can check what a process is doing by pressing CTRL+T?<br>\nHas it happened to you before that you were waiting for something to be finished that can take a lot of time, but there is no easy way to check the status. Like a dd, cp, mv and many others. All you have to do is press CTRL+T where the process is running.  This will output what’s happening and will not interrupt or mess with it in any way. This causes the operating system to output the SIGINFO signal.<br>\nOn FreeBSD it looks like this:</p>\n</blockquote>\n\n<pre><code>ping pingtest.com\nPING pingtest.com (5.22.149.135): 56 data bytes\n64 bytes from 5.22.149.135: icmp_seq=0 ttl=51 time=86.232 ms\n64 bytes from 5.22.149.135: icmp_seq=1 ttl=51 time=85.477 ms\n64 bytes from 5.22.149.135: icmp_seq=2 ttl=51 time=85.493 ms\n64 bytes from 5.22.149.135: icmp_seq=3 ttl=51 time=85.211 ms\n64 bytes from 5.22.149.135: icmp_seq=4 ttl=51 time=86.002 ms\nload: 1.12 cmd: ping 94371 [select] 4.70r 0.00u 0.00s 0% 2500k\n5/5 packets received (100.0%) 85.211 min / 85.683 avg / 86.232 max\n64 bytes from 5.22.149.135: icmp_seq=5 ttl=51 time=85.725 ms\n64 bytes from 5.22.149.135: icmp_seq=6 ttl=51 time=85.510 ms\n</code></pre>\n\n<blockquote>\n<p>As you can see it not only outputs the name of the running command but the following parameters as well:</p>\n</blockquote>\n\n<pre><code>94371 – PID\n4.70r – since when is the process running\n0.00u – user time\n0.00s – system time\n0% – CPU usage\n2500k – resident set size of the process or RSS\n``\n\n&gt; An even better example is with the following cp command:\n\n</code></pre>\n\n<p>cp FreeBSD-11.1-RELEASE-amd64-dvd1.iso /dev/null<br>\nload: 0.99 cmd: cp 94412 [runnable] 1.61r 0.00u 0.39s 3% 3100k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 15%<br>\nload: 0.91 cmd: cp 94412 [runnable] 2.91r 0.00u 0.80s 6% 3104k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 32%<br>\nload: 0.91 cmd: cp 94412 [runnable] 4.20r 0.00u 1.23s 9% 3104k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 49%<br>\nload: 0.91 cmd: cp 94412 [runnable] 5.43r 0.00u 1.64s 11% 3104k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 64%<br>\nload: 1.07 cmd: cp 94412 [runnable] 6.65r 0.00u 2.05s 13% 3104k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 79%<br>\nload: 1.07 cmd: cp 94412 [runnable] 7.87r 0.00u 2.43s 15% 3104k<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso -&gt; /dev/null 95%</p>\n\n<pre><code>\n&gt; I prcessed CTRL+T six times.  Without that, all the output would have been is the first line.\n\n&gt; Another example how the process is changing states:\n\n</code></pre>\n\n<p>wget <a href=\"https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso\">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>\n–2018-06-17 18:47:48– <a href=\"https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso\">https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso</a><br>\nResolving <a href=\"http://download.freebsd.org\">download.freebsd.org</a> (<a href=\"http://download.freebsd.org\">download.freebsd.org</a>)… 96.47.72.72, 2610:1c1:1:606c::15:0<br>\nConnecting to <a href=\"http://download.freebsd.org\">download.freebsd.org</a> (<a href=\"http://download.freebsd.org\">download.freebsd.org</a>)|96.47.72.72|:443… connected.<br>\nHTTP request sent, awaiting response… 200 OK<br>\nLength: 3348465664 (3.1G) [application/octet-stream]<br>\nSaving to: ‘FreeBSD-11.1-RELEASE-amd64-dvd1.iso’</p>\n\n<p>FreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 41.04M 527KB/s eta 26m 49sload: 4.95 cmd: wget 10152 waiting 0.48u 0.72s<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 1%[&gt; ] 49.41M 659KB/s eta 25m 29sload: 12.64 cmd: wget 10152 waiting 0.55u 0.85s<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 75.58M 6.31MB/s eta 20m 6s load: 11.71 cmd: wget 10152 running 0.73u 1.19s<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 2%[=&gt; ] 85.63M 6.83MB/s eta 18m 58sload: 11.71 cmd: wget 10152 waiting 0.80u 1.32s<br>\nFreeBSD-11.1-RELEASE-amd64-dvd1.iso 14%[==============&gt; ] 460.23M 7.01MB/s eta 9m 0s 1</p>\n\n<pre><code>\n&gt; The bad news is that CTRl+T doesn’t work with Linux kernel, but you can use it on MacOS/OS-X:\n\n</code></pre>\n\n<p>—&gt; Fetching distfiles for gmp<br>\n—&gt; Attempting to fetch gmp-6.1.2.tar.bz2 from <a href=\"https://distfiles.macports.org/gmp\">https://distfiles.macports.org/gmp</a><br>\n—&gt; Verifying checksums for gmp<br>\n—&gt; Extracting gmp<br>\n—&gt; Applying patches to gmp<br>\n—&gt; Configuring gmp<br>\nload: 2.81 cmd: clang 74287 running 0.31u 0.28s</p>\n\n<pre><code>\n&gt; PS: If I recall correctly Feld showed me CTRL+T, thank you!\n\n***\n\n\n##Beastie Bits\n+ [Half billion tries for a HAMMER2 bug](http://lists.dragonflybsd.org/pipermail/commits/2018-May/672263.html)\n+ OpenBSD with various Desktops\n + [OpenBSD 6.3 running twm window manager](https://youtu.be/v6XeC5wU2s4)\n + [OpenBSD 6.3 jwm and rox desktop](https://youtu.be/jlSK2oi7CBc)\n + [OpenBSD 6.3 cwm youtube video](https://youtu.be/mgqNyrP2CPs)\n+ [pf: Increase default state table size](https://svnweb.freebsd.org/base?view=revision&amp;revision=336221)\n***\n\n**Tarsnap**\n\n##Feedback/Questions\n+ Ben Sims - [Full feed?](http://dpaste.com/3XVH91T#wrap)\n+ Scott - [Questions and Comments](http://dpaste.com/08P34YN#wrap)\n+ Troels - [Features of FreeBSD 11.2 that deserve a mention](http://dpaste.com/3DDPEC2#wrap)\n+ [Fred - Show Ideas](http://dpaste.com/296ZA0P#wrap)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n***\n\n***\n\niXsystems [It's all NAS](https://www.ixsystems.com/blog/its-all-nas/)\n</code></pre>","summary":"What ZFS blockpointers are, zero-day rewards offered, KDE on FreeBSD status, new FreeBSD core team, NetBSD WiFi refresh, poor man’s CI, and the power of Ctrl+T.","date_published":"2018-07-18T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ca9b19c1-e202-45d6-ac45-d0048a734c45.mp3","mime_type":"audio/mp3","size_in_bytes":48457846,"duration_in_seconds":4827}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2259","title":"Episode 254: Bare the OS | BSD Now 254","url":"https://www.bsdnow.tv/254","content_text":"Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.\n\n##Headlines\n###Silent Fanless FreeBSD Desktop/Server\n\n\nToday I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multa##Headlines\n###Cross-DSO CFI in HardenedBSD\nControl Flow Integrity, or CFI, raises the bar for attackers aiming to hijack control flow and execute arbitrary code. The llvm compiler toolchain, included and used by default in HardenedBSD 12-CURRENT/amd64, supports forward-edge CFI. Backward-edge CFI support is gained via a tangential feature called SafeStack. Cross-DSO CFI builds upon ASLR and PaX NOEXEC for effectiveness.\nHardenedBSD supports non-Cross-DSO CFI in base for 12-CURRENT/amd64 and has it enabled for a few individual ports. The term “non-Cross-DSO CFI” means that CFI is enabled for code within an application’s codebase, but not for the shared libraries it depends on. Supporting non-Cross-DSO CFI is an important initial milestone for supporting Cross-DSO CFI, or CFI applied to both shared libraries and applications.\nThis article discusses where HardenedBSD stands with regards to Cross-DSO CFI in base. We have made a lot of progress, yet we’re not even half-way there.\nBrace yourself: This article is going to be full of references to “Cross-DSO CFI.” Make a drinking game out of it. Or don’t. It’s your call. ;)\n\n\n\nUsing More llvm Toolchain Components\n\n\n\nCFI requires compiling source files with Link-Time Optimization (LTO). I remembered hearing a few years back that llvm developers were able to compile the entirety of FreeBSD’s source code with LTO. Compiling with LTO produces intermediate object files as LLVM IR bitcode instead of ELF objects.\nIn March of 2017, we started compiling all applications with LTO and non-Cross-DSO CFI. This also enabled ld.lld as the default linker in base since CFI requires lld. Commit f38b51668efcd53b8146789010611a4632cafade made the switch to ld.lld as the default linker while enabling non-Cross-DSO CFI at the same time.\nBuilding libraries in base requires applications like ar, ranlib, nm, and objdump. In FreeBSD 12-CURRENT, ar and ranlib are known as “BSD ar” and “BSD ranlib.” In fact, ar and ranlib are the same applications. One is hardlinked to another and the application changes behavior depending on arvgv[0] ending in “ranlib”. The ar, nm, and objdump used in FreeBSD do not support LLVM IR bitcode object files.\nIn preparation for Cross-DSO CFI support, commit fe4bb0104fc75c7216a6dafe2d7db0e3f5fe8257 in October 2017 saw HardenedBSD switching ar, ranlib, nm, and objdump to their respective llvm components. The llvm versions due support LLVM IR bitcode object files (surprise!) There has been some fallout in the ports tree and we’ve added LLVM_AR_UNSAFE and friends to help transition those ports that dislike llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump.\nWith ld.lld, llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump the default, HardenedBSD has effectively switched to a full llvm compiler toolchain in 12-CURRENT/amd64.\n\n\n\nBuilding Libraries With LTO\n\n\n\nThe primary 12-CURRENT development branch in HardenedBSD (hardened/current/master) only builds applications with LTO as mentioned in the secion above. My first attempt at building all static and shared libraries failed due to issues within llvm itself.\nI reported these issues to FreeBSD. Ed Maste (emaste@), Dimitry Andric (dim@), and llvm’s Rafael Espindola expertly helped address these issues. Various commits within the llvm project by Rafael fully and quickly resolved the issues brought up privately in emails.\nWith llvm fixed, I could now build nearly every library in base with LTO. I noticed, however, that if I kept non-Cross-DSO CFI and SafeStack enabled, all applications would segfault. Even simplistic applications like /bin/ls.\nDisabling both non-Cross-DSO CFI and SafeStack, but keeping LTO produced a fully functioning world! I have spent the last few months figuring out why enabling either non-Cross-DSO CFI or SafeStack caused issues. This brings us to today.\n\n\n\nThe Sanitizers in FreeBSD\n\n\n\nFreeBSD brought in all the files required for SafeStack and CFI. When compiling with SafeStack, llvm statically links a full sanitization framework into the application. FreeBSD includes a full copy of the sanitization framework in SafeStack, including the common C++ sanization namespaces. Thus, libclang_rt.safestack included code meant to be shared among all the sanitizers, not just SafeStack.\nI had naively taken a brute-force approach to setting up the libclang_rt.cfi static library. I copied the Makefile from libclang_rt.safestack and used that as a template for libclang_rt.cfi. This approach was incorrect due to breaking the One Definition Rule (ODR). Essentially, I ended up including a duplicate copy of the C++ classes and sanitizer runtime if both CFI and SafeStack were used.\nIn my Cross-DSO CFI development VM, I now have SafeStack disabled across-the-board and am only compiling in CFI. As of 26 May 2018, an LTO-ified world (libs + apps) works in my limited testing. /bin/ls does not crash anymore! The second major milestone for Cross-DSO CFI has now been reached.\n\n\n\nKnown Issues And Limitations\n\n\n\nThere are a few known issues and regressions. Note that this list of known issues essentially also constitutes a “work-in-progress” and every known issue will be fixed prior to the official launch of Cross-DSO CFI.\nIt seems llvm does not like statically compiling applications with LTO that have a mixture of C and C++ code. /sbin/devd is one of these applications. As such, when Cross-DSO CFI is enabled, devd is compiled as a Position-Independent Executable (PIE). Doing this breaks UFS systems where /usr is on a separate partition. We are currently looking into solving this issue to allow devd to be statically compiled again.\nNO_SHARED is now unset in the tools build stage (aka, bootstrap-tools, cross-tools). This is related to the static compilation issue above. Unsetting NO_SHARED for to tools build stage is only a band-aid until we can resolve static compliation with LTO.\nOne goal of our Cross-DSO CFI integration work is to be able to support the cfi-icall scheme when dlopen(3) and dlsym(3)/dlfunc(3) is used. This means the runtime linker (RTLD), must be enhanced to know and care about the CFI runtime. This enhancement is not currently implemented, but is planned.\nWhen Cross-DSO CFI is enabled, SafeStack is disabled. This is because compiling with Cross-DSO CFI brings in a second copy of the sanitizer runtime, violating the One Definition Rule (ODR). Resolving this issue should be straightforward: Unify the sanitizer runtime into a single common library that both Cross-DSO CFI and SafeStack can link against.  When the installed world has Cross-DSO CFI enabled, performing a buildworld with Cross-DSO CFI disabled fails. This is somewhat related to the static compilation issue described above.\n\n\n\nCurrent Status\n\n\n\nI’ve managed to get a Cross-DSO CFI world booting on bare metal (my development laptop) and in a VM. Some applications failed to work. Curiously, Firefox still worked (which also means xorg works).\nI’m now working through the known issues list, researching and learning.\n\n\n\nFuture Work\n\n\n\nFixing pretty much everything in the “Known Issues And Limitations” section. ;P\nI need to create a static library that includes only a single copy of the common sanitizer framework code. Applications compiled with CFI or SafeStack will then only have a single copy of the framework.\nNext I will need to integrate support in the RTLD for Cross-DSO CFI. Applications with the cfi-icall scheme enabled that call functions resolved through dlsym(3) currently crash due to the lack of RTLD support. I need to make a design decision as to whether to only support adding cfi-icall whitelist entries only with dlfunc(3) or to also whitelist cfi-icall entries with the more widely used dlsym(3).\nThere’s likely more items in the “TODO” bucket that I am not currently aware of. I’m treading in uncharted territory. I have no firm ETA for any bit of this work. We may gain Cross-DSO CFI support in 2018, but it’s looking like it will be later in either 2019 or 2020.\n\n\n\nConclusion\n\n\n\nI have been working on Cross-DSO CFI support in HardenedBSD for a little over a year now. A lot of progress is being made, yet there’s still some major hurdles to overcome. This work has already helped improve llvm and I hope more commits upstream to both FreeBSD and llvm will happen.\nWe’re getting closer to being able to send out a preliminary Call For Testing (CFT). At the very least, I would like to solve the static linking issues prior to publishing the CFT. Expect it to be published before the end of 2018.\nI would like to thank Ed Maste, Dimitry Andric, and Rafael Espindola for their help, guidance, and support.\n\n\n\n\niXsystems\nFreeNAS 11.2-BETAs are starting to appear\n\n###Bareos Backup Server on FreeBSD\n\n\nEver heard about Bareos? Probably heard about Bacula. Read what is the difference here – Why Bareos forked from Bacula?\nBareos (Backup Archiving Recovery Open Sourced) is a network based open source backup solution. It is 100% open source fork of the backup project from bacula.org site. The fork is in development since late 2010 and it has a lot of new features. The source is published on github and licensed under AGPLv3 license. Bareos supports ‘Always Incremental backup which is interesting especially for users with big data. The time and network capacity consuming full backups only have to be taken once. Bareos comes with WebUI for administration tasks and restore file browser. Bareos can backup data to disk and to tape drives as well as tape libraries. It supports compression and encryption both hardware-based (like on LTO tape drives) and software-based. You can also get professional services and support from Bareos as well as Bareos subscription service that provides you access to special quality assured installation packages.\n\n\n\nI started my sysadmin job with backup system as one of the new responsibilities, so it will be like going back to the roots. As I look on the ‘backup’ market it is more and more popular – especially in cloud oriented environments – to implement various levels of protection like GOLD, SILVER and BRONZE for example. They of course have different retention times, number of backups kept, different RTO and RPO. Below is a example implementation of BRONZE level backups in Bareos. I used 3 groups of A, B and C with FULL backup starting on DAY 0 (A group), DAY 1 (B group) and DAY 2 (C group).\nThis way you still have FULL backups quite often and with 3 groups you can balance the network load. I for the days that we will not be doing FULL backups we will be doing DIFFERENTIAL backups. People often confuse them with INCREMENTAL backups. The difference is that DIFFERENTIAL backups are always against FULL backup, so its always ‘one level of combining’. INCREMENTAL ones are done against last done backup TYPE, so its possible to have 100+ levels of combining against 99 earlier INCREMENTAL backups and the 1 FULL backup. That is why I prefer DIFFERENTIAL ones here, faster recovery. That is all backups is about generally, recovery, some people/companies tend to forget that.\nThe implementation of BRONZE in these three groups is not perfect, but ‘does the job’. I also made ‘simulation’ how these group will overlap at the end/beginning of the month, here is the result.\nNot bad for my taste.\n\n\n\nToday I will show you how to install and configure Bareos Server based on FreeBSD operating system. It will be the most simplified setup with all services on single machine:\n\n\n\nbareos-dir\nbareos-sd\nbareos-webui\nbareos-fd\n\n\n\nI also assume that in order to provide storage space for the backup data itself You would mount resources from external NFS shares.\n\n\n\nTo get in touch with Bareos terminology and technology check their great Manual in HTML or PDF version depending which format You prefer for reading documentation. Also their FAQ provides a lot of needed answers.\n\n\n\nAlso this diagram may be useful for You to get some grip into the Bareos world.\n\n\n\nSystem\n\n\n\nAs every system needs to have its name we will use latin word closest to backup here – replica – for our FreeBSD system hostname. The install would be generally the same as in the FreeBSD Desktop – Part 2 – Install article. Here is our installed FreeBSD system with login prompt.\n","content_html":"<p>Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/\">Silent Fanless FreeBSD Desktop/Server</a></p>\n\n<blockquote>\n<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multa##Headlines<br>\n###<a href=\"https://github.com/lattera/articles/blob/master/hardenedbsd/2018-05-26_cross-dso-cfi/article.md\">Cross-DSO CFI in HardenedBSD</a><br>\nControl Flow Integrity, or CFI, raises the bar for attackers aiming to hijack control flow and execute arbitrary code. The llvm compiler toolchain, included and used by default in HardenedBSD 12-CURRENT/amd64, supports forward-edge CFI. Backward-edge CFI support is gained via a tangential feature called SafeStack. Cross-DSO CFI builds upon ASLR and PaX NOEXEC for effectiveness.<br>\nHardenedBSD supports non-Cross-DSO CFI in base for 12-CURRENT/amd64 and has it enabled for a few individual ports. The term “non-Cross-DSO CFI” means that CFI is enabled for code within an application’s codebase, but not for the shared libraries it depends on. Supporting non-Cross-DSO CFI is an important initial milestone for supporting Cross-DSO CFI, or CFI applied to both shared libraries and applications.<br>\nThis article discusses where HardenedBSD stands with regards to Cross-DSO CFI in base. We have made a lot of progress, yet we’re not even half-way there.<br>\nBrace yourself: This article is going to be full of references to “Cross-DSO CFI.” Make a drinking game out of it. Or don’t. It’s your call. ;)</p>\n</blockquote>\n\n<ul>\n<li>Using More llvm Toolchain Components</li>\n</ul>\n\n<blockquote>\n<p>CFI requires compiling source files with Link-Time Optimization (LTO). I remembered hearing a few years back that llvm developers were able to compile the entirety of FreeBSD’s source code with LTO. Compiling with LTO produces intermediate object files as LLVM IR bitcode instead of ELF objects.<br>\nIn March of 2017, we started compiling all applications with LTO and non-Cross-DSO CFI. This also enabled ld.lld as the default linker in base since CFI requires lld. Commit f38b51668efcd53b8146789010611a4632cafade made the switch to ld.lld as the default linker while enabling non-Cross-DSO CFI at the same time.<br>\nBuilding libraries in base requires applications like ar, ranlib, nm, and objdump. In FreeBSD 12-CURRENT, ar and ranlib are known as “BSD ar” and “BSD ranlib.” In fact, ar and ranlib are the same applications. One is hardlinked to another and the application changes behavior depending on arvgv[0] ending in “ranlib”. The ar, nm, and objdump used in FreeBSD do not support LLVM IR bitcode object files.<br>\nIn preparation for Cross-DSO CFI support, commit fe4bb0104fc75c7216a6dafe2d7db0e3f5fe8257 in October 2017 saw HardenedBSD switching ar, ranlib, nm, and objdump to their respective llvm components. The llvm versions due support LLVM IR bitcode object files (surprise!) There has been some fallout in the ports tree and we’ve added LLVM_AR_UNSAFE and friends to help transition those ports that dislike llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump.<br>\nWith ld.lld, llvm-ar, llvm-ranlib, llvm-nm, and llvm-objdump the default, HardenedBSD has effectively switched to a full llvm compiler toolchain in 12-CURRENT/amd64.</p>\n</blockquote>\n\n<ul>\n<li>Building Libraries With LTO</li>\n</ul>\n\n<blockquote>\n<p>The primary 12-CURRENT development branch in HardenedBSD (hardened/current/master) only builds applications with LTO as mentioned in the secion above. My first attempt at building all static and shared libraries failed due to issues within llvm itself.<br>\nI reported these issues to FreeBSD. Ed Maste (emaste@), Dimitry Andric (dim@), and llvm’s Rafael Espindola expertly helped address these issues. Various commits within the llvm project by Rafael fully and quickly resolved the issues brought up privately in emails.<br>\nWith llvm fixed, I could now build nearly every library in base with LTO. I noticed, however, that if I kept non-Cross-DSO CFI and SafeStack enabled, all applications would segfault. Even simplistic applications like /bin/ls.<br>\nDisabling both non-Cross-DSO CFI and SafeStack, but keeping LTO produced a fully functioning world! I have spent the last few months figuring out why enabling either non-Cross-DSO CFI or SafeStack caused issues. This brings us to today.</p>\n</blockquote>\n\n<ul>\n<li>The Sanitizers in FreeBSD</li>\n</ul>\n\n<blockquote>\n<p>FreeBSD brought in all the files required for SafeStack and CFI. When compiling with SafeStack, llvm statically links a full sanitization framework into the application. FreeBSD includes a full copy of the sanitization framework in SafeStack, including the common C++ sanization namespaces. Thus, libclang_rt.safestack included code meant to be shared among all the sanitizers, not just SafeStack.<br>\nI had naively taken a brute-force approach to setting up the libclang_rt.cfi static library. I copied the Makefile from libclang_rt.safestack and used that as a template for libclang_rt.cfi. This approach was incorrect due to breaking the One Definition Rule (ODR). Essentially, I ended up including a duplicate copy of the C++ classes and sanitizer runtime if both CFI and SafeStack were used.<br>\nIn my Cross-DSO CFI development VM, I now have SafeStack disabled across-the-board and am only compiling in CFI. As of 26 May 2018, an LTO-ified world (libs + apps) works in my limited testing. /bin/ls does not crash anymore! The second major milestone for Cross-DSO CFI has now been reached.</p>\n</blockquote>\n\n<ul>\n<li>Known Issues And Limitations</li>\n</ul>\n\n<blockquote>\n<p>There are a few known issues and regressions. Note that this list of known issues essentially also constitutes a “work-in-progress” and every known issue will be fixed prior to the official launch of Cross-DSO CFI.<br>\nIt seems llvm does not like statically compiling applications with LTO that have a mixture of C and C++ code. /sbin/devd is one of these applications. As such, when Cross-DSO CFI is enabled, devd is compiled as a Position-Independent Executable (PIE). Doing this breaks UFS systems where /usr is on a separate partition. We are currently looking into solving this issue to allow devd to be statically compiled again.<br>\nNO_SHARED is now unset in the tools build stage (aka, bootstrap-tools, cross-tools). This is related to the static compilation issue above. Unsetting NO_SHARED for to tools build stage is only a band-aid until we can resolve static compliation with LTO.<br>\nOne goal of our Cross-DSO CFI integration work is to be able to support the cfi-icall scheme when dlopen(3) and dlsym(3)/dlfunc(3) is used. This means the runtime linker (RTLD), must be enhanced to know and care about the CFI runtime. This enhancement is not currently implemented, but is planned.<br>\nWhen Cross-DSO CFI is enabled, SafeStack is disabled. This is because compiling with Cross-DSO CFI brings in a second copy of the sanitizer runtime, violating the One Definition Rule (ODR). Resolving this issue should be straightforward: Unify the sanitizer runtime into a single common library that both Cross-DSO CFI and SafeStack can link against.  When the installed world has Cross-DSO CFI enabled, performing a buildworld with Cross-DSO CFI disabled fails. This is somewhat related to the static compilation issue described above.</p>\n</blockquote>\n\n<ul>\n<li>Current Status</li>\n</ul>\n\n<blockquote>\n<p>I’ve managed to get a Cross-DSO CFI world booting on bare metal (my development laptop) and in a VM. Some applications failed to work. Curiously, Firefox still worked (which also means xorg works).<br>\nI’m now working through the known issues list, researching and learning.</p>\n</blockquote>\n\n<ul>\n<li>Future Work</li>\n</ul>\n\n<blockquote>\n<p>Fixing pretty much everything in the “Known Issues And Limitations” section. ;P<br>\nI need to create a static library that includes only a single copy of the common sanitizer framework code. Applications compiled with CFI or SafeStack will then only have a single copy of the framework.<br>\nNext I will need to integrate support in the RTLD for Cross-DSO CFI. Applications with the cfi-icall scheme enabled that call functions resolved through dlsym(3) currently crash due to the lack of RTLD support. I need to make a design decision as to whether to only support adding cfi-icall whitelist entries only with dlfunc(3) or to also whitelist cfi-icall entries with the more widely used dlsym(3).<br>\nThere’s likely more items in the “TODO” bucket that I am not currently aware of. I’m treading in uncharted territory. I have no firm ETA for any bit of this work. We may gain Cross-DSO CFI support in 2018, but it’s looking like it will be later in either 2019 or 2020.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>I have been working on Cross-DSO CFI support in HardenedBSD for a little over a year now. A lot of progress is being made, yet there’s still some major hurdles to overcome. This work has already helped improve llvm and I hope more commits upstream to both FreeBSD and llvm will happen.<br>\nWe’re getting closer to being able to send out a preliminary Call For Testing (CFT). At the very least, I would like to solve the static linking issues prior to publishing the CFT. Expect it to be published before the end of 2018.<br>\nI would like to thank Ed Maste, Dimitry Andric, and Rafael Espindola for their help, guidance, and support.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong><br>\nFreeNAS 11.2-BETAs are starting to appear</p>\n\n<p>###<a href=\"https://vermaden.wordpress.com/2018/05/01/bareos-backup-server-on-freebsd/\">Bareos Backup Server on FreeBSD</a></p>\n\n<blockquote>\n<p>Ever heard about Bareos? Probably heard about Bacula. Read what is the difference here – Why Bareos forked from Bacula?<br>\nBareos (Backup Archiving Recovery Open Sourced) is a network based open source backup solution. It is 100% open source fork of the backup project from <a href=\"http://bacula.org\">bacula.org</a> site. The fork is in development since late 2010 and it has a lot of new features. The source is published on github and licensed under AGPLv3 license. Bareos supports ‘Always Incremental backup which is interesting especially for users with big data. The time and network capacity consuming full backups only have to be taken once. Bareos comes with WebUI for administration tasks and restore file browser. Bareos can backup data to disk and to tape drives as well as tape libraries. It supports compression and encryption both hardware-based (like on LTO tape drives) and software-based. You can also get professional services and support from Bareos as well as Bareos subscription service that provides you access to special quality assured installation packages.</p>\n</blockquote>\n\n<blockquote>\n<p>I started my sysadmin job with backup system as one of the new responsibilities, so it will be like going back to the roots. As I look on the ‘backup’ market it is more and more popular – especially in cloud oriented environments – to implement various levels of protection like GOLD, SILVER and BRONZE for example. They of course have different retention times, number of backups kept, different RTO and RPO. Below is a example implementation of BRONZE level backups in Bareos. I used 3 groups of A, B and C with FULL backup starting on DAY 0 (A group), DAY 1 (B group) and DAY 2 (C group).<br>\nThis way you still have FULL backups quite often and with 3 groups you can balance the network load. I for the days that we will not be doing FULL backups we will be doing DIFFERENTIAL backups. People often confuse them with INCREMENTAL backups. The difference is that DIFFERENTIAL backups are always against FULL backup, so its always ‘one level of combining’. INCREMENTAL ones are done against last done backup TYPE, so its possible to have 100+ levels of combining against 99 earlier INCREMENTAL backups and the 1 FULL backup. That is why I prefer DIFFERENTIAL ones here, faster recovery. That is all backups is about generally, recovery, some people/companies tend to forget that.<br>\nThe implementation of BRONZE in these three groups is not perfect, but ‘does the job’. I also made ‘simulation’ how these group will overlap at the end/beginning of the month, here is the result.<br>\nNot bad for my taste.</p>\n</blockquote>\n\n<blockquote>\n<p>Today I will show you how to install and configure Bareos Server based on FreeBSD operating system. It will be the most simplified setup with all services on single machine:</p>\n</blockquote>\n\n<ul>\n<li>bareos-dir</li>\n<li>bareos-sd</li>\n<li>bareos-webui</li>\n<li>bareos-fd</li>\n</ul>\n\n<blockquote>\n<p>I also assume that in order to provide storage space for the backup data itself You would mount resources from external NFS shares.</p>\n</blockquote>\n\n<blockquote>\n<p>To get in touch with Bareos terminology and technology check their great Manual in HTML or PDF version depending which format You prefer for reading documentation. Also their FAQ provides a lot of needed answers.</p>\n</blockquote>\n\n<blockquote>\n<p>Also this diagram may be useful for You to get some grip into the Bareos world.</p>\n</blockquote>\n\n<ul>\n<li>System</li>\n</ul>\n\n<blockquote>\n<p>As every system needs to have its name we will use latin word closest to backup here – replica – for our FreeBSD system hostname. The install would be generally the same as in the FreeBSD Desktop – Part 2 – Install article. Here is our installed FreeBSD system with login prompt.</p>\n</blockquote>","summary":"Control flow integrity with HardenedBSD, fixing bufferbloat with OpenBSD’s pf, Bareos Backup Server on FreeBSD, MeetBSD CfP, crypto simplified interface, twitter gems, interesting BSD commits, and more.","date_published":"2018-07-12T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/d28fb670-e841-4f88-b58f-768d8876f126.mp3","mime_type":"audio/mp3","size_in_bytes":54900530,"duration_in_seconds":5483}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2208","title":"Episode 253: Silence of the Fans | BSD Now 253","url":"https://www.bsdnow.tv/253","content_text":"Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD's Korn Shell on Plan9, static site generators on OpenBSD, and more.\n\n##Headlines\n###Silent Fanless FreeBSD Desktop/Server\n\n\nToday I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multiple purposes. It also very low power solution, which also means that it will not overheat. Silent means no fans at all, even for the PSU. The format of the system should also be brought to minimum, so Mini-ITX seems best solution here.\n\n\n\nI have chosen Intel based solutions as they are very low power (6-10W), if you prefer AMD (as I often do) the closest solution in comparable price and power is Biostar A68N-2100 motherboard with AMD E1-2100 CPU and 9W power. Of course AMD has even more low power SoC solutions but finding the Mini-ITX motherboard with decent price is not an easy task. For comparison Intel has lots of such solutions below 6W whose can be nicely filtered on the ark.intel.com page. Pity that AMD does not provide such filtration for their products. I also chosen AES instructions as storage encryption (GELI on FreeBSD) today seems as obvious as HTTPS for the web pages.\n\n\n\nHere is how the system look powered up and working\n\n\n\nThis motherboard uses Intel J3355 SoC which uses 10W and has AES instructions. It has two cores at your disposal but it also supports VT-x and EPT extensions so you can even run Bhyve on it.\n\n\n\nComponents\n\n\n\nNow, an example system would look like that one below, here are the components with their prices.\n\n\n\n$49  CPU/Motherboard ASRock J3355B-ITX Mini-ITX\n$14  RAM Crucial 4 GB DDR3L 1.35V (low power)\n$17  PSU 12V 160W Pico (internal)\n$11  PSU 12V 96W FSP (external)\n$5  USB 2.0 Drive 16 GB ADATA\n$4  USB Wireless 802.11n\n$100  TOTAL\n\n\n\nThe PSU 12V 160W Pico (internal) and PSU 12V 96W FSP can be purchased on aliexpress.com or ebay.com for example, at least I got them there.  Here is the 12V 160W Pico (internal) PSU and its optional additional cables to power the optional HDDs. If course its one SATA power and one MOLEX power so additional MOLEX-SATA power adapter for about 1$ would be needed. Here is the 12V 96W FSP (external) PSU without the power cord.\n\n\n\nThis gives as total silent fanless system price of about $120. Its about ONE TENTH OF THE COST of the cheapest FreeNAS hardware solution available – the FreeNAS Mini (Diskless) costs $1156 also without disks.\n\n\n\nYou can put plain FreeBSD on top of it or Solaris/Illumos distribution OmniOSce which is server oriented. You can use prebuilt NAS solution based on FreeBSD like FreeNAS, NAS4Free, ZFSguru or even Solaris/Illumos based storage with napp-it appliance.\n\n\n\n\n###An annotated look at a NetBSD Pinebook’s startup\n\n\nPinebook is an affordable 64-bit ARM notebook. Today we’re going to take a look at the kernel output at startup and talk about what hardware support is available on NetBSD.\nPhoto\nPinebook comes with 2GB RAM standard. A small amount of this is reserved by the kernel and framebuffer.\nNetBSD uses flattened device-tree (FDT) to enumerate devices on all Allwinner based SoCs. On a running system, you can inspect the device tree using the ofctl(8) utility:\nPinebook’s Allwinner A64 processor is based on the ARM Cortex-A53. It is designed to run at frequencies up to 1.2GHz.\nThe A64 is a quad core design. NetBSD’s aarch64 pmap does not yet support SMP, so three cores are disabled for now.\nThe interrupt controller is a standard ARM GIC-400 design.\nClock drivers for managing PLLs, module clock dividers, clock gating, software resets, etc. Information about the clock tree is exported in the hw.clk sysctl namespace (root access required to read these values).\n\n\n# sysctl hw.clk.sun50ia64ccu0.mmc2\nhw.clk.sun50ia64ccu0.mmc2.rate = 200000000\nhw.clk.sun50ia64ccu0.mmc2.parent = pll_periph0_2x\nhw.clk.sun50ia64ccu0.mmc2.parent_domain = sun50ia64ccu0\n\n\n\n\nDigital Ocean\nhttp://do.co/bsdnow\n\n###BSDCan 2018 Trip Report: Mark Johnston\n\n\nBSDCan is a highlight of my summers: the ability to have face-to-face conversations with fellow developers and contributors is invaluable and always helps refresh my enthusiasm for FreeBSD.  While in a perfect world we would all be able to communicate effectively over the Internet, it’s often noted that locking a group of developers together in a room can be a very efficient way to make progress on projects that otherwise get strung out over time, and to me this is one of the principal functions of BSD conferences.  In my case I was able to fix some kgdb bugs that had been hindering me for months; get some opinions on the design of a feature I’ve been working on for FreeBSD 12.0; hear about some ongoing usage of code that I’ve worked on; and do some pair-debugging of an issue that has been affecting another developer.\nAs is tradition, on Tuesday night I dropped off my things at the university residence where I was staying, and headed straight to the Royal Oak.  This year it didn’t seem quite as packed with BSD developers, but I did meet several long-time colleagues and get a chance to catch up.  In particular, I chatted with Justin Hibbits and got to hear about the bring-up of FreeBSD on POWER9, a new CPU family released by IBM.  Justin was able to acquire a workstation based upon this CPU, which is a great motivator for getting FreeBSD into shape on that platform.  POWER9 also has some promise in the server market, so it’s important for FreeBSD to be a viable OS choice there.\nWednesday morning saw the beginning of the two-day FreeBSD developer summit, which precedes the conference proper.  Gordon Tetlow led the summit and did an excellent job organizing things and keeping to the schedule.  The first presentation was by Deb Goodkin of the FreeBSD Foundation, who gave an overview of the Foundation’s role and activities. After Deb’s presentation, present members of the FreeBSD core team discussed the work they had done over the past two years, as well as open tasks that would be handed over to the new core team upon completion of the ongoing election.  Finally, Marius Strobl rounded off the day’s presentations by discussing the state and responsibilities of FreeBSD’s release engineering team.\nOne side discussion of interest to me was around the notion of tightening integration with our Bugzilla instance; at moment we do not have any good means to mark a given bug as blocking a release, making it easy for bugs to slip into releases and thus lowering our overall quality.  With FreeBSD 12.0 upon us, I plan to help with the triage and fixes for known regressions before the release process begins.\nAfter a break, the rest of the morning was devoted to plans for features in upcoming FreeBSD releases.  This is one of my favorite discussion topics and typically takes the form of have/need/want, where developers collectively list features that they’ve developed and intend to upstream (have), features that they are missing (need), and nice-to-have features (want).  This year, instead of the usual format, we listed features that are intended to ship in FreeBSD 12.0.  The compiled list ended up being quite ambitious given how close we are to the beginning of the release cycle, but many individual developers (including myself) have signed up to deliver work.  I’m hopeful that most, if not all of it, will make it into the release.\nAfter lunch, I attended a discussion led by Matt Ahrens and Alexander Motin on OpenZFS.  Of particular interest to me were some observations made regarding the relative quantity and quality of contributions made by different “camps” of OpenZFS users (illumos, FreeBSD and ZoL), and their respective track records of upstreaming enhancements to the OpenZFS project. In part due to the high pace of changes in ZoL, the definition of “upstream” for ZFS has become murky, and of late ZFS changes have been ported directly from ZoL.  Alexander discussed some known problems with ZFS on FreeBSD that have been discovered through performance testing.  While I’m not familiar with ZFS internals, Alexander noted that ZFS’ write path has poor SMP scalability on FreeBSD owing to some limitations in a certain kernel API called taskqueue(9).  I would like to explore this problem further and perhaps integrate a relatively new alternative interface which should perform better.\nFriday and Saturday were, of course, taken up by BSDCan talks.  Friday’s keynote was by Benno Rice, who provided some history of UNIX boot systems as a precursor to some discussion of systemd and the difficulties presented by a user and developer community that actively resist change.  The rest of the morning was consumed by talks and passed by quickly. First was Colin Percival’s detailed examination of where the FreeBSD kernel spends time during boot, together with an overview of some infrastructure he added to track boot times. He also provided a list of improvements that have been made since he started taking measurements, and some areas we can further improve.  Colin’s existing work in this area has already brought about substantial reductions in boot time; amusingly, one of the remaining large delays comes from the keyboard driver, which contains a workaround for old PS/2 keyboards.  While there seems to be general agreement that the workaround is probably no longer needed on most systems, the lingering uncertainty around this prevents us from removing the workaround.  This is, sadly, a fairly typical example of an OS maintenance burden, and underscores the need to carefully document hardware bug workarounds.  After this talk, I got to see some rather novel demonstrations of system tracing using dwatch, a new utility by Devin Teske, which aims to provide a user-friendly interface to DTrace.  After lunch, I attended talks on netdump, a protocol for transmitting kernel dumps over a network after the system has panicked, and on a VPC implementation for FreeBSD.  After the talks ended, I headed yet again to the hacker lounge and had some fruitful discussions on early microcode loading (one of my features for FreeBSD 12.0). These led me to reconsider some aspects of my approach and saved me a lot of time.  Finally, I continued my debugging session from Wednesday with help from a couple of other developers.\nSaturday’s talks included a very thorough account by Li-Wen Hsu of his work in organizing a BSD conference in Taipei last year.  As one of the attendees, I had felt that the conference had gone quite smoothly and was taken aback by the number of details and pitfalls that Li-Wen enumerated during his talk. This was followed by an excellent talk by Baptiste Daroussin on the difficulties one encounters when deploying FreeBSD in new environments. Baptiste offered criticisms of a number of aspects of FreeBSD, some of which hit close to home as they involved portions of the system that I’ve worked on.\nAt the conclusion of the talks, we all gathered in the main lecture hall, where Dan led a traditional and quite lively auction for charity.  I managed to snag a Pine64 board and will be getting FreeBSD installed on it the first chance I get.  At the end of the auction, we all headed to ByWard for dinner, concluding yet another BSDCan.\n\n\n\nThanks to Mark for sharing his experiences at this years BSDCan\n\n\n\n\n##News Roundup\n###Transparent network audio with mpd &amp; sndiod\n\n\nLandry Breuil (landry@ when wearing his developer hat) wrote in…\n\n\nI've been a huge fan of MPD over the years to centralize my audio collection, and i've been using it with the http output to stream the music as a radio on the computer i'm currently using…\n\naudio_output {\n       type            \"sndio\"\n       name            \"Local speakers\"\n       mixer_type      \"software\"\n}\naudio_output {\n       type            \"httpd\"\n       name            \"HTTP stream\"\n       mixer_type      \"software\"\n       encoder         \"vorbis\"\n       port            \"8000\"\n       format          \"44100:16:2\"\n}\nthis setup worked for years, allows me to stream my home radio to $work by tunnelling the port 8000 over ssh via LocalForward, but that still has some issues:\n\na distinct timing gap between the 'local output' (ie the speakers connected to the machine where MPD is running) and the 'http output' caused by the time it takes to reencode the stream, which is ugly when you walk through the house and have a 15s delay\nsometimes mplayer as a client doesn't detect the pauses in the stream and needs to be restarted\ni need to configure/start a client on each computer and point it at the sound server url (can do via gmpc shoutcast client plugin…)\nit's not that elegant to reencode the stream, and it wastes cpu cycles\nSo the current scheme is:\n\nmpd -&gt; http output -&gt; network -&gt; mplayer -&gt; sndiod on remote machine\n|\n-&gt; sndio output -&gt; sndiod on soundserver\nFiddling a little bit with mpd outputs and reading the sndio output driver, i remembered sndiod has native network support… and the mpd sndio output allows you to specify a device (it uses SIO_DEVANY by default).\n\nSo in the end, it's super easy to:\n\nenable network support in sndio on the remote machine i want the audio to play by adding -L&lt;local ip&gt; to sndiod_flags (i have two audio devices, with an input coming from the webcam):\nsndiod_flags=\"-L10.246.200.10 -f rsnd/0 -f rsnd/1\"\nopen pf on port 11025 from the sound server ip:\npass in proto tcp from 10.246.200.1 to any port 11025\nconfigure a new output in mpd:\naudio_output {\n       type            \"sndio\"\n       name            \"sndio on renton\"\n       device          \"snd@10.246.200.10/0\"\n       mixer_type      \"software\"\n}\nand enable the new output in mpd:\n$mpc enable 2\nOutput 1 (Local speakers) is disabled\nOutput 2 (sndio on renton) is enabled\nOutput 3 (HTTP stream) is disabled\nResults in a big win: no gap anymore with the local speakers, no reencoding, no need to configure a client to play the stream, and i can still probably reproduce the same scheme over ssh from $work using a RemoteForward.\n\nmpd -&gt; sndio output 2 -&gt; network -&gt; sndiod on remote machine\n|\n-&gt; sndio output 1 -&gt; sndiod on soundserver\nThanks ratchov@ for sndiod :)\n\n\n\n\n###MirBSD’s Korn Shell on Plan9 Jehanne\n\n\nLet start by saying that I’m not really a C programmer.\nMy last public contribution to a POSIX C program was a little improvement to the Snort’s react module back in 2008.\nSo while I know the C language well enough, I do not know anything about the subtleness of the standard library and I have little experience with POSIX semantics.\nThis is not a big issue with Plan 9, since the C library and compiler are not standard anyway, but with Jehanne (a Plan 9 derivative of my own) I want to build a simple, loosely coupled, system that can actually run useful free software ported from UNIX.\nSo I ported RedHat’s newlib to Jehanne on top of a new system library I wrote, LibPOSIX, that provides the necessary emulations. I wrote several test, checking they run the same on Linux and Jehanne, and then I begun looking for a real-world, battle tested, application to port first.\nI approached MirBSD’s Korn Shell for several reason:\n\n\n\nit is simple, powerful and well written\nit has been ported to several different operating systems\nit has few dependencies\nit’s the default shell in Android, so it’s really battle tested\n\n\n\nI was very confident. I had read the POSIX standard after all! And I had a test suite!\nI remember, I thought “Given newlib, how hard can it be?”\nThe porting begun on September 1, 2017. It was completed by tg on January 5, 2018. 125 nights later.\nTurn out, my POSIX emulation was badly broken. Not just because of the usual bugs that any piece of C can have: I didn’t understood most POSIX semantics at all!\n\n\n\n\niXsystems\n\n###Static site generator with rsync and lowdown on OpenBSD\n\n\n\nssg is a tiny POSIX-compliant shell script with few dependencies:\n\n\nlowdown(1) to parse markdown,\n\n\nrsync(1) to copy temporary files, and\n\n\nentr(1) to watch file changes.\n\n\nIt generates Markdown articles to a static website.\n\n\nIt copies the current directory to a temporary on in /tmp skipping .* and _*, renders all Markdown articles to HTML, generates RSS feed based on links from index.html, extracts the first &lt;h1&gt; tag from every article to generate a sitemap and use it as a page title, then wraps articles with a single HTML template, copies everything from the temporary directory to $DOCS/\n\n\n\n\nWhy not Jekyll or “$X”?\n\n\n\nssg is one hundred times smaller than Jekyll.\n\n\n\nssg and its dependencies are about 800KB combined. Compare that to 78MB of ruby with Jekyll and all the gems. So ssg can be installed in just few seconds on almost any Unix-like operating system.\nObviously, ssg is tailored for my needs, it has all features I need and only those I use.\nKeeping ssg helps you to master your Unix-shell skills: awk, grep, sed, sh, cut, tr. As a web developer you work with lots of text: code and data. So you better master these wonderful tools.\n\n\n\nPerformance\n\n\n\n100 pps. On modern computers ssg generates a hundred pages per second. Half of a time for markdown rendering and another half for wrapping articles into the template. I heard good static site generators work—twice as fast—at 200 pps, so there’s lots of performance that can be gained. ;)\n\n\n\n\n###Why does FreeBSD have virtually no (0%) desktop market share?\n\n\nBecause someone made a horrible design decision back in 1984.\n\n\n\nIn absolute fairness to those involved, it was an understandable decision, both from a research perspective, and from an economic perspective, although likely not, from a technology perspective.\n\n\n\nWhy and what.\n\n\n\nThe decision was taken because the X Window System was intended to run on cheap hardware, and, at the time, that meant reduced functionality in the end-point device with the physical display attached to it.\nAt the same time, another force was acting to also limit X displays to display services only, rather than rolling in both window management and specific widget instances for common operational paradigms.\nMostly, common operational paradigms didn’t really exist for windowing systems because they also simply didn’t exist at the time, and no one really knew how people were going to use the things, and so researchers didn’t want to commit future research to a set of hard constraints.\nSo a decision was made: separate the display services from the application at the lowest level of graphics primitives currently in use at the time.\n\n\n\nThe ramifications of this were pretty staggering.\n\n\n\nFirst, it guaranteed that all higher level graphics would live on the host side of the X protocol, instead of on the display device side of the protocol.\nDespite a good understanding of Moore’s law, and the fact that, since no X Terminals existed at the time as hardware, but were instead running as emulations on workstations that had sufficient capability, this put the higher level GUI object libraries — referred to as “widgets” — in host libraries linked into the applications.\nSecond, it guaranteed that display organization and management paradigms would also live on the host side of the protocol — assumed, in contradiction to the previous decision, to be running on the workstation.\nBut, presumably, at some point, as lightweight X Terminals became available, to migrate to a particular host computer managing compute resource login/access services.\n\n\n\nBetween these early decisions reigned chaos.\n\n\n\nSpecifically, the consequences of these decisions have been with us ever since:\nLook-and-feel are a consequence of the toolkit chosen by the application programmer, rather than a user decision which applies universally to all applications.\nYou could call this “lack of a theme”, and — although I personally despise the idea of customizing or “theming” desktops — this meant that one paradigm chosen by the user would not apply universally across all applications, no matter who had written them.\nWindow management style is a preference.\nYou could call this a more radical version of “theming” — which you will remember, I despise — but a consequence to this is that training is not universal across personnel using such systems, nor is it transferrable.\nIn other words, I can’t send someone to a class, and have them come back and use the computers in the office as a tool, with the computer itself — and the elements not specific to the application itself — disappearing into the background.\nBoth of these ultimately render an X-based system unsuitable for desktops.\nI can’t pay once for training. Training that I do pay for does not easily and naturally translate between applications. Each new version may radically alter the desktop management paradigm into unrecognizability.\n\n\n\nIs there hope for the future?\n\n\n\nWell, the Linux community has been working on something called Wayland, and it is very promising…\n…In the same way X was “very promising” in 1984, because, unfortunately, they are making exactly the same mistakes X made in 1984, rather than correcting them, now that we have 20/20 hindsight, and know what a mature widget library should look like.\nSo Wayland is screwing up again.\nBut hey, it only took us, what, 25 years to get from X in 1987 to Wayland in in 2012.\nMaybe if we try again in 2037, we can get to where Windows was in 1995.\n\n\n\n\n##Beastie Bits\n\n\nNew washing machine comes with 7 pages of open source licenses!\nBSD Jobs Site\nFreeBSD Foundation Update, May 2018\nFreeBSD Journal looking for book reviewers\nzedenv ZFS Boot Environment Manager\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nWouter - Feedback\nEfraim - OS Suggestion\nkevr - Raspberry Pi2/FreeBSD/Router on a Stick\nVanja - Interview Suggestion\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD&#39;s Korn Shell on Plan9, static site generators on OpenBSD, and more.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://vermaden.wordpress.com/2018/06/07/silent-fanless-freebsd-desktop-server/\">Silent Fanless FreeBSD Desktop/Server</a></p>\n\n<blockquote>\n<p>Today I will write about silent fanless FreeBSD desktop or server computer … or NAS … or you name it, it can have multiple purposes. It also very low power solution, which also means that it will not overheat. Silent means no fans at all, even for the PSU. The format of the system should also be brought to minimum, so Mini-ITX seems best solution here.</p>\n</blockquote>\n\n<blockquote>\n<p>I have chosen Intel based solutions as they are very low power (6-10W), if you prefer AMD (as I often do) the closest solution in comparable price and power is Biostar A68N-2100 motherboard with AMD E1-2100 CPU and 9W power. Of course AMD has even more low power SoC solutions but finding the Mini-ITX motherboard with decent price is not an easy task. For comparison Intel has lots of such solutions below 6W whose can be nicely filtered on the <a href=\"http://ark.intel.com\">ark.intel.com</a> page. Pity that AMD does not provide such filtration for their products. I also chosen AES instructions as storage encryption (GELI on FreeBSD) today seems as obvious as HTTPS for the web pages.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://vermaden.files.wordpress.com/2018/06/itx-mobo.jpg\">Here is how the system look powered up and working</a></li>\n</ul>\n\n<blockquote>\n<p>This motherboard uses Intel J3355 SoC which uses 10W and has AES instructions. It has two cores at your disposal but it also supports VT-x and EPT extensions so you can even run Bhyve on it.</p>\n</blockquote>\n\n<ul>\n<li>Components</li>\n</ul>\n\n<blockquote>\n<p>Now, an example system would look like that one below, here are the components with their prices.</p>\n</blockquote>\n\n<ul>\n<li>$49  CPU/Motherboard ASRock J3355B-ITX Mini-ITX</li>\n<li>$14  RAM Crucial 4 GB DDR3L 1.35V (low power)</li>\n<li>$17  PSU 12V 160W Pico (internal)</li>\n<li>$11  PSU 12V 96W FSP (external)</li>\n<li>$5  USB 2.0 Drive 16 GB ADATA</li>\n<li>$4  USB Wireless 802.11n</li>\n<li>$100  TOTAL</li>\n</ul>\n\n<blockquote>\n<p>The PSU 12V 160W Pico (internal) and PSU 12V 96W FSP can be purchased on <a href=\"http://aliexpress.com\">aliexpress.com</a> or <a href=\"http://ebay.com\">ebay.com</a> for example, at least I got them there.  Here is the 12V 160W Pico (internal) PSU and its optional additional cables to power the optional HDDs. If course its one SATA power and one MOLEX power so additional MOLEX-SATA power adapter for about 1$ would be needed. Here is the 12V 96W FSP (external) PSU without the power cord.</p>\n</blockquote>\n\n<blockquote>\n<p>This gives as total silent fanless system price of about $120. Its about ONE TENTH OF THE COST of the cheapest FreeNAS hardware solution available – the FreeNAS Mini (Diskless) costs $1156 also without disks.</p>\n</blockquote>\n\n<blockquote>\n<p>You can put plain FreeBSD on top of it or Solaris/Illumos distribution OmniOSce which is server oriented. You can use prebuilt NAS solution based on FreeBSD like FreeNAS, NAS4Free, ZFSguru or even Solaris/Illumos based storage with napp-it appliance.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/pinebook\">An annotated look at a NetBSD Pinebook’s startup</a></p>\n\n<ul>\n<li>Pinebook is an affordable 64-bit ARM notebook. Today we’re going to take a look at the kernel output at startup and talk about what hardware support is available on NetBSD.</li>\n<li><a href=\"https://twitter.com/jmcwhatever/status/998258710496628736/photo/1\">Photo</a></li>\n<li>Pinebook comes with 2GB RAM standard. A small amount of this is reserved by the kernel and framebuffer.</li>\n<li>NetBSD uses flattened device-tree (FDT) to enumerate devices on all Allwinner based SoCs. On a running system, you can inspect the device tree using the ofctl(8) utility:</li>\n<li>Pinebook’s Allwinner A64 processor is based on the ARM Cortex-A53. It is designed to run at frequencies up to 1.2GHz.</li>\n<li>The A64 is a quad core design. NetBSD’s aarch64 pmap does not yet support SMP, so three cores are disabled for now.</li>\n<li>The interrupt controller is a standard ARM GIC-400 design.</li>\n<li>Clock drivers for managing PLLs, module clock dividers, clock gating, software resets, etc. Information about the clock tree is exported in the hw.clk sysctl namespace (root access required to read these values).</li>\n</ul>\n\n<pre><code># sysctl hw.clk.sun50ia64ccu0.mmc2\nhw.clk.sun50ia64ccu0.mmc2.rate = 200000000\nhw.clk.sun50ia64ccu0.mmc2.parent = pll_periph0_2x\nhw.clk.sun50ia64ccu0.mmc2.parent_domain = sun50ia64ccu0\n</code></pre>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong><br>\n<a href=\"http://do.co/bsdnow\">http://do.co/bsdnow</a></p>\n\n<p>###<a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-trip-report-mark-johnston/\">BSDCan 2018 Trip Report: Mark Johnston</a></p>\n\n<blockquote>\n<p>BSDCan is a highlight of my summers: the ability to have face-to-face conversations with fellow developers and contributors is invaluable and always helps refresh my enthusiasm for FreeBSD.  While in a perfect world we would all be able to communicate effectively over the Internet, it’s often noted that locking a group of developers together in a room can be a very efficient way to make progress on projects that otherwise get strung out over time, and to me this is one of the principal functions of BSD conferences.  In my case I was able to fix some kgdb bugs that had been hindering me for months; get some opinions on the design of a feature I’ve been working on for FreeBSD 12.0; hear about some ongoing usage of code that I’ve worked on; and do some pair-debugging of an issue that has been affecting another developer.<br>\nAs is tradition, on Tuesday night I dropped off my things at the university residence where I was staying, and headed straight to the Royal Oak.  This year it didn’t seem quite as packed with BSD developers, but I did meet several long-time colleagues and get a chance to catch up.  In particular, I chatted with Justin Hibbits and got to hear about the bring-up of FreeBSD on POWER9, a new CPU family released by IBM.  Justin was able to acquire a workstation based upon this CPU, which is a great motivator for getting FreeBSD into shape on that platform.  POWER9 also has some promise in the server market, so it’s important for FreeBSD to be a viable OS choice there.<br>\nWednesday morning saw the beginning of the two-day FreeBSD developer summit, which precedes the conference proper.  Gordon Tetlow led the summit and did an excellent job organizing things and keeping to the schedule.  The first presentation was by Deb Goodkin of the FreeBSD Foundation, who gave an overview of the Foundation’s role and activities. After Deb’s presentation, present members of the FreeBSD core team discussed the work they had done over the past two years, as well as open tasks that would be handed over to the new core team upon completion of the ongoing election.  Finally, Marius Strobl rounded off the day’s presentations by discussing the state and responsibilities of FreeBSD’s release engineering team.<br>\nOne side discussion of interest to me was around the notion of tightening integration with our Bugzilla instance; at moment we do not have any good means to mark a given bug as blocking a release, making it easy for bugs to slip into releases and thus lowering our overall quality.  With FreeBSD 12.0 upon us, I plan to help with the triage and fixes for known regressions before the release process begins.<br>\nAfter a break, the rest of the morning was devoted to plans for features in upcoming FreeBSD releases.  This is one of my favorite discussion topics and typically takes the form of have/need/want, where developers collectively list features that they’ve developed and intend to upstream (have), features that they are missing (need), and nice-to-have features (want).  This year, instead of the usual format, we listed features that are intended to ship in FreeBSD 12.0.  The compiled list ended up being quite ambitious given how close we are to the beginning of the release cycle, but many individual developers (including myself) have signed up to deliver work.  I’m hopeful that most, if not all of it, will make it into the release.<br>\nAfter lunch, I attended a discussion led by Matt Ahrens and Alexander Motin on OpenZFS.  Of particular interest to me were some observations made regarding the relative quantity and quality of contributions made by different “camps” of OpenZFS users (illumos, FreeBSD and ZoL), and their respective track records of upstreaming enhancements to the OpenZFS project. In part due to the high pace of changes in ZoL, the definition of “upstream” for ZFS has become murky, and of late ZFS changes have been ported directly from ZoL.  Alexander discussed some known problems with ZFS on FreeBSD that have been discovered through performance testing.  While I’m not familiar with ZFS internals, Alexander noted that ZFS’ write path has poor SMP scalability on FreeBSD owing to some limitations in a certain kernel API called taskqueue(9).  I would like to explore this problem further and perhaps integrate a relatively new alternative interface which should perform better.<br>\nFriday and Saturday were, of course, taken up by BSDCan talks.  Friday’s keynote was by Benno Rice, who provided some history of UNIX boot systems as a precursor to some discussion of systemd and the difficulties presented by a user and developer community that actively resist change.  The rest of the morning was consumed by talks and passed by quickly. First was Colin Percival’s detailed examination of where the FreeBSD kernel spends time during boot, together with an overview of some infrastructure he added to track boot times. He also provided a list of improvements that have been made since he started taking measurements, and some areas we can further improve.  Colin’s existing work in this area has already brought about substantial reductions in boot time; amusingly, one of the remaining large delays comes from the keyboard driver, which contains a workaround for old PS/2 keyboards.  While there seems to be general agreement that the workaround is probably no longer needed on most systems, the lingering uncertainty around this prevents us from removing the workaround.  This is, sadly, a fairly typical example of an OS maintenance burden, and underscores the need to carefully document hardware bug workarounds.  After this talk, I got to see some rather novel demonstrations of system tracing using dwatch, a new utility by Devin Teske, which aims to provide a user-friendly interface to DTrace.  After lunch, I attended talks on netdump, a protocol for transmitting kernel dumps over a network after the system has panicked, and on a VPC implementation for FreeBSD.  After the talks ended, I headed yet again to the hacker lounge and had some fruitful discussions on early microcode loading (one of my features for FreeBSD 12.0). These led me to reconsider some aspects of my approach and saved me a lot of time.  Finally, I continued my debugging session from Wednesday with help from a couple of other developers.<br>\nSaturday’s talks included a very thorough account by Li-Wen Hsu of his work in organizing a BSD conference in Taipei last year.  As one of the attendees, I had felt that the conference had gone quite smoothly and was taken aback by the number of details and pitfalls that Li-Wen enumerated during his talk. This was followed by an excellent talk by Baptiste Daroussin on the difficulties one encounters when deploying FreeBSD in new environments. Baptiste offered criticisms of a number of aspects of FreeBSD, some of which hit close to home as they involved portions of the system that I’ve worked on.<br>\nAt the conclusion of the talks, we all gathered in the main lecture hall, where Dan led a traditional and quite lively auction for charity.  I managed to snag a Pine64 board and will be getting FreeBSD installed on it the first chance I get.  At the end of the auction, we all headed to ByWard for dinner, concluding yet another BSDCan.</p>\n</blockquote>\n\n<ul>\n<li>Thanks to Mark for sharing his experiences at this years BSDCan</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://undeadly.org/cgi?action=article&amp;sid=20180410063454\">Transparent network audio with mpd &amp; sndiod</a></p>\n\n<blockquote>\n<p>Landry Breuil (landry@ when wearing his developer hat) wrote in…</p>\n</blockquote>\n\n<pre><code>I've been a huge fan of MPD over the years to centralize my audio collection, and i've been using it with the http output to stream the music as a radio on the computer i'm currently using…\n\naudio_output {\n       type            &quot;sndio&quot;\n       name            &quot;Local speakers&quot;\n       mixer_type      &quot;software&quot;\n}\naudio_output {\n       type            &quot;httpd&quot;\n       name            &quot;HTTP stream&quot;\n       mixer_type      &quot;software&quot;\n       encoder         &quot;vorbis&quot;\n       port            &quot;8000&quot;\n       format          &quot;44100:16:2&quot;\n}\nthis setup worked for years, allows me to stream my home radio to $work by tunnelling the port 8000 over ssh via LocalForward, but that still has some issues:\n\na distinct timing gap between the 'local output' (ie the speakers connected to the machine where MPD is running) and the 'http output' caused by the time it takes to reencode the stream, which is ugly when you walk through the house and have a 15s delay\nsometimes mplayer as a client doesn't detect the pauses in the stream and needs to be restarted\ni need to configure/start a client on each computer and point it at the sound server url (can do via gmpc shoutcast client plugin…)\nit's not that elegant to reencode the stream, and it wastes cpu cycles\nSo the current scheme is:\n\nmpd -&gt; http output -&gt; network -&gt; mplayer -&gt; sndiod on remote machine\n|\n-&gt; sndio output -&gt; sndiod on soundserver\nFiddling a little bit with mpd outputs and reading the sndio output driver, i remembered sndiod has native network support… and the mpd sndio output allows you to specify a device (it uses SIO_DEVANY by default).\n\nSo in the end, it's super easy to:\n\nenable network support in sndio on the remote machine i want the audio to play by adding -L&lt;local ip&gt; to sndiod_flags (i have two audio devices, with an input coming from the webcam):\nsndiod_flags=&quot;-L10.246.200.10 -f rsnd/0 -f rsnd/1&quot;\nopen pf on port 11025 from the sound server ip:\npass in proto tcp from 10.246.200.1 to any port 11025\nconfigure a new output in mpd:\naudio_output {\n       type            &quot;sndio&quot;\n       name            &quot;sndio on renton&quot;\n       device          &quot;snd@10.246.200.10/0&quot;\n       mixer_type      &quot;software&quot;\n}\nand enable the new output in mpd:\n$mpc enable 2\nOutput 1 (Local speakers) is disabled\nOutput 2 (sndio on renton) is enabled\nOutput 3 (HTTP stream) is disabled\nResults in a big win: no gap anymore with the local speakers, no reencoding, no need to configure a client to play the stream, and i can still probably reproduce the same scheme over ssh from $work using a RemoteForward.\n\nmpd -&gt; sndio output 2 -&gt; network -&gt; sndiod on remote machine\n|\n-&gt; sndio output 1 -&gt; sndiod on soundserver\nThanks ratchov@ for sndiod :)\n</code></pre>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.mirbsd.org/permalinks/wlog-10_e20180415-tg.htm\">MirBSD’s Korn Shell on Plan9 Jehanne</a></p>\n\n<blockquote>\n<p>Let start by saying that I’m not really a C programmer.<br>\nMy last public contribution to a POSIX C program was a little improvement to the Snort’s react module back in 2008.<br>\nSo while I know the C language well enough, I do not know anything about the subtleness of the standard library and I have little experience with POSIX semantics.<br>\nThis is not a big issue with Plan 9, since the C library and compiler are not standard anyway, but with Jehanne (a Plan 9 derivative of my own) I want to build a simple, loosely coupled, system that can actually run useful free software ported from UNIX.<br>\nSo I ported RedHat’s newlib to Jehanne on top of a new system library I wrote, LibPOSIX, that provides the necessary emulations. I wrote several test, checking they run the same on Linux and Jehanne, and then I begun looking for a real-world, battle tested, application to port first.<br>\nI approached MirBSD’s Korn Shell for several reason:</p>\n</blockquote>\n\n<ul>\n<li>it is simple, powerful and well written</li>\n<li>it has been ported to several different operating systems</li>\n<li>it has few dependencies</li>\n<li>it’s the default shell in Android, so it’s really battle tested</li>\n</ul>\n\n<blockquote>\n<p>I was very confident. I had read the POSIX standard after all! And I had a test suite!<br>\nI remember, I thought “Given newlib, how hard can it be?”<br>\nThe porting begun on September 1, 2017. It was completed by tg on January 5, 2018. 125 nights later.<br>\nTurn out, my POSIX emulation was badly broken. Not just because of the usual bugs that any piece of C can have: I didn’t understood most POSIX semantics at all!</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###<a href=\"https://www.romanzolotarev.com/ssg.html\">Static site generator with rsync and lowdown on OpenBSD</a></p>\n\n<ul>\n<li>\n<p>ssg is a tiny POSIX-compliant shell script with few dependencies:</p>\n</li>\n<li>\n<p>lowdown(1) to parse markdown,</p>\n</li>\n<li>\n<p>rsync(1) to copy temporary files, and</p>\n</li>\n<li>\n<p>entr(1) to watch file changes.</p>\n</li>\n<li>\n<p>It generates Markdown articles to a static website.</p>\n</li>\n<li>\n<p>It copies the current directory to a temporary on in /tmp skipping .* and _*, renders all Markdown articles to HTML, generates RSS feed based on links from index.html, extracts the first &lt;h1&gt; tag from every article to generate a sitemap and use it as a page title, then wraps articles with a single HTML template, copies everything from the temporary directory to $DOCS/</p>\n</li>\n</ul>\n\n<blockquote>\n<p>Why not Jekyll or “$X”?</p>\n</blockquote>\n\n<ul>\n<li>ssg is one hundred times smaller than Jekyll.</li>\n</ul>\n\n<blockquote>\n<p>ssg and its dependencies are about 800KB combined. Compare that to 78MB of ruby with Jekyll and all the gems. So ssg can be installed in just few seconds on almost any Unix-like operating system.<br>\nObviously, ssg is tailored for my needs, it has all features I need and only those I use.<br>\nKeeping ssg helps you to master your Unix-shell skills: awk, grep, sed, sh, cut, tr. As a web developer you work with lots of text: code and data. So you better master these wonderful tools.</p>\n</blockquote>\n\n<ul>\n<li>Performance</li>\n</ul>\n\n<blockquote>\n<p>100 pps. On modern computers ssg generates a hundred pages per second. Half of a time for markdown rendering and another half for wrapping articles into the template. I heard good static site generators work—twice as fast—at 200 pps, so there’s lots of performance that can be gained. ;)</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.quora.com/Why-does-FreeBSD-have-virtually-no-0-desktop-market-share/answer/Terry-Lambert\">Why does FreeBSD have virtually no (0%) desktop market share?</a></p>\n\n<ul>\n<li>Because someone made a horrible design decision back in 1984.</li>\n</ul>\n\n<blockquote>\n<p>In absolute fairness to those involved, it was an understandable decision, both from a research perspective, and from an economic perspective, although likely not, from a technology perspective.</p>\n</blockquote>\n\n<ul>\n<li>Why and what.</li>\n</ul>\n\n<blockquote>\n<p>The decision was taken because the X Window System was intended to run on cheap hardware, and, at the time, that meant reduced functionality in the end-point device with the physical display attached to it.<br>\nAt the same time, another force was acting to also limit X displays to display services only, rather than rolling in both window management and specific widget instances for common operational paradigms.<br>\nMostly, common operational paradigms didn’t really exist for windowing systems because they also simply didn’t exist at the time, and no one really knew how people were going to use the things, and so researchers didn’t want to commit future research to a set of hard constraints.<br>\nSo a decision was made: separate the display services from the application at the lowest level of graphics primitives currently in use at the time.</p>\n</blockquote>\n\n<ul>\n<li>The ramifications of this were pretty staggering.</li>\n</ul>\n\n<blockquote>\n<p>First, it guaranteed that all higher level graphics would live on the host side of the X protocol, instead of on the display device side of the protocol.<br>\nDespite a good understanding of Moore’s law, and the fact that, since no X Terminals existed at the time as hardware, but were instead running as emulations on workstations that had sufficient capability, this put the higher level GUI object libraries — referred to as “widgets” — in host libraries linked into the applications.<br>\nSecond, it guaranteed that display organization and management paradigms would also live on the host side of the protocol — assumed, in contradiction to the previous decision, to be running on the workstation.<br>\nBut, presumably, at some point, as lightweight X Terminals became available, to migrate to a particular host computer managing compute resource login/access services.</p>\n</blockquote>\n\n<ul>\n<li>Between these early decisions reigned chaos.</li>\n</ul>\n\n<blockquote>\n<p>Specifically, the consequences of these decisions have been with us ever since:<br>\nLook-and-feel are a consequence of the toolkit chosen by the application programmer, rather than a user decision which applies universally to all applications.<br>\nYou could call this “lack of a theme”, and — although I personally despise the idea of customizing or “theming” desktops — this meant that one paradigm chosen by the user would not apply universally across all applications, no matter who had written them.<br>\nWindow management style is a preference.<br>\nYou could call this a more radical version of “theming” — which you will remember, I despise — but a consequence to this is that training is not universal across personnel using such systems, nor is it transferrable.<br>\nIn other words, I can’t send someone to a class, and have them come back and use the computers in the office as a tool, with the computer itself — and the elements not specific to the application itself — disappearing into the background.<br>\nBoth of these ultimately render an X-based system unsuitable for desktops.<br>\nI can’t pay once for training. Training that I do pay for does not easily and naturally translate between applications. Each new version may radically alter the desktop management paradigm into unrecognizability.</p>\n</blockquote>\n\n<ul>\n<li>Is there hope for the future?</li>\n</ul>\n\n<blockquote>\n<p>Well, the Linux community has been working on something called Wayland, and it is very promising…<br>\n…In the same way X was “very promising” in 1984, because, unfortunately, they are making exactly the same mistakes X made in 1984, rather than correcting them, now that we have 20/20 hindsight, and know what a mature widget library should look like.<br>\nSo Wayland is screwing up again.<br>\nBut hey, it only took us, what, 25 years to get from X in 1987 to Wayland in in 2012.<br>\nMaybe if we try again in 2037, we can get to where Windows was in 1995.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://twitter.com/FranckPachot/status/1012606253338591232\">New washing machine comes with 7 pages of open source licenses!</a></li>\n<li><a href=\"https://www.bsdjobs.com/\">BSD Jobs Site</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/wp-content/uploads/2018/05/FreeBSD-Foundation-May-2018-Update.pdf\">FreeBSD Foundation Update, May 2018</a></li>\n<li><a href=\"http://freebsdjournal.org/\">FreeBSD Journal looking for book reviewers</a></li>\n<li><a href=\"https://ramsdenj.com/2018/05/29/zedenv-zfs-boot-environment-manager.html\">zedenv ZFS Boot Environment Manager</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Wouter - <a href=\"http://dpaste.com/28959CK#wrap\">Feedback</a></li>\n<li>Efraim - <a href=\"http://dpaste.com/2RZ16K8#wrap\">OS Suggestion</a></li>\n<li>kevr - <a href=\"http://dpaste.com/2PX7KSP#wrap\">Raspberry Pi2/FreeBSD/Router on a Stick</a></li>\n<li>Vanja - <a href=\"http://dpaste.com/0ARSVWE#wrap\">Interview Suggestion</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"Fanless server setup with FreeBSD, NetBSD on pinebooks, another BSDCan trip report, transparent network audio, MirBSD's Korn Shell on Plan9, static site generators on OpenBSD, and more.","date_published":"2018-07-05T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/f597f732-405b-4f10-8d40-c00315bd064b.mp3","mime_type":"audio/mp3","size_in_bytes":52181883,"duration_in_seconds":5211}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2170","title":"Episode 252: Goes to 11.2 | BSD Now 252","url":"https://www.bsdnow.tv/252","content_text":"FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.\n\n##Headlines\n###FreeBSD 11.2-RELEASE Available\n\n\nFreeBSD 11.2 was released today (June 27th) and is ready for download\nHighlights:\n\n\n\nOpenSSH has been updated to version 7.5p1.\nOpenSSL has been updated to version 1.0.2o.\nThe clang, llvm, lldb and compiler-rt utilities have been updated to version 6.0.0.\nThe libarchive(3) library has been updated to version 3.3.2.\nThe libxo(3) library has been updated to version 0.9.0.\nMajor Device driver updates to:\n\n\n\ncxgbe(4) – Chelsio 10/25/40/50/100 gigabit NICs – version 1.16.63.0 supports T4, T5 and T6\nixl(4) – Intel 10 and 40 gigabit NICs, updated to version 1.9.9-k\nng_pppoe(4) – driver has been updated to add support for user-supplied Host-Uniq tags\n\n\n\nNew drivers:\n+ drm-next-kmod driver supporting integrated Intel graphics with the i915 driver.\n\n\n\nmlx5io(4) – a new IOCTL interface for Mellanox ConnectX-4 and ConnectX-5 10/20/25/40/50/56/100 gigabit NICs\nocs_fc(4) – Emulex Fibre Channel 8/16/32 gigabit Host Adapters\nsmartpqi(4) – HP Gen10 Smart Array Controller Family\n\n\n\nThe newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs\nThe diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller.\nThe top(1) utility has been updated to allow filtering on multiple user names when the    -U flag is used\nThe umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.\nThe ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by the flag ‘C’\nThe service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID\nThe mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).\nThe ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface.\nThe dwatch(1) utility has been introduced\nThe efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.\nThe etdump(1) utility has been added, which is used to view El Torito boot catalog information.\nThe linux(4) ABI compatibility layer has been updated to include support for musl consumers.\nThe fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior\nSupport for virtio_console(4) has been added to bhyve(4).\nThe length of GELI passphrases entered when booting a system with encrypted disks is now hidden by default. See the configuration options in geli(8) to restore the previous behavior.\n\n\n\nIn addition to the usual CD/DVD ISO, Memstick, and prebuilt VM images (raw, qcow2, vhd, and vmdk), FreeBSD 11.2 is also available on:\n\nAmazon EC2\nGoogle Compute Engine\nHashicorp/Atlas Vagrant\nMicrosoft Azure\n\n\n\nIn addition to a generic ARM64 image for devices like the Pine64 and Raspberry Pi 3, specific images are provided for:\n\n\nGUMSTIX\nBANANAPI\nBEAGLEBONE\nCUBIEBOARD\nCUBIEBOARD2\nCUBOX-HUMMINGBOARD\nRASPBERRY PI 2\nPANDABOARD\nWANDBOARD\n\n\n\nFull Release Notes\n\n\n\n###Setting up an MTA Behind Tor\n\n\nThis article will document how to set up OpenSMTPD behind a fully Tor-ified network. Given that Tor’s DNS resolver code does not support MX record lookups, care must be taken for setting up an MTA behind a fully Tor-ified network. OpenSMTPD was chosen because it was easy to modify to force it to fall back to A/AAAA lookups when MX lookups failed with a DNS result code of NOTIMP (4).\n\n\n\nNote that as of 08 May 2018, the OpenSMTPD project is planning a configuration file language change. The proposed change has not landed. Once it does, this article will be updated to reflect both the old language and new.\n\n\n\nThe reason to use an MTA behing a fully Tor-ified network is to be able to support email behind the .onion TLD. This setup will only allow us to send and receive email to and from the .onion TLD.\n\n\n\n\nRequirements:\n\n\nA fully Tor-ified network\n\n\nHardenedBSD as the operating system\n\n\nA server (or VM) running HardenedBSD behind the fully Tor-ified network.\n\n\n/usr/ports is empty\n\n\nOr is already pre-populated with the HardenedBSD Ports tree\n\n\nWhy use HardenedBSD? We get all the features of FreeBSD (ZFS, DTrace, bhyve, and jails) with enhanced security through exploit mitigations and system hardening. Tor has a very unique threat landscape and using a hardened ecosystem is crucial to mitigating risks and threats.\n\n\n\n\nAlso note that this article reflects how I’ve set up my MTA. I’ve included configuration files verbatim. You will need to replace the text that refers to my .onion domain with yours.\n\n\n\nOn 08 May 2018, HardenedBSD’s version of OpenSMTPD just gained support for running an MTA behind Tor. The package repositories do not yet contain the patch, so we will compile OpenSMTPD from ports.\n\n\n\nSteps\nInstallation\nGenerating Cryptographic Key Material\nTor Configuration\nOpenSMTPD Configuration\nDovecot Configuration\nTesting your configuration\nOptional: Webmail Access\n\n\n\n\niXsystems\nhttps://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec\nhttps://www.ixsystems.com/blog/self-2018-recap/\n\n###Running pfSense on a Digital Ocean Droplet\n\n\nI love pfSense (and opnSense, no discrimination here). I use it for just about anything, from homelab to large scale deployments and I’ll give out on any fancy &lt;enter brand name fw appliance here&gt; for a pfSense setup on a decent hardware.\n\n\n\nI also love DigitalOcean, if you ever used them, you know why, if you never did, head over and try, you’ll understand why.\n&lt;shameless plug: head over to JupiterBroadcasting.com, the best technology content out there, they have coupon codes to get you started with DO&gt;.\n\n\n\nUnfortunately, while DO offers tremendous amount of useful distros and applications, pfSense isn’t one of them. But, where there’s a will, there’s a way, and here’s how to get pfSense up and running on DO so you can have it as the gatekeeper to your kingdom.\n\n\n\nStart by creating a FreeBSD droplet, choose your droplet size (for modest setups, I find the 5$ to be quite awesome):\n\n\n\nThere are many useful things you can do with pfSense on your droplet, from OpenVPN, squid, firewalling, fancy routing, url filtering, dns black listing and much much more.\n\n\n\nOne note though, before we wrap up:\n\n\n\nYou have two ways to initiate the initial setup wizard of the web-configurator:\nSpin up another droplet, log into it and browse your way to the INTERNAL ip address of the internal NIC you’ve set up. This is the long and tedious way, but it’s also somewhat safer  as it eliminates the small window of risk the second method poses.\nor\nOnce your  WAN address is all setup, your pfSense is ready to accept https connection to start the initial web-configurator setup.\nThing is, there’s a default, well known set of credential to this initial wizard (admin:pfsense), so, there is a slight window of opportunity that someone can swoop in (assuming they know you’ve installed pfsense + your wan IP address + the exact time window between setting up the WAN interface and completing the wizard) and do &lt;enter scary thing here&gt;.\n\n\n\nI leave it up to you which of the path you’d like to go, either way, once you’re done with the web-configurator wizard, you’ll have a shiny new pfSense installation at your disposal running on your favorite VPS.\n\n\n\nHopefully this was helpful for someone, I hope to get a similar post soon detailing how to get FreeNAS up and running on DO.\nMany thanks to Tubsta and his blogpost as well as to Allan Jude, Kris Moore and Benedict Reuschling for their AWESOME and inspiring podcast, BSD Now.\n\n\n\n\n##News Roundup\n###One year of C\n\n\nIt’s now nearly a year that I started writing non-trivial amounts of C code again (the first sokol_gfx.h commit was on the 14-Jul-2017), so I guess it’s time for a little retrospective.\n\n\n\nIn the beginning it was more of an experiment: I wanted to see how much I would miss some of the more useful C++ features (for instance namespaces, function overloading, ‘simple’ template code for containers, …), and whether it is possible to write non-trivial codebases in C without going mad.\n\n\n\nHere are all the github projects I wrote in C:\n\n\n\nsokol: a slowly growing set of platform-abstraction headers\nsokol-samples - examples for Sokol\nchips - 8-bit chip emulators\nchips-test - tests and examples for the chip- emulators, including some complete home computer emulators (minus sound)\n\n\n\nAll in all these are around 32k lines of code (not including 3rd party code like flextGL and HandmadeMath). I think I wrote more C code in the recent 10 months than any other language.\n\n\n\nSo one thing seems to be clear: yes, it’s possible to write a non-trivial amount of C code that does something useful without going mad (and it’s even quite enjoyable I might add).\n\n\n\n\nHere’s a few things I learned:\n\n\nPick the right language for a problem\n\n\nC is a perfect match for WebAssembly\n\n\nC99 is a huge improvement over C89\n\n\nThe dangers of pointers and explicit memory management are overrated\n\n\nLess Boilerplate Code\n\n\nLess Language Feature ‘Anxiety’\n\n\nConclusion\n\n\n\n\nAll in all my “C experiment” is a success. For a lot of problems, picking C over C++ may be the better choice since C is a much simpler language (btw, did you notice how there are hardly any books, conferences or discussions about C despite being a fairly popular language? Apart from the neverending bickering about undefined behaviour from the compiler people of course ;) There simply isn’t much to discuss about a language that can be learned in an afternoon.\n\n\n\nI don’t like some of the old POSIX or Linux APIs as much as the next guy (e.g. ioctl(), the socket API or some of the CRT library functions), but that’s an API design problem, not a language problem. It’s possible to build friendly C APIs with a bit of care and thinking, especially when C99’s designated initialization can be used (C++ should really make sure that the full C99 language can be used from inside C++ instead of continuing to wander off into an entirely different direction).\n\n\n\n\n###Configuring OpenBGPD to announce VM’s virtual networks\n\n\nWe use BGP quite heavily at work, and even though I’m not interacting with that directly, it feels like it’s something very useful to learn at least on some basic level. The most effective and fun way of learning technology is finding some practical application, so I decided to see if it could help to improve networking management for my Virtual Machines.\n\n\n\nMy setup is fairly simple: I have a host that runs bhyve VMs and I have a desktop system from where I ssh to VMs, both hosts run FreeBSD. All VMs are connected to each other through a bridge and have a common network 10.0.1/24. The point of this exercise is to be able to ssh to these VMs from desktop without adding static routes and without adding vmhost’s external interfaces to the VMs bridge.\n\n\n\nI’ve installed openbgpd on both hosts and configured it like this:\n\n\nvmhost: /usr/local/etc/bgpd.conf\nAS 65002\nrouter-id 192.168.87.48\nfib-update no\n\nnetwork 10.0.1.1/24\n\nneighbor 192.168.87.41 {\n    descr \"desktop\"\n    remote-as 65001\n}\n\n\n\nHere, router-id is set vmhost’s IP address in my home network (192.168.87/24), fib-update no is set to forbid routing table update, which I initially set for testing, but keeping it as vmhost is not supposed to learn new routes from desktop anyway. network announces my VMs network and neighbor describes my desktop box. Now the desktop box:\n\n\ndesktop: /usr/local/etc/bgpd.conf\nAS 65001\nrouter-id 192.168.87.41\nfib-update yes\n\nneighbor 192.168.87.48 {                                                                                                                                                                                           \n        descr \"vmhost\"                                                                                                                                                                                             \n        remote-as 65002                                                                                                                                                                                            \n}\n\n\n\nIt’s pretty similar to vmhost’s bgpd.conf, but no networks are announced here, and fib-update is set to yes because the whole point is to get VM routes added. Both hosts have to have the openbgpd service enabled:\n\n\n/etc/rc.conf.local\nopenbgpd_enable=\"YES\"\n\n\n\nConclusion\n\n\n\nAs mentioned already, similar result could be achieved without using BGP by using either static routes or bridging interfaces differently, but the purpose of this exercise is to get some basic hands-on experience with BGP. Right now I’m looking into extending my setup in order to try more complex BGP schema. I’m thinking about adding some software switches in front of my VMs or maybe adding a second VM host (if budget allows). You’re welcome to comment if you have some ideas how to extend this setup for educational purposes in the context of BGP and networking.\n\n\n\nAs a side note, I really like openbgpd so far. Its configuration file format is clean and simple, documentation is good, error and information messages are clear, and CLI has intuitive syntax.\n\n\n\n\nDigital Ocean\n\n###The Power to Serve\n\n\nAll people within the IT Industry should known where the slogan “The Power To Serve” is exposed every day to millions of people. But maybe too much wishful thinking from me. But without “The Power To Serve” the IT industry today will look totally different. Companies like Apple, Juniper, Cisco and even WatsApp would not exist in their current form.\n\n\n\nI provide IT architecture services to make your complex IT landscape manageable and I love to solve complex security and privacy challenges. Complex challenges where people, processes and systems are heavily interrelated. For this knowledge intensive work I often run some IT experiments. When you run experiments nowadays you have a choice:\n\n\n\nRent some cloud based services or\nDIY (Do IT Yourself) on premise\n\n\n\nRunning your own developments experiments on your own infrastructure can be time consuming. However smart automation saves time and money. And by creating your own CICD pipeline (Continuous Integration, Continuous Deployment) you stay on top of core infrastructure developments. Even hands-on. Knowing how things work from a technical ‘hands-on’ perspective gives great advantages when it comes to solving complex business IT problems. Making a clear distinguish between a business problem or IT problem is useless. Business and IT problems are related. Sometimes causal related, but more often indirect by one or more non linear feedback loops. Almost every business depends of IT systems. Bad IT means often that your customers will leave your business.\n\n\n\nOne of the things of FeeBSD for me is still FreeBSD Jails. In 2015 I had luck to attend to a presentation of the legendary hacker Poul-Henning Kamp . Check his BSD bio to see what he has done for the FreeBSD community! FreeBSD jails are a light way to visualize your system without enormous overhead. Now that the development on Linux for LXD/LXD is more mature (lxd is the next generation system container manager on linux) there is finally again an alternative for a nice chroot Linux based system again. At least when you do not need the overhead and management complexity that comes with Kubernetes or Docker.\n\n\n\nFreeBSD means control and quality for me. When there is an open source package I need, I want to install it from source. It gives me more control and always some extra knowledge on how things work. So no precompiled binaries for me on my BSD systems! If a build on FreeBSD fails most of the time this is an alert regarding the quality for me.\n\n\n\nIf a complex OSS package is not available at all in the FreeBSD ports collection there should be a reason for it. Is it really that nobody on the world wants to do this dirty maintenance work? Or is there another cause that running this software on FreeBSD is not possible…There are currently 32644 ports available on FreeBSD. So all the major programming language, databases and middleware libraries are present. The FreeBSD organization is a mature organization and since this is one of the largest OSS projects worldwide learning how this community manages to keep innovation and creates and maintains software is a good entrance for learning how complex IT systems function.\n\n\n\nFreeBSD is of course BSD licensed. It worked well! There is still a strong community with lots of strong commercial sponsors around the community. Of course: sometimes a GPL license makes more sense. So beside FreeBSD I also love GPL software and the rationale and principles behind it. So my hope is that maybe within the next 25 years the hard battle between BSD vs GPL churches will be more rationalized and normalized. Principles are good, but as all good IT architects know: With good principles alone you never make a good system. So use requirements and not only principles to figure out what OSS license fits your project. There is never one size fits all.\n\n\n\nJune 19, 1993 was the day the official name for FreeBSD was agreed upon. So this blog is written to celebrate 25th anniversary of FreeBSD.\n\n\n\n\n###Dave’s BSDCan trip report\n\n\nSo far, only one person has bothered to send in a BSDCan trip report. Our warmest thanks to Dave for doing his part.\n\n\n\nHello guys! During the last show, you asked for a trip report regarding BSDCan 2018.\nThis was my first time attending BSDCan. However, BSDCan was my second BSD conference overall, my first being vBSDCon 2017 in Reston, VA.\nArriving early Thursday evening and after checking into the hotel, I headed straight to the Red Lion for the registration, picked up my badge and swag and then headed towards the ‘DMS’ building for the newbies talk. The only thing is, I couldn’t find the DMS building! Fortunately I found a BSDCan veteran who was heading there themselves. My only suggestion is to include the full building name and address on the BSDCan web site, or even a link to Google maps to help out with the navigation. The on-campus street maps didn’t have ‘DMS’ written on them anywhere. But I digress.\nOnce I made it to the newbies talk hosted by Dan Langille and Michael W Lucas, it highlighted places to meet, an overview of what is happening, details about the ‘BSDCan widow/widower tours’ and most importantly, the 6-2-1 rule!\nThe following morning, we were present with tea/coffee, muffins and other goodies to help prepare us for the day ahead.\nThe first talk, “The Tragedy of systemd” covered what systemd did wrong and how the BSD community could improve on the ideas behind it.\nWith the exception of Michael W Lucas, SSH Key Management and Kirk McKusick, The Evolution of FreeBSD Governance talk, I pretty much attended all of the ZFS talks including the lunchtime BoF session, hosted by Allan Jude. Coming from FreeNAS and being involved in the community, this is where my main interest and motivation lies. Since then I have been able to share some of that information with the FreeNAS community forums and chatroom.\nI also attended the “Speculating about Intel” lunchtime BoF session hosted by Theo de Raddt, which proved to be “interesting”.\nThe talks ended with the wrap up session with a few words from Dan, covering the record attendance and made very clear there “was no cabal”. Followed by the the handing over of Groff the BSD goat to a new owner, thank you’s from the FreeBSD Foundation to various community committers and maintainers, finally ending with the charity auction, where a things like a Canadian $20 bill sold for $40, a signed FreeBSD Foundation shirt originally worn by George Neville-Neil, a lost laptop charger, Michael’s used gelato spoon, various books, the last cookie and more importantly, the second to last cookie!\nAfter the auction, we all headed to the Red Lion for food and drinks, sponsored by iXsystems.\nI would like to thank the BSDCan organizers, speakers and sponsors for a great conference. I will certainly hope to attend next year!\nRegards,\nDave (aka m0nkey_)\n\n\n\nThanks to Dave for sharing his experiences with us and our viewers\n\n\n\n\n##Beastie Bits\n\n\nRobert Watson (from 2008) on how much FreeBSD is in Mac OS X \nWhy Intel Skylake CPUs are sometimes 50% slower than older CPUs\nKristaps Dzonsons is looking for somebody to maintain this as mentioned at this link\ncamcontrol(8) saves the day again! Formatting floppy disks in a USB floppy disk drive\n32+ great indie games now playable on OpenBSD -current; 7 currently on sale!\nWarsaw BSD User Group. June 27 2018 18:30-21:00, Wheel Systems Office, Aleje Jerozolimskie 178, Warsaw\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nRon - Adding a disk to ZFS\nMarshall - zfs question\nThomas - Allan, the myth perpetuator\nRoss - ZFS IO stats per dataset\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.freebsd.org/releases/11.2R/announce.html\">FreeBSD 11.2-RELEASE Available</a></p>\n\n<ul>\n<li>FreeBSD 11.2 was released today (June 27th) and is ready for download</li>\n<li>Highlights:</li>\n</ul>\n\n<blockquote>\n<p>OpenSSH has been updated to version 7.5p1.<br>\nOpenSSL has been updated to version 1.0.2o.<br>\nThe clang, llvm, lldb and compiler-rt utilities have been updated to version 6.0.0.<br>\nThe libarchive(3) library has been updated to version 3.3.2.<br>\nThe libxo(3) library has been updated to version 0.9.0.<br>\nMajor Device driver updates to:</p>\n</blockquote>\n\n<ul>\n<li>cxgbe(4) – Chelsio 10/25/40/50/100 gigabit NICs – version 1.16.63.0 supports T4, T5 and T6</li>\n<li>ixl(4) – Intel 10 and 40 gigabit NICs, updated to version 1.9.9-k</li>\n<li>ng_pppoe(4) – driver has been updated to add support for user-supplied Host-Uniq tags</li>\n</ul>\n\n<blockquote>\n<p>New drivers:<br>\n+ drm-next-kmod driver supporting integrated Intel graphics with the i915 driver.</p>\n</blockquote>\n\n<ul>\n<li>mlx5io(4) – a new IOCTL interface for Mellanox ConnectX-4 and ConnectX-5 10/20/25/40/50/56/100 gigabit NICs</li>\n<li>ocs_fc(4) – Emulex Fibre Channel 8/16/32 gigabit Host Adapters</li>\n<li>smartpqi(4) – HP Gen10 Smart Array Controller Family</li>\n</ul>\n\n<blockquote>\n<p>The newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs<br>\nThe diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller.<br>\nThe top(1) utility has been updated to allow filtering on multiple user names when the    -U flag is used<br>\nThe umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.<br>\nThe ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by the flag ‘C’<br>\nThe service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID<br>\nThe mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).<br>\nThe ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface.<br>\nThe dwatch(1) utility has been introduced<br>\nThe efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.<br>\nThe etdump(1) utility has been added, which is used to view El Torito boot catalog information.<br>\nThe linux(4) ABI compatibility layer has been updated to include support for musl consumers.<br>\nThe fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior<br>\nSupport for virtio_console(4) has been added to bhyve(4).<br>\nThe length of GELI passphrases entered when booting a system with encrypted disks is now hidden by default. See the configuration options in geli(8) to restore the previous behavior.</p>\n</blockquote>\n\n<ul>\n<li>In addition to the usual CD/DVD ISO, Memstick, and prebuilt VM images (raw, qcow2, vhd, and vmdk), FreeBSD 11.2 is also available on:\n<ul>\n<li>Amazon EC2</li>\n<li>Google Compute Engine</li>\n<li>Hashicorp/Atlas Vagrant</li>\n<li>Microsoft Azure</li>\n</ul>\n\n<p></li><br>\n<li>In addition to a generic ARM64 image for devices like the Pine64 and Raspberry Pi 3, specific images are provided for:</p>\n\n<ul>\n<li>GUMSTIX</li>\n<li>BANANAPI</li>\n<li>BEAGLEBONE</li>\n<li>CUBIEBOARD</li>\n<li>CUBIEBOARD2</li>\n<li>CUBOX-HUMMINGBOARD</li>\n<li>RASPBERRY PI 2</li>\n<li>PANDABOARD</li>\n<li>WANDBOARD</li>\n</ul>\n\n<p></li><br>\n<li><a href=\"https://www.freebsd.org/releases/11.2R/relnotes.html\">Full Release Notes</a></li><br>\n</ul><br>\n<hr></p>\n\n<p>###<a href=\"https://github.com/lattera/articles/blob/master/opsec/2018-05-08_torified_mta/article.md\">Setting up an MTA Behind Tor</a></p>\n\n<blockquote>\n<p>This article will document how to set up OpenSMTPD behind a fully Tor-ified network. Given that Tor’s DNS resolver code does not support MX record lookups, care must be taken for setting up an MTA behind a fully Tor-ified network. OpenSMTPD was chosen because it was easy to modify to force it to fall back to A/AAAA lookups when MX lookups failed with a DNS result code of NOTIMP (4).</p>\n</blockquote>\n\n<blockquote>\n<p>Note that as of 08 May 2018, the OpenSMTPD project is planning a configuration file language change. The proposed change has not landed. Once it does, this article will be updated to reflect both the old language and new.</p>\n</blockquote>\n\n<blockquote>\n<p>The reason to use an MTA behing a fully Tor-ified network is to be able to support email behind the .onion TLD. This setup will only allow us to send and receive email to and from the .onion TLD.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Requirements:</p>\n</li>\n<li>\n<p>A fully Tor-ified network</p>\n</li>\n<li>\n<p>HardenedBSD as the operating system</p>\n</li>\n<li>\n<p>A server (or VM) running HardenedBSD behind the fully Tor-ified network.</p>\n</li>\n<li>\n<p>/usr/ports is empty</p>\n</li>\n<li>\n<p>Or is already pre-populated with the HardenedBSD Ports tree</p>\n</li>\n<li>\n<p>Why use HardenedBSD? We get all the features of FreeBSD (ZFS, DTrace, bhyve, and jails) with enhanced security through exploit mitigations and system hardening. Tor has a very unique threat landscape and using a hardened ecosystem is crucial to mitigating risks and threats.</p>\n</li>\n</ul>\n\n<blockquote>\n<p>Also note that this article reflects how I’ve set up my MTA. I’ve included configuration files verbatim. You will need to replace the text that refers to my .onion domain with yours.</p>\n</blockquote>\n\n<blockquote>\n<p>On 08 May 2018, HardenedBSD’s version of OpenSMTPD just gained support for running an MTA behind Tor. The package repositories do not yet contain the patch, so we will compile OpenSMTPD from ports.</p>\n</blockquote>\n\n<ul>\n<li>Steps</li>\n<li>Installation</li>\n<li>Generating Cryptographic Key Material</li>\n<li>Tor Configuration</li>\n<li>OpenSMTPD Configuration</li>\n<li>Dovecot Configuration</li>\n<li>Testing your configuration</li>\n<li>Optional: Webmail Access</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong><br>\n<a href=\"https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec\">https://www.forbes.com/sites/forbestechcouncil/2018/06/21/strings-attached-knowing-when-and-when-not-to-accept-vc-funding/#30f9f18f46ec</a><br>\n<a href=\"https://www.ixsystems.com/blog/self-2018-recap/\">https://www.ixsystems.com/blog/self-2018-recap/</a></p>\n\n<p>###<a href=\"https://squigly.blogspot.com/2018/02/running-pfsense-on-digitalocean-droplet.html\">Running pfSense on a Digital Ocean Droplet</a></p>\n\n<blockquote>\n<p>I love pfSense (and opnSense, no discrimination here). I use it for just about anything, from homelab to large scale deployments and I’ll give out on any fancy &lt;enter brand name fw appliance here&gt; for a pfSense setup on a decent hardware.</p>\n</blockquote>\n\n<blockquote>\n<p>I also love DigitalOcean, if you ever used them, you know why, if you never did, head over and try, you’ll understand why.<br>\n&lt;shameless plug: head over to <a href=\"http://JupiterBroadcasting.com\">JupiterBroadcasting.com</a>, the <em>best</em> technology content out there, they have coupon codes to get you started with DO&gt;.</p>\n</blockquote>\n\n<blockquote>\n<p>Unfortunately, while DO offers tremendous amount of useful distros and applications, pfSense isn’t one of them. But, where there’s a will, there’s a way, and here’s how to get pfSense up and running on DO so you can have it as the gatekeeper to your kingdom.</p>\n</blockquote>\n\n<blockquote>\n<p>Start by creating a FreeBSD droplet, choose your droplet size (for modest setups, I find the 5$ to be quite awesome):</p>\n</blockquote>\n\n<blockquote>\n<p>There are many useful things you can do with pfSense on your droplet, from OpenVPN, squid, firewalling, fancy routing, url filtering, dns black listing and much much more.</p>\n</blockquote>\n\n<ul>\n<li>One note though, before we wrap up:</li>\n</ul>\n\n<blockquote>\n<p>You have two ways to initiate the initial setup wizard of the web-configurator:<br>\nSpin up another droplet, log into it and browse your way to the INTERNAL ip address of the internal NIC you’ve set up. This is the long and tedious way, but it’s also somewhat safer  as it eliminates the small window of risk the second method poses.<br>\nor<br>\nOnce your  WAN address is all setup, your pfSense is ready to accept https connection to start the initial web-configurator setup.<br>\nThing is, there’s a default, well known set of credential to this initial wizard (admin:pfsense), so, there is a slight window of opportunity that someone can swoop in (assuming they know you’ve installed pfsense + your wan IP address + the exact time window between setting up the WAN interface and completing the wizard) and do &lt;enter scary thing here&gt;.</p>\n</blockquote>\n\n<blockquote>\n<p>I leave it up to you which of the path you’d like to go, either way, once you’re done with the web-configurator wizard, you’ll have a shiny new pfSense installation at your disposal running on your favorite VPS.</p>\n</blockquote>\n\n<blockquote>\n<p>Hopefully this was helpful for someone, I hope to get a similar post soon detailing how to get FreeNAS up and running on DO.<br>\nMany thanks to Tubsta and his blogpost as well as to Allan Jude, Kris Moore and Benedict Reuschling for their AWESOME and inspiring podcast, BSD Now.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"http://floooh.github.io/2018/06/02/one-year-of-c.html\">One year of C</a></p>\n\n<blockquote>\n<p>It’s now nearly a year that I started writing non-trivial amounts of C code again (the first sokol_gfx.h commit was on the 14-Jul-2017), so I guess it’s time for a little retrospective.</p>\n</blockquote>\n\n<blockquote>\n<p>In the beginning it was more of an experiment: I wanted to see how much I would miss some of the more useful C++ features (for instance namespaces, function overloading, ‘simple’ template code for containers, …), and whether it is possible to write non-trivial codebases in C without going mad.</p>\n</blockquote>\n\n<blockquote>\n<p>Here are all the github projects I wrote in C:</p>\n</blockquote>\n\n<ul>\n<li>sokol: a slowly growing set of platform-abstraction headers</li>\n<li>sokol-samples - examples for Sokol</li>\n<li>chips - 8-bit chip emulators</li>\n<li>chips-test - tests and examples for the chip- emulators, including some complete home computer emulators (minus sound)</li>\n</ul>\n\n<blockquote>\n<p>All in all these are around 32k lines of code (not including 3rd party code like flextGL and HandmadeMath). I think I wrote more C code in the recent 10 months than any other language.</p>\n</blockquote>\n\n<blockquote>\n<p>So one thing seems to be clear: yes, it’s possible to write a non-trivial amount of C code that does something useful without going mad (and it’s even quite enjoyable I might add).</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Here’s a few things I learned:</p>\n</li>\n<li>\n<p>Pick the right language for a problem</p>\n</li>\n<li>\n<p>C is a perfect match for WebAssembly</p>\n</li>\n<li>\n<p>C99 is a huge improvement over C89</p>\n</li>\n<li>\n<p>The dangers of pointers and explicit memory management are overrated</p>\n</li>\n<li>\n<p>Less Boilerplate Code</p>\n</li>\n<li>\n<p>Less Language Feature ‘Anxiety’</p>\n</li>\n<li>\n<p>Conclusion</p>\n</li>\n</ul>\n\n<blockquote>\n<p>All in all my “C experiment” is a success. For a lot of problems, picking C over C++ may be the better choice since C is a much simpler language (btw, did you notice how there are hardly any books, conferences or discussions about C despite being a fairly popular language? Apart from the neverending bickering about undefined behaviour from the compiler people of course ;) There simply isn’t much to discuss about a language that can be learned in an afternoon.</p>\n</blockquote>\n\n<blockquote>\n<p>I don’t like some of the old POSIX or Linux APIs as much as the next guy (e.g. ioctl(), the socket API or some of the CRT library functions), but that’s an API design problem, not a language problem. It’s possible to build friendly C APIs with a bit of care and thinking, especially when C99’s designated initialization can be used (C++ should really make sure that the full C99 language can be used from inside C++ instead of continuing to wander off into an entirely different direction).</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://empt1e.blogspot.com/2018/06/configuring-openbgpd-to-announce-vms.html\">Configuring OpenBGPD to announce VM’s virtual networks</a></p>\n\n<blockquote>\n<p>We use BGP quite heavily at work, and even though I’m not interacting with that directly, it feels like it’s something very useful to learn at least on some basic level. The most effective and fun way of learning technology is finding some practical application, so I decided to see if it could help to improve networking management for my Virtual Machines.</p>\n</blockquote>\n\n<blockquote>\n<p>My setup is fairly simple: I have a host that runs bhyve VMs and I have a desktop system from where I ssh to VMs, both hosts run FreeBSD. All VMs are connected to each other through a bridge and have a common network 10.0.1/24. The point of this exercise is to be able to ssh to these VMs from desktop without adding static routes and without adding vmhost’s external interfaces to the VMs bridge.</p>\n</blockquote>\n\n<blockquote>\n<p>I’ve installed openbgpd on both hosts and configured it like this:</p>\n</blockquote>\n\n<pre><code>vmhost: /usr/local/etc/bgpd.conf\nAS 65002\nrouter-id 192.168.87.48\nfib-update no\n\nnetwork 10.0.1.1/24\n\nneighbor 192.168.87.41 {\n    descr &quot;desktop&quot;\n    remote-as 65001\n}\n</code></pre>\n\n<blockquote>\n<p>Here, router-id is set vmhost’s IP address in my home network (192.168.87/24), fib-update no is set to forbid routing table update, which I initially set for testing, but keeping it as vmhost is not supposed to learn new routes from desktop anyway. network announces my VMs network and neighbor describes my desktop box. Now the desktop box:</p>\n</blockquote>\n\n<pre><code>desktop: /usr/local/etc/bgpd.conf\nAS 65001\nrouter-id 192.168.87.41\nfib-update yes\n\nneighbor 192.168.87.48 {                                                                                                                                                                                           \n        descr &quot;vmhost&quot;                                                                                                                                                                                             \n        remote-as 65002                                                                                                                                                                                            \n}\n</code></pre>\n\n<blockquote>\n<p>It’s pretty similar to vmhost’s bgpd.conf, but no networks are announced here, and fib-update is set to yes because the whole point is to get VM routes added. Both hosts have to have the openbgpd service enabled:</p>\n</blockquote>\n\n<pre><code>/etc/rc.conf.local\nopenbgpd_enable=&quot;YES&quot;\n</code></pre>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>As mentioned already, similar result could be achieved without using BGP by using either static routes or bridging interfaces differently, but the purpose of this exercise is to get some basic hands-on experience with BGP. Right now I’m looking into extending my setup in order to try more complex BGP schema. I’m thinking about adding some software switches in front of my VMs or maybe adding a second VM host (if budget allows). You’re welcome to comment if you have some ideas how to extend this setup for educational purposes in the context of BGP and networking.</p>\n</blockquote>\n\n<blockquote>\n<p>As a side note, I really like openbgpd so far. Its configuration file format is clean and simple, documentation is good, error and information messages are clear, and CLI has intuitive syntax.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong></p>\n\n<p>###<a href=\"https://nocomplexity.com/the-power-to-serve/\">The Power to Serve</a></p>\n\n<blockquote>\n<p>All people within the IT Industry should known where the slogan “The Power To Serve” is exposed every day to millions of people. But maybe too much wishful thinking from me. But without “The Power To Serve” the IT industry today will look totally different. Companies like Apple, Juniper, Cisco and even WatsApp would not exist in their current form.</p>\n</blockquote>\n\n<blockquote>\n<p>I provide IT architecture services to make your complex IT landscape manageable and I love to solve complex security and privacy challenges. Complex challenges where people, processes and systems are heavily interrelated. For this knowledge intensive work I often run some IT experiments. When you run experiments nowadays you have a choice:</p>\n</blockquote>\n\n<ul>\n<li>Rent some cloud based services or</li>\n<li>DIY (Do IT Yourself) on premise</li>\n</ul>\n\n<blockquote>\n<p>Running your own developments experiments on your own infrastructure can be time consuming. However smart automation saves time and money. And by creating your own CICD pipeline (Continuous Integration, Continuous Deployment) you stay on top of core infrastructure developments. Even hands-on. Knowing how things work from a technical ‘hands-on’ perspective gives great advantages when it comes to solving complex business IT problems. Making a clear distinguish between a business problem or IT problem is useless. Business and IT problems are related. Sometimes causal related, but more often indirect by one or more non linear feedback loops. Almost every business depends of IT systems. Bad IT means often that your customers will leave your business.</p>\n</blockquote>\n\n<blockquote>\n<p>One of the things of FeeBSD for me is still FreeBSD Jails. In 2015 I had luck to attend to a presentation of the legendary hacker Poul-Henning Kamp . Check his BSD bio to see what he has done for the FreeBSD community! FreeBSD jails are a light way to visualize your system without enormous overhead. Now that the development on Linux for LXD/LXD is more mature (lxd is the next generation system container manager on linux) there is finally again an alternative for a nice chroot Linux based system again. At least when you do not need the overhead and management complexity that comes with Kubernetes or Docker.</p>\n</blockquote>\n\n<blockquote>\n<p>FreeBSD means control and quality for me. When there is an open source package I need, I want to install it from source. It gives me more control and always some extra knowledge on how things work. So no precompiled binaries for me on my BSD systems! If a build on FreeBSD fails most of the time this is an alert regarding the quality for me.</p>\n</blockquote>\n\n<blockquote>\n<p>If a complex OSS package is not available at all in the FreeBSD ports collection there should be a reason for it. Is it really that nobody on the world wants to do this dirty maintenance work? Or is there another cause that running this software on FreeBSD is not possible…There are currently 32644 ports available on FreeBSD. So all the major programming language, databases and middleware libraries are present. The FreeBSD organization is a mature organization and since this is one of the largest OSS projects worldwide learning how this community manages to keep innovation and creates and maintains software is a good entrance for learning how complex IT systems function.</p>\n</blockquote>\n\n<blockquote>\n<p>FreeBSD is of course BSD licensed. It worked well! There is still a strong community with lots of strong commercial sponsors around the community. Of course: sometimes a GPL license makes more sense. So beside FreeBSD I also love GPL software and the rationale and principles behind it. So my hope is that maybe within the next 25 years the hard battle between BSD vs GPL churches will be more rationalized and normalized. Principles are good, but as all good IT architects know: With good principles alone you never make a good system. So use requirements and not only principles to figure out what OSS license fits your project. There is never one size fits all.</p>\n</blockquote>\n\n<blockquote>\n<p>June 19, 1993 was the day the official name for FreeBSD was agreed upon. So this blog is written to celebrate 25th anniversary of FreeBSD.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###Dave’s BSDCan trip report</p>\n\n<ul>\n<li>So far, only one person has bothered to send in a BSDCan trip report. Our warmest thanks to Dave for doing his part.</li>\n</ul>\n\n<blockquote>\n<p>Hello guys! During the last show, you asked for a trip report regarding BSDCan 2018.<br>\nThis was my first time attending BSDCan. However, BSDCan was my second BSD conference overall, my first being vBSDCon 2017 in Reston, VA.<br>\nArriving early Thursday evening and after checking into the hotel, I headed straight to the Red Lion for the registration, picked up my badge and swag and then headed towards the ‘DMS’ building for the newbies talk. The only thing is, I couldn’t find the DMS building! Fortunately I found a BSDCan veteran who was heading there themselves. My only suggestion is to include the full building name and address on the BSDCan web site, or even a link to Google maps to help out with the navigation. The on-campus street maps didn’t have ‘DMS’ written on them anywhere. But I digress.<br>\nOnce I made it to the newbies talk hosted by Dan Langille and Michael W Lucas, it highlighted places to meet, an overview of what is happening, details about the ‘BSDCan widow/widower tours’ and most importantly, the 6-2-1 rule!<br>\nThe following morning, we were present with tea/coffee, muffins and other goodies to help prepare us for the day ahead.<br>\nThe first talk, “The Tragedy of systemd” covered what systemd did wrong and how the BSD community could improve on the ideas behind it.<br>\nWith the exception of Michael W Lucas, SSH Key Management and Kirk McKusick, The Evolution of FreeBSD Governance talk, I pretty much attended all of the ZFS talks including the lunchtime BoF session, hosted by Allan Jude. Coming from FreeNAS and being involved in the community, this is where my main interest and motivation lies. Since then I have been able to share some of that information with the FreeNAS community forums and chatroom.<br>\nI also attended the “Speculating about Intel” lunchtime BoF session hosted by Theo de Raddt, which proved to be “interesting”.<br>\nThe talks ended with the wrap up session with a few words from Dan, covering the record attendance and made very clear there “was no cabal”. Followed by the the handing over of Groff the BSD goat to a new owner, thank you’s from the FreeBSD Foundation to various community committers and maintainers, finally ending with the charity auction, where a things like a Canadian $20 bill sold for $40, a signed FreeBSD Foundation shirt originally worn by George Neville-Neil, a lost laptop charger, Michael’s used gelato spoon, various books, the last cookie and more importantly, the second to last cookie!<br>\nAfter the auction, we all headed to the Red Lion for food and drinks, sponsored by iXsystems.<br>\nI would like to thank the BSDCan organizers, speakers and sponsors for a great conference. I will certainly hope to attend next year!<br>\nRegards,<br>\nDave (aka m0nkey_)</p>\n</blockquote>\n\n<ul>\n<li>Thanks to Dave for sharing his experiences with us and our viewers</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-advocacy/2008-August/003674.html\">Robert Watson (from 2008) on how much FreeBSD is in Mac OS X </a></li>\n<li><a href=\"https://aloiskraus.wordpress.com/2018/06/16/why-skylakex-cpus-are-sometimes-50-slower-how-intel-has-broken-existing-code/\">Why Intel Skylake CPUs are sometimes 50% slower than older CPUs</a></li>\n<li><a href=\"https://lobste.rs/s/bos5cr/practical_unix_manuals_mdoc\">Kristaps Dzonsons is looking for somebody to maintain this as mentioned at this link</a></li>\n<li><a href=\"https://www.reddit.com/r/freebsd/comments/87rru4/formatting_floppy_disks_in_a_usb_floppy_disk_drive/\">camcontrol(8) saves the day again! Formatting floppy disks in a USB floppy disk drive</a></li>\n<li><a href=\"https://www.reddit.com/r/openbsd_gaming/comments/898ey5/32_great_indie_games_now_playable_on_current_7/\">32+ great indie games now playable on OpenBSD -current; 7 currently on sale!</a></li>\n<li><a href=\"https://bsd-pl.org/en\">Warsaw BSD User Group. June 27 2018 18:30-21:00, Wheel Systems Office, Aleje Jerozolimskie 178, Warsaw</a></li>\n</ul>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Ron - <a href=\"http://dpaste.com/2B6CWDM#wrap\">Adding a disk to ZFS</a></li>\n<li>Marshall - <a href=\"http://dpaste.com/2W7VD6K#wrap\">zfs question</a></li>\n<li>Thomas - <a href=\"http://dpaste.com/1FS7534#wrap\">Allan, the myth perpetuator</a></li>\n<li>Ross - <a href=\"http://dpaste.com/1HWQWB6#wrap\">ZFS IO stats per dataset</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"FreeBSD 11.2 has been released, setting up an MTA behind Tor, running pfsense on DigitalOcean, one year of C, using OpenBGPD to announce VM networks, the power to serve, and a BSDCan trip report.","date_published":"2018-06-28T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ee4c7eca-8ae4-44bc-965b-9631a9d99865.mp3","mime_type":"audio/mp3","size_in_bytes":56727001,"duration_in_seconds":5666}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2136","title":"Episode 251: Crypto HAMMER | BSD Now 251","url":"https://www.bsdnow.tv/251","content_text":"DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.\n\n##Headlines\n###DragonflyBSD: Towards a HAMMER1 master/slave encrypted setup with LUKS\n\n\nI just wanted to share my experience with setting up DragonFly master/slave HAMMER1 PFS’s on top of LUKS\nSo after a long time using an Synology for my NFS needs, I decided it was time to rethink my setup a little since I had several issues with it :\n\n\n\nYou cannot run NFS on top of encrypted partitions easily\nI suspect I am having some some data corruption (bitrot) on the ext4 filesystem\nthe NIC was stcuk to 100 Mbps instead of 1 Gbps even after swapping cables, switches, you name it\nIt’s proprietary\n\n\n\nI have been playing with DragonFly in the past and knew about HAMMER, now I just had the perfect excuse to actually use it in production :) After setting up the OS, creating the LUKS partition and HAMMER FS was easy :\n\n\nkdload dm\ncryptsetup luksFormat /dev/serno/&lt;id1&gt;\ncryptsetup luksOpen /dev/serno/&lt;id1&gt; fort_knox\nnewfs_hammer -L hammer1_secure_master /dev/mapper/fort_knox\ncryptsetup luksFormat /dev/serno/&lt;id2&gt;\ncryptsetup luksOpen /dev/serno/&lt;id2&gt; fort_knox_slave\nnewfs_hammer -L hammer1_secure_slave /dev/mapper/fort_knox_slave\n\n\nMount the 2 drives :\n\n\nmount /dev/mapper/fort_knox /fort_knox\nmount /dev/mapper_fort_know_slave /fort_knox_slave\n\n\nYou can now put your data under /fort_knox\nNow, off to setting up the replication, first get the shared-uuid of /fort_knox\n\n\nhammer pfs-status /fort_knox\n\n\nCreate a PFS slave “linked” to the master\n\n\nhammer pfs-slave /fort_knox_slave/pfs/slave shared-uuid=f9e7cc0d-eb59-10e3-a5b5-01e6e7cefc12\n\n\nAnd then stream your data to the slave PFS !\n\n\nhammer mirror-stream /fort_knox /fort_knox_slave/pfs/slave\n\n\nAfter that, setting NFS is fairly trivial even though I had problem with the /etc/exports syntax which is different than Linux\n\n\n\nThere’s a few things I wish would be better though but nothing too problematic or without workarounds :\n\n\n\nCannot unlock LUKS partitions at boot time afaik (Acceptable tradeoff for the added security LUKS gives me vs my old Synology setup) but this force me to run a script to unlock LUKS, mount hammer and start mirror-stream at each boot\nNo S1/S3 sleep so I made a script to shutdown the system when there’s no network neighborgs to serve the NFS\nAs my system isn’t online 24/7 for energy reasons, I guess will have to run hammer cleanup myself from time to time\nSome uncertainty because hey, it’s kind of exotic but exciting too :)\n\n\n\nOverall, I am happy, HAMMER1 and PFS are looking really good, DragonFly is a neat Unix and the community is super friendly (Matthew Dillon actually provided me with a kernel patch to fix the broken ACPI on the PC holding this setup, many thanks!), the system is still a “work in progress” but it is already serving my files as I write this post.\n\n\n\nLet’s see in 6 months how it goes in the longer run !\n\n\n\nHelpful resources : https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/\n\n\n\n\n###BSDCan 2018 Recap\n\n\nAs promised, here is our second part of our BSDCan report, covering the conference proper. The last tutorials/devsummit of that day lead directly into the conference, as people could pick up their registration packs at the Red Lion and have a drink with fellow BSD folks.\nAllan and I were there only briefly, as we wanted to get back to the “Newcomers orientation and mentorship” session lead by Michael W. Lucas. This session is intended for people that are new to BSDCan (maybe their first BSD conference ever?) and may have questions. Michael explained everything from the 6-2-1 rule (hours of sleep, meals per day, and number of showers that attendees should have at a minimum), to the partner and widowers program (lead by his wife Liz), to the sessions that people should not miss (opening, closing, and hallway track). Old-time BSDCan folks were asked to stand up so that people can recognize them and ask them any questions they might have during the conferences. The session was well attended. Afterwards, people went for dinner in groups, a big one lead by Michael Lucas to his favorite Shawarma place, followed by gelato (of course). This allowed newbies to mingle over dinner and ice cream, creating a welcoming atmosphere.\nThe next day, after Dan Langille opened the conference, Benno Rice gave the keynote presentation about “The Tragedy of Systemd”.\nBenedict went to the following talks:\n\n\n\n“Automating Network Infrastructures with Ansible on FreeBSD” in the DevSummit track. A good talk that connected well with his Ansible tutorial and even allowed some discussions among participants.\n“All along the dwatch tower”: Devin delivered a well prepared talk. I first thought that the number of slides would not fit into the time slot, but she even managed to give a demo of her work, which was well received. The dwatch tool she wrote should make it easy for people to get started with DTrace without learning too much about the syntax at first. The visualizations were certainly nice to see, combining different tools together in a new way.\nZFS BoF, lead by Allan and Matthew Ahrens\nSSH Key Management by Michael W. Lucas. Yet another great talk where I learned a lot. I did not get to the SSH CA chapter in the new SSH Mastery book, so this was a good way to wet my appetite for it and motivated me to look into creating one for the cluster that I’m managing.\nThe rest of the day was spent at the FreeBSD Foundation table, talking to various folks. Then, Allan and I had an interview with Kirk McKusick for National FreeBSD Day, then we had a core meeting, followed by a core dinner.\n\n\n\nDay 2:\n\n“Flexible Disk Use in OpenZFS”: Matthew Ahrens talking about the feature he is implementing to expand a RAID-Z with a single disk, as well as device removal.\nAllan’s talk about his efforts to implement ZSTD in OpenZFS as another compression algorithm. I liked his overview slides with the numbers comparing the algorithms for their effectiveness and his personal story about the sometimes rocky road to get the feature implemented.\n“zrepl - ZFS replication” by Christian Schwarz, was well prepared and even had a demo to show what his snapshot replication tool can do. We covered it on the show before and people can find it under sysutils/zrepl. Feedback and help is welcome.\n“The Evolution of FreeBSD Governance” by Kirk McKusick was yet another great talk by him covering the early days of FreeBSD until today, detailing some of the progress and challenges the project faced over the years in terms of leadership and governance. This is an ongoing process that everyone in the community should participate in to keep the project healthy and infused with fresh blood.\nClosing session and auction were funny and great as always.\nAll in all, yet another amazing BSDCan. Thank you Dan Langille and your organizing team for making it happen! Well done.\n\n\n\n\n\n\nDigital Ocean\n\n###NomadBSD 1.1-RC1 Released\n\n\nThe first – and hopefully final – release candidate of NomadBSD 1.1 is available!\n\n\n\nChanges\nThe base system has been upgraded to FreeBSD 11.2-RC3\nEFI booting has been fixed.\nSupport for modern Intel GPUs has been added.\nSupport for installing packages has been added.\nImproved setup menu.\nMore software packages:\nbenchmarks/bonnie++\nDSBDisplaySettings\nDSBExec\nDSBSu\nmail/thunderbird\nnet/mosh\nports-mgmt/octopkg\nprint/qpdfview\nsecurity/nmap\nsysutils/ddrescue\nsysutils/fusefs-hfsfuse\nsysutils/fusefs-sshfs\nsysutils/sleuthkit\nwww/lynx\nx11-wm/compton\nx11/xev\nx11/xterm\nMany improvements and bugfixes\nThe image and instructions can be found here.\n\n\n\n\n##News Roundup\n###LDAP client added to -current\n\nCVSROOT:    /cvs\nModule name:    src\nChanges by: reyk@cvs.openbsd.org    2018/06/13 09:45:58\n\nLog message:\n    Import ldap(1), a simple ldap search client.\n    We have an ldapd(8) server and ypldap in base, so it makes sense to\n    have a simple LDAP client without depending on the OpenLDAP package.\n    This tool can be used in an ssh(1) AuthorizedKeysCommand script.\n    \n    With feedback from many including millert@ schwarze@ gilles@ dlg@ jsing@\n    \n    OK deraadt@\n    \n    Status:\n    \n    Vendor Tag: reyk\n    Release Tags:   ldap_20180613\n    \n    N src/usr.bin/ldap/Makefile\n    N src/usr.bin/ldap/aldap.c\n    N src/usr.bin/ldap/aldap.h\n    N src/usr.bin/ldap/ber.c\n    N src/usr.bin/ldap/ber.h\n    N src/usr.bin/ldap/ldap.1\n    N src/usr.bin/ldap/ldapclient.c\n    N src/usr.bin/ldap/log.c\n    N src/usr.bin/ldap/log.h\n    \n    No conflicts created by this import\n\n\n\n\n###Intel® FPU Speculation Vulnerability Confirmed\n\n\nEarlier this month, Philip Guenther (guenther@) committed (to amd64 -current) a change from lazy to semi-eager FPU switching to mitigate against rumored FPU state leakage in Intel® CPUs.\nTheo de Raadt (deraadt@) discussed this in his BSDCan 2018 session.\nUsing information disclosed in Theo’s talk, Colin Percival developed a proof-of-concept exploit in around 5 hours. This seems to have prompted an early end to an embargo (in which OpenBSD was not involved), and the official announcement of the vulnerability.\nFPU change in FreeBSD\n\n\nSummary:\n\nSystem software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.\n\nDescription:\n\nSystem software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.\n\n    ·    CVSS - 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\nAffected Products:\n\nIntel® Core-based microprocessors.\n\nRecommendations:\n\nIf an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.\n\nAcknowledgements:\n\nIntel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.\n\n\n\n\niXsystems\niX Ad Spot\n###iX Systems - BSDCan 2018 Recap\n\n###FreeBSD gets pNFS support\n\nMerge the pNFS server code from projects/pnfs-planb-server into head.\n\nThis code merge adds a pNFS service to the NFSv4.1 server. Although it is\na large commit it should not affect behaviour for a non-pNFS NFS server.\nSome documentation on how this works can be found at:\nMerge the pN http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt\nand will hopefully be turned into a proper document soon.\nThis is a merge of the kernel code. Userland and man page changes will\ncome soon, once the dust settles on this merge.\nIt has passed a \"make universe\", so I hope it will not cause build problems.\nIt also adds NFSv4.1 server support for the \"current stateid\".\n\nHere is a brief overview of the pNFS service:\nA pNFS service separates the Read/Write operations from all the other NFSv4.1\nMetadata operations. It is hoped that this separation allows a pNFS service\nto be configured that exceeds the limits of a single NFS server for either\nstorage capacity and/or I/O bandwidth.\nIt is possible to configure mirroring within the data servers (DSs) so that\nthe data storage file for an MDS file will be mirrored on two or more of\nthe DSs.\nWhen this is used, failure of a DS will not stop the pNFS service and a\nfailed DS can be recovered once repaired while the pNFS service continues\nto operate.  Although two way mirroring would be the norm, it is possible\nto set a mirroring level of up to four or the number of DSs, whichever is\nless.\nThe Metadata server will always be a single point of failure,\njust as a single NFS server is.\n\nA Plan B pNFS service consists of a single MetaData Server (MDS) and K\nData Servers (DS), all of which are recent FreeBSD systems.\nClients will mount the MDS as they would a single NFS server.\nWhen files are created, the MDS creates a file tree identical to what a\nsingle NFS server creates, except that all the regular (VREG) files will\nbe empty. As such, if you look at the exported tree on the MDS directly\non the MDS server (not via an NFS mount), the files will all be of size 0.\nEach of these files will also have two extended attributes in the system\nattribute name space:\npnfsd.dsfile - This extended attrbute stores the information that\n    the MDS needs to find the data storage file(s) on DS(s) for this file.\npnfsd.dsattr - This extended attribute stores the Size, AccessTime, ModifyTime\n    and Change attributes for the file, so that the MDS doesn't need to\n    acquire the attributes from the DS for every Getattr operation.\nFor each regular (VREG) file, the MDS creates a data storage file on one\n(or more if mirroring is enabled) of the DSs in one of the \"dsNN\"\nsubdirectories.  The name of this file is the file handle\nof the file on the MDS in hexadecimal so that the name is unique.\nThe DSs use subdirectories named \"ds0\" to \"dsN\" so that no one directory\ngets too large. The value of \"N\" is set via the sysctl vfs.nfsd.dsdirsize\non the MDS, with the default being 20.\nFor production servers that will store a lot of files, this value should\nprobably be much larger.\nIt can be increased when the \"nfsd\" daemon is not running on the MDS,\nonce the \"dsK\" directories are created.\n\nFor pNFS aware NFSv4.1 clients, the FreeBSD server will return two pieces\nof information to the client that allows it to do I/O directly to the DS.\nDeviceInfo - This is relatively static information that defines what a DS\n             is. The critical bits of information returned by the FreeBSD\n             server is the IP address of the DS and, for the Flexible\n             File layout, that NFSv4.1 is to be used and that it is\n             \"tightly coupled\".\n             There is a \"deviceid\" which identifies the DeviceInfo.\nLayout     - This is per file and can be recalled by the server when it\n             is no longer valid. For the FreeBSD server, there is support\n             for two types of layout, call File and Flexible File layout.\n             Both allow the client to do I/O on the DS via NFSv4.1 I/O\n             operations. The Flexible File layout is a more recent variant\n             that allows specification of mirrors, where the client is\n             expected to do writes to all mirrors to maintain them in a\n             consistent state. The Flexible File layout also allows the\n             client to report I/O errors for a DS back to the MDS.\n             The Flexible File layout supports two variants referred to as\n             \"tightly coupled\" vs \"loosely coupled\". The FreeBSD server always\n             uses the \"tightly coupled\" variant where the client uses the\n             same credentials to do I/O on the DS as it would on the MDS.\n             For the \"loosely coupled\" variant, the layout specifies a\n             synthetic user/group that the client uses to do I/O on the DS.\n             The FreeBSD server does not do striping and always returns\n             layouts for the entire file. The critical information in a layout\n             is Read vs Read/Writea and DeviceID(s) that identify which\n             DS(s) the data is stored on.\n\nAt this time, the MDS generates File Layout layouts to NFSv4.1 clients\nthat know how to do pNFS for the non-mirrored DS case unless the sysctl\nvfs.nfsd.default_flexfile is set non-zero, in which case Flexible File\nlayouts are generated.\nThe mirrored DS configuration always generates Flexible File layouts.\nFor NFS clients that do not support NFSv4.1 pNFS, all I/O operations\nare done against the MDS which acts as a proxy for the appropriate DS(s).\nWhen the MDS receives an I/O RPC, it will do the RPC on the DS as a proxy.\nIf the DS is on the same machine, the MDS/DS will do the RPC on the DS as\na proxy and so on, until the machine runs out of some resource, such as\nsession slots or mbufs.\nAs such, DSs must be separate systems from the MDS.\n\n***\n\n###[What does {some strange unix command name} stand for?](http://www.unixguide.net/unix/faq/1.3.shtml)\n\n+ awk = \"Aho Weinberger and Kernighan\" \n+ grep = \"Global Regular Expression Print\" \n+ fgrep = \"Fixed GREP\". \n+ egrep = \"Extended GREP\" \n+ cat = \"CATenate\" \n+ gecos = \"General Electric Comprehensive Operating Supervisor\" \n+ nroff = \"New ROFF\" \n+ troff = \"Typesetter new ROFF\" \n+ tee = T \n+ bss = \"Block Started by Symbol\n+ biff = \"BIFF\" \n+ rc (as in \".cshrc\" or \"/etc/rc\") = \"RunCom\" \n+ Don Libes' book \"Life with Unix\" contains lots more of these \ntidbits. \n***\n\n##Beastie Bits\n+ [RetroBSD: Unix for microcontrollers](http://retrobsd.org/wiki/doku.php)\n+ [On the matter of OpenBSD breaking embargos (KRACK)](https://marc.info/?l=openbsd-tech&amp;m=152910536208954&amp;w=2)\n+ [Theo's Basement Computer Paradise (1998)](https://zeus.theos.com/deraadt/hosts.html)\n+ [Airport Extreme runs NetBSD](https://jcs.org/2018/06/12/airport_ssh)\n+ [What UNIX shell could have been](https://rain-1.github.io/shell-2.html)\n\n***\nTarsnap ad\n***\n\n##Feedback/Questions\n+ We need more feedback and questions. Please email feedback@bsdnow.tv \n+ Also, many of you owe us BSDCan trip reports! We have shared what our experience at BSDCan was like, but we want to hear about yours. What can we do better next year? What was it like being there for the first time?\n+ [Jason writes in](https://slexy.org/view/s205jU58X2)\n    + https://www.wheelsystems.com/en/products/wheel-fudo-psm/\n+ [June 19th was National FreeBSD Day](https://twitter.com/search?src=typd&amp;q=%23FreeBSDDay)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n***\n\n","content_html":"<p>DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.</p>\n\n<p>##Headlines<br>\n###<a href=\"https://www.reddit.com/r/dragonflybsd/comments/8riwtx/towards_a_hammer1_masterslave_encrypted_setup/\">DragonflyBSD: Towards a HAMMER1 master/slave encrypted setup with LUKS</a></p>\n\n<blockquote>\n<p>I just wanted to share my experience with setting up DragonFly master/slave HAMMER1 PFS’s on top of LUKS<br>\nSo after a long time using an Synology for my NFS needs, I decided it was time to rethink my setup a little since I had several issues with it :</p>\n</blockquote>\n\n<ul>\n<li>You cannot run NFS on top of encrypted partitions easily</li>\n<li>I suspect I am having some some data corruption (bitrot) on the ext4 filesystem</li>\n<li>the NIC was stcuk to 100 Mbps instead of 1 Gbps even after swapping cables, switches, you name it</li>\n<li>It’s proprietary</li>\n</ul>\n\n<blockquote>\n<p>I have been playing with DragonFly in the past and knew about HAMMER, now I just had the perfect excuse to actually use it in production :) After setting up the OS, creating the LUKS partition and HAMMER FS was easy :</p>\n</blockquote>\n\n<p><code>kdload dm</code><br>\n<code>cryptsetup luksFormat /dev/serno/&lt;id1&gt;</code><br>\n<code>cryptsetup luksOpen /dev/serno/&lt;id1&gt; fort_knox</code><br>\n<code>newfs_hammer -L hammer1_secure_master /dev/mapper/fort_knox</code><br>\n<code>cryptsetup luksFormat /dev/serno/&lt;id2&gt;</code><br>\n<code>cryptsetup luksOpen /dev/serno/&lt;id2&gt; fort_knox_slave</code><br>\n<code>newfs_hammer -L hammer1_secure_slave /dev/mapper/fort_knox_slave</code></p>\n\n<ul>\n<li>Mount the 2 drives :</li>\n</ul>\n\n<p><code>mount /dev/mapper/fort_knox /fort_knox</code><br>\n<code>mount /dev/mapper_fort_know_slave /fort_knox_slave</code></p>\n\n<blockquote>\n<p>You can now put your data under /fort_knox<br>\nNow, off to setting up the replication, first get the shared-uuid of /fort_knox</p>\n</blockquote>\n\n<p><code>hammer pfs-status /fort_knox</code></p>\n\n<blockquote>\n<p>Create a PFS slave “linked” to the master</p>\n</blockquote>\n\n<p><code>hammer pfs-slave /fort_knox_slave/pfs/slave shared-uuid=f9e7cc0d-eb59-10e3-a5b5-01e6e7cefc12</code></p>\n\n<blockquote>\n<p>And then stream your data to the slave PFS !</p>\n</blockquote>\n\n<p><code>hammer mirror-stream /fort_knox /fort_knox_slave/pfs/slave</code></p>\n\n<blockquote>\n<p>After that, setting NFS is fairly trivial even though I had problem with the /etc/exports syntax which is different than Linux</p>\n</blockquote>\n\n<blockquote>\n<p>There’s a few things I wish would be better though but nothing too problematic or without workarounds :</p>\n</blockquote>\n\n<ul>\n<li>Cannot unlock LUKS partitions at boot time afaik (Acceptable tradeoff for the added security LUKS gives me vs my old Synology setup) but this force me to run a script to unlock LUKS, mount hammer and start mirror-stream at each boot</li>\n<li>No S1/S3 sleep so I made a script to shutdown the system when there’s no network neighborgs to serve the NFS</li>\n<li>As my system isn’t online 24/7 for energy reasons, I guess will have to run hammer cleanup myself from time to time</li>\n<li>Some uncertainty because hey, it’s kind of exotic but exciting too :)</li>\n</ul>\n\n<blockquote>\n<p>Overall, I am happy, HAMMER1 and PFS are looking really good, DragonFly is a neat Unix and the community is super friendly (Matthew Dillon actually provided me with a kernel patch to fix the broken ACPI on the PC holding this setup, many thanks!), the system is still a “work in progress” but it is already serving my files as I write this post.</p>\n</blockquote>\n\n<blockquote>\n<p>Let’s see in 6 months how it goes in the longer run !</p>\n</blockquote>\n\n<ul>\n<li>Helpful resources : <a href=\"https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/\">https://www.dragonflybsd.org/docs/how_to_implement_hammer_pseudo_file_system__40___pfs___41___slave_mirroring_from_pfs_master/</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>###BSDCan 2018 Recap</p>\n\n<ul>\n<li>As promised, here is our second part of our BSDCan report, covering the conference proper. The last tutorials/devsummit of that day lead directly into the conference, as people could pick up their registration packs at the Red Lion and have a drink with fellow BSD folks.</li>\n<li>Allan and I were there only briefly, as we wanted to get back to the “Newcomers orientation and mentorship” session lead by Michael W. Lucas. This session is intended for people that are new to BSDCan (maybe their first BSD conference ever?) and may have questions. Michael explained everything from the 6-2-1 rule (hours of sleep, meals per day, and number of showers that attendees should have at a minimum), to the partner and widowers program (lead by his wife Liz), to the sessions that people should not miss (opening, closing, and hallway track). Old-time BSDCan folks were asked to stand up so that people can recognize them and ask them any questions they might have during the conferences. The session was well attended. Afterwards, people went for dinner in groups, a big one lead by Michael Lucas to his favorite Shawarma place, followed by gelato (of course). This allowed newbies to mingle over dinner and ice cream, creating a welcoming atmosphere.</li>\n<li>The next day, after Dan Langille opened the conference, Benno Rice gave the keynote presentation about “The Tragedy of Systemd”.</li>\n<li>Benedict went to the following talks:</li>\n</ul>\n\n<blockquote>\n<p>“Automating Network Infrastructures with Ansible on FreeBSD” in the DevSummit track. A good talk that connected well with his Ansible tutorial and even allowed some discussions among participants.<br>\n“All along the dwatch tower”: Devin delivered a well prepared talk. I first thought that the number of slides would not fit into the time slot, but she even managed to give a demo of her work, which was well received. The dwatch tool she wrote should make it easy for people to get started with DTrace without learning too much about the syntax at first. The visualizations were certainly nice to see, combining different tools together in a new way.<br>\nZFS BoF, lead by Allan and Matthew Ahrens<br>\nSSH Key Management by Michael W. Lucas. Yet another great talk where I learned a lot. I did not get to the SSH CA chapter in the new SSH Mastery book, so this was a good way to wet my appetite for it and motivated me to look into creating one for the cluster that I’m managing.<br>\nThe rest of the day was spent at the FreeBSD Foundation table, talking to various folks. Then, Allan and I had an interview with Kirk McKusick for National FreeBSD Day, then we had a core meeting, followed by a core dinner.</p>\n</blockquote>\n\n<ul>\n<li>Day 2:\n<blockquote>\n<p>“Flexible Disk Use in OpenZFS”: Matthew Ahrens talking about the feature he is implementing to expand a RAID-Z with a single disk, as well as device removal.<br>\nAllan’s talk about his efforts to implement ZSTD in OpenZFS as another compression algorithm. I liked his overview slides with the numbers comparing the algorithms for their effectiveness and his personal story about the sometimes rocky road to get the feature implemented.<br>\n“zrepl - ZFS replication” by Christian Schwarz, was well prepared and even had a demo to show what his snapshot replication tool can do. We covered it on the show before and people can find it under sysutils/zrepl. Feedback and help is welcome.<br>\n“The Evolution of FreeBSD Governance” by Kirk McKusick was yet another great talk by him covering the early days of FreeBSD until today, detailing some of the progress and challenges the project faced over the years in terms of leadership and governance. This is an ongoing process that everyone in the community should participate in to keep the project healthy and infused with fresh blood.<br>\nClosing session and auction were funny and great as always.<br>\nAll in all, yet another amazing BSDCan. Thank you Dan Langille and your organizing team for making it happen! Well done.</p>\n</blockquote>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Digital Ocean</strong></p>\n\n<p>###<a href=\"http://nomadbsd.org/index.html#rel1.1-rc1\">NomadBSD 1.1-RC1 Released</a></p>\n\n<blockquote>\n<p>The first – and hopefully final – release candidate of NomadBSD 1.1 is available!</p>\n</blockquote>\n\n<ul>\n<li>Changes</li>\n<li>The base system has been upgraded to FreeBSD 11.2-RC3</li>\n<li>EFI booting has been fixed.</li>\n<li>Support for modern Intel GPUs has been added.</li>\n<li>Support for installing packages has been added.</li>\n<li>Improved setup menu.</li>\n<li>More software packages:</li>\n<li>benchmarks/bonnie++</li>\n<li>DSBDisplaySettings</li>\n<li>DSBExec</li>\n<li>DSBSu</li>\n<li>mail/thunderbird</li>\n<li>net/mosh</li>\n<li>ports-mgmt/octopkg</li>\n<li>print/qpdfview</li>\n<li>security/nmap</li>\n<li>sysutils/ddrescue</li>\n<li>sysutils/fusefs-hfsfuse</li>\n<li>sysutils/fusefs-sshfs</li>\n<li>sysutils/sleuthkit</li>\n<li>www/lynx</li>\n<li>x11-wm/compton</li>\n<li>x11/xev</li>\n<li>x11/xterm</li>\n<li>Many improvements and bugfixes<br>\nThe image and instructions can be found <a href=\"http://nomadbsd.org/download.html\">here</a>.</li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://undeadly.org/cgi?action=article;sid=20180616115514\">LDAP client added to -current</a></p>\n\n<pre><code>CVSROOT:    /cvs\nModule name:    src\nChanges by: reyk@cvs.openbsd.org    2018/06/13 09:45:58\n\nLog message:\n    Import ldap(1), a simple ldap search client.\n    We have an ldapd(8) server and ypldap in base, so it makes sense to\n    have a simple LDAP client without depending on the OpenLDAP package.\n    This tool can be used in an ssh(1) AuthorizedKeysCommand script.\n    \n    With feedback from many including millert@ schwarze@ gilles@ dlg@ jsing@\n    \n    OK deraadt@\n    \n    Status:\n    \n    Vendor Tag: reyk\n    Release Tags:   ldap_20180613\n    \n    N src/usr.bin/ldap/Makefile\n    N src/usr.bin/ldap/aldap.c\n    N src/usr.bin/ldap/aldap.h\n    N src/usr.bin/ldap/ber.c\n    N src/usr.bin/ldap/ber.h\n    N src/usr.bin/ldap/ldap.1\n    N src/usr.bin/ldap/ldapclient.c\n    N src/usr.bin/ldap/log.c\n    N src/usr.bin/ldap/log.h\n    \n    No conflicts created by this import\n</code></pre>\n\n<p><hr></p>\n\n<p>###<a href=\"https://undeadly.org/cgi?action=article;sid=20180614064341\">Intel® FPU Speculation Vulnerability Confirmed</a></p>\n\n<ul>\n<li>Earlier this month, Philip Guenther (guenther@) <a href=\"https://marc.info/?l=openbsd-cvs&amp;m=152818076013158&amp;w=2\">committed</a> (to amd64 -current) a change from lazy to semi-eager FPU switching to mitigate against rumored FPU state leakage in Intel® CPUs.</li>\n<li>Theo de Raadt (deraadt@) discussed this in <a href=\"https://undeadly.org/cgi?action=article;sid=20180611101817\">his BSDCan 2018 session</a>.</li>\n<li>Using information disclosed in Theo’s talk, <a href=\"https://twitter.com/cperciva/status/1007010583244230656\">Colin Percival</a> developed a proof-of-concept exploit in around 5 hours. This seems to have prompted an early end to an embargo (in which OpenBSD was not involved), and the <a href=\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html\">official announcement</a> of the vulnerability.</li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=335072\">FPU change in FreeBSD</a></li>\n</ul>\n\n<pre><code>Summary:\n\nSystem software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.\n\nDescription:\n\nSystem software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.\n\n    ·    CVSS - 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\nAffected Products:\n\nIntel® Core-based microprocessors.\n\nRecommendations:\n\nIf an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.\n\nAcknowledgements:\n\nIntel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.\n</code></pre>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong><br>\niX Ad Spot<br>\n###<a href=\"https://www.ixsystems.com/blog/bsdcan-2018-recap/\">iX Systems - BSDCan 2018 Recap</a></p>\n\n<p>###<a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=335012\">FreeBSD gets pNFS support</a></p>\n\n<pre><code>Merge the pNFS server code from projects/pnfs-planb-server into head.\n\nThis code merge adds a pNFS service to the NFSv4.1 server. Although it is\na large commit it should not affect behaviour for a non-pNFS NFS server.\nSome documentation on how this works can be found at:\nMerge the pN http://people.freebsd.org/~rmacklem/pnfs-planb-setup.txt\nand will hopefully be turned into a proper document soon.\nThis is a merge of the kernel code. Userland and man page changes will\ncome soon, once the dust settles on this merge.\nIt has passed a &quot;make universe&quot;, so I hope it will not cause build problems.\nIt also adds NFSv4.1 server support for the &quot;current stateid&quot;.\n\nHere is a brief overview of the pNFS service:\nA pNFS service separates the Read/Write operations from all the other NFSv4.1\nMetadata operations. It is hoped that this separation allows a pNFS service\nto be configured that exceeds the limits of a single NFS server for either\nstorage capacity and/or I/O bandwidth.\nIt is possible to configure mirroring within the data servers (DSs) so that\nthe data storage file for an MDS file will be mirrored on two or more of\nthe DSs.\nWhen this is used, failure of a DS will not stop the pNFS service and a\nfailed DS can be recovered once repaired while the pNFS service continues\nto operate.  Although two way mirroring would be the norm, it is possible\nto set a mirroring level of up to four or the number of DSs, whichever is\nless.\nThe Metadata server will always be a single point of failure,\njust as a single NFS server is.\n\nA Plan B pNFS service consists of a single MetaData Server (MDS) and K\nData Servers (DS), all of which are recent FreeBSD systems.\nClients will mount the MDS as they would a single NFS server.\nWhen files are created, the MDS creates a file tree identical to what a\nsingle NFS server creates, except that all the regular (VREG) files will\nbe empty. As such, if you look at the exported tree on the MDS directly\non the MDS server (not via an NFS mount), the files will all be of size 0.\nEach of these files will also have two extended attributes in the system\nattribute name space:\npnfsd.dsfile - This extended attrbute stores the information that\n    the MDS needs to find the data storage file(s) on DS(s) for this file.\npnfsd.dsattr - This extended attribute stores the Size, AccessTime, ModifyTime\n    and Change attributes for the file, so that the MDS doesn't need to\n    acquire the attributes from the DS for every Getattr operation.\nFor each regular (VREG) file, the MDS creates a data storage file on one\n(or more if mirroring is enabled) of the DSs in one of the &quot;dsNN&quot;\nsubdirectories.  The name of this file is the file handle\nof the file on the MDS in hexadecimal so that the name is unique.\nThe DSs use subdirectories named &quot;ds0&quot; to &quot;dsN&quot; so that no one directory\ngets too large. The value of &quot;N&quot; is set via the sysctl vfs.nfsd.dsdirsize\non the MDS, with the default being 20.\nFor production servers that will store a lot of files, this value should\nprobably be much larger.\nIt can be increased when the &quot;nfsd&quot; daemon is not running on the MDS,\nonce the &quot;dsK&quot; directories are created.\n\nFor pNFS aware NFSv4.1 clients, the FreeBSD server will return two pieces\nof information to the client that allows it to do I/O directly to the DS.\nDeviceInfo - This is relatively static information that defines what a DS\n             is. The critical bits of information returned by the FreeBSD\n             server is the IP address of the DS and, for the Flexible\n             File layout, that NFSv4.1 is to be used and that it is\n             &quot;tightly coupled&quot;.\n             There is a &quot;deviceid&quot; which identifies the DeviceInfo.\nLayout     - This is per file and can be recalled by the server when it\n             is no longer valid. For the FreeBSD server, there is support\n             for two types of layout, call File and Flexible File layout.\n             Both allow the client to do I/O on the DS via NFSv4.1 I/O\n             operations. The Flexible File layout is a more recent variant\n             that allows specification of mirrors, where the client is\n             expected to do writes to all mirrors to maintain them in a\n             consistent state. The Flexible File layout also allows the\n             client to report I/O errors for a DS back to the MDS.\n             The Flexible File layout supports two variants referred to as\n             &quot;tightly coupled&quot; vs &quot;loosely coupled&quot;. The FreeBSD server always\n             uses the &quot;tightly coupled&quot; variant where the client uses the\n             same credentials to do I/O on the DS as it would on the MDS.\n             For the &quot;loosely coupled&quot; variant, the layout specifies a\n             synthetic user/group that the client uses to do I/O on the DS.\n             The FreeBSD server does not do striping and always returns\n             layouts for the entire file. The critical information in a layout\n             is Read vs Read/Writea and DeviceID(s) that identify which\n             DS(s) the data is stored on.\n\nAt this time, the MDS generates File Layout layouts to NFSv4.1 clients\nthat know how to do pNFS for the non-mirrored DS case unless the sysctl\nvfs.nfsd.default_flexfile is set non-zero, in which case Flexible File\nlayouts are generated.\nThe mirrored DS configuration always generates Flexible File layouts.\nFor NFS clients that do not support NFSv4.1 pNFS, all I/O operations\nare done against the MDS which acts as a proxy for the appropriate DS(s).\nWhen the MDS receives an I/O RPC, it will do the RPC on the DS as a proxy.\nIf the DS is on the same machine, the MDS/DS will do the RPC on the DS as\na proxy and so on, until the machine runs out of some resource, such as\nsession slots or mbufs.\nAs such, DSs must be separate systems from the MDS.\n\n***\n\n###[What does {some strange unix command name} stand for?](http://www.unixguide.net/unix/faq/1.3.shtml)\n\n+ awk = &quot;Aho Weinberger and Kernighan&quot; \n+ grep = &quot;Global Regular Expression Print&quot; \n+ fgrep = &quot;Fixed GREP&quot;. \n+ egrep = &quot;Extended GREP&quot; \n+ cat = &quot;CATenate&quot; \n+ gecos = &quot;General Electric Comprehensive Operating Supervisor&quot; \n+ nroff = &quot;New ROFF&quot; \n+ troff = &quot;Typesetter new ROFF&quot; \n+ tee = T \n+ bss = &quot;Block Started by Symbol\n+ biff = &quot;BIFF&quot; \n+ rc (as in &quot;.cshrc&quot; or &quot;/etc/rc&quot;) = &quot;RunCom&quot; \n+ Don Libes' book &quot;Life with Unix&quot; contains lots more of these \ntidbits. \n***\n\n##Beastie Bits\n+ [RetroBSD: Unix for microcontrollers](http://retrobsd.org/wiki/doku.php)\n+ [On the matter of OpenBSD breaking embargos (KRACK)](https://marc.info/?l=openbsd-tech&amp;m=152910536208954&amp;w=2)\n+ [Theo's Basement Computer Paradise (1998)](https://zeus.theos.com/deraadt/hosts.html)\n+ [Airport Extreme runs NetBSD](https://jcs.org/2018/06/12/airport_ssh)\n+ [What UNIX shell could have been](https://rain-1.github.io/shell-2.html)\n\n***\nTarsnap ad\n***\n\n##Feedback/Questions\n+ We need more feedback and questions. Please email feedback@bsdnow.tv \n+ Also, many of you owe us BSDCan trip reports! We have shared what our experience at BSDCan was like, but we want to hear about yours. What can we do better next year? What was it like being there for the first time?\n+ [Jason writes in](https://slexy.org/view/s205jU58X2)\n    + https://www.wheelsystems.com/en/products/wheel-fudo-psm/\n+ [June 19th was National FreeBSD Day](https://twitter.com/search?src=typd&amp;q=%23FreeBSDDay)\n***\n\n- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to [feedback@bsdnow.tv](mailto:feedback@bsdnow.tv)\n***\n\n</code></pre>","summary":"DragonflyBSD’s hammer1 encrypted master/slave setup, second part of our BSDCan recap, NomadBSD 1.1-RC1 available, OpenBSD adds an LDAP client to base, FreeBSD gets pNFS support, Intel FPU Speculation Vulnerability confirmed, and what some Unix command names mean.","date_published":"2018-06-21T05:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/034d5002-639f-4744-a773-9c000ce91d1c.mp3","mime_type":"audio/mp3","size_in_bytes":53300210,"duration_in_seconds":5323}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2107","title":"Episode 250: BSDCan 2018 Recap | BSD Now 250","url":"https://www.bsdnow.tv/250","content_text":"TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.\n\n##Headlines##\n###TrueOS to Focus on Core Operating System\n\n\nThe TrueOS Project has some big plans in the works, and we want to take a minute and share them with you. Many have come to know TrueOS as the “graphical FreeBSD” that makes things easy for newcomers to the BSDs. Today we’re announcing that TrueOS is shifting our focus a bit to become a cutting-edge operating system that keeps all of the stability that you know and love from ZFS (OpenZFS) and FreeBSD, and adds additional features to create a fresh, innovative operating system. Our goal is to create a core-centric operating system that is modular, functional, and perfect for do-it-yourselfers and advanced users alike.\n\n\n\nTrueOS will become a downstream fork that will build on FreeBSD by integrating new software technologies like OpenRC and LibreSSL. Work has already begun which allows TrueOS to be used as a base platform for other projects, including JSON-based manifests, integrated Poudriere / pkg tools and much more. We’re planning on a six month release cycle to keep development moving and fresh, allowing us to bring you hot new features to ZFS, bhyve and related tools in a timely manner. This makes TrueOS the perfect fit to serve as the basis for building other distributions.\n\n\n\nSome of you are probably asking yourselves “But what if I want to have a graphical desktop?” Don’t worry! We’re making sure that everyone who knows and loves the legacy desktop version of TrueOS will be able to continue using a FreeBSD-based, graphical operating system in the future. For instance, if you want to add KDE, just use sudo pkg install kde and voila! You have your new shiny desktop. Easy right? This allows us to get back to our roots of being a desktop agnostic operating system. If you want to add a new desktop environment, you get to pick the one that best suits your use.\n\n\n\nWe know that some of you will still be looking for an out-of-the-box solution similar to legacy PC-BSD and TrueOS. We’re happy to announce that Project Trident will take over graphical FreeBSD development going forward. Not much is going to change in that regard other than a new name! You’ll still have Lumina Desktop as a lightweight and feature-rich desktop environment and tons of utilities from the legacy TrueOS toolchain like sysadm and AppCafe. There will be migration paths available for those that would like to move to other FreeBSD-based distributions like Project Trident or GhostBSD.\n\n\n\nWe look forward to this new chapter for TrueOS and hope you will give the new edition a spin! Tell us what you think about the new changes by leaving us a comment. Don’t forget you can ask us questions on our Twitter and be a part of our community by joining the new TrueOS Forums when they go live in about a week. Thanks for being a loyal fan of TrueOS.\n\n\n###Project Trident FAQ\n\n\nQ: Why did you pick the name “Project Trident”?\n\n\n\nA: We were looking for a name that was unique, yet would still relate to the BSD community. Since Beastie (the FreeBSD mascot) is always pictured with a trident, it felt like that would be a great name.\n\n\n\nQ: Where can users go for technical support?\n\n\n\nA: At the moment, Project Trident will continue sharing the TrueOS community forums and Telegram channels. We are currently evaluating dedicated options for support channels in the future.\n\n\n\nQ: Can I help contribute to the project?\n\n\n\nA: We are always looking for developers who want to join the project. If you’re not a developer you can still help, as a community project we will be more reliant on contributions from the community in the form of how-to guides and other user-centric documentation and support systems.\n\n\n\nQ: How is the project supported financially?\n\n\n\nA: Project Trident is sponsored by the community, from both individuals and corporations. iXsystems has stepped up as the first enterprise-level sponsor of the project, and has been instrumental in getting Project Trident up and running. Please visit the Sponsors page to see all the current sponsors.\n\n\n\nQ: How can I help support the project financially?\n\n\n\nA: Several methods exist, from one time or recurring donations via Paypal to limited time swag t-shirt campaigns during the year. We are also looking into more alternative methods of support, so please visit the Sponsors page to see all the current methods of sponsorship.\n\n\n\nQ: Will there be any transparency of the financial donations and expenditures?\n\n\n\nA: Yes, we will be totally open with how much money comes into the project and what it is spent on. Due to concerns of privacy, we will not identify individuals and their donation amounts unless they specifically request to be identified. We will release a monthly overview in/out ledger, so that community members can see where their money is going.\n\n\n\n\nRelationship with TrueOS\n\n\nProject Trident does have very close ties to the TrueOS project, since most of the original Project Trident developers were once part of the TrueOS project before it became a distribution platform. For users of the TrueOS desktop, we have some additional questions and answers below.\n\n\nQ: Do we need to be at a certain TrueOS install level/release to upgrade?\n\n\n\n\nA: As long as you have a TrueOS system which has been updated to at least the 18.03 release you should be able to just perform a system update to be automatically upgraded to Project Trident.\n\n\n\nQ: Which members moved from TrueOS to Project Trident?\n\n\n\nA: Project Trident is being led by prior members of the TrueOS desktop team. Ken and JT (development), Tim (documentation) and Rod (Community/Support). Since Project Trident is a community-first project, we look forward to working with new members of the team.\n\n\n\n\niXsystems\n\n###BSDCan\n\n\nBSDCan finished Saturday last week\nIt started with the GoatBoF on Tuesday at the Royal Oak Pub, where people had a chance to meet and greet. Benedict could not attend due to an all-day FreeBSD Foundation meeting and and even FreeBSD Journal Editorial Board meeting.\nThe FreeBSD devsummit was held the next two days in parallel to the tutorials. Gordon Tetlow, who organized the devsummit, opened the devsummit. Deb Goodkin from the FreeBSD Foundation gave the first talk with a Foundation update, highlighting current and future efforts. Li-Wen Hsu is now employed by the Foundation to assist in QA work (Jenkins, CI/CD) and Gordon Tetlow has a part-time contract to help secteam as their secretary.\nNext, the FreeBSD core team (among them Allan and Benedict) gave a talk about what has happened this last term. With a core election currently running, some of these items will carry over to the next core team, but there were also some finished ones like the FCP process and FreeBSD members initiative. People in the audience asked questions on various topics of interest.\nAfter the coffee break, the release engineering team gave a talk about their efforts in terms of making releases happen in time and good quality.\nBenedict had to give his Ansible tutorial in the afternoon, which had roughly 15 people attending. Most of them beginners, we could get some good discussions going and I also learned a few new tricks. The overall feedback was positive and one even asked what I’m going to teach next year.\nThe second day of the FreeBSD devsummit began with Gordon Tetlow giving an insight into the FreeBSD Security team (aka secteam). He gave a overview of secteam members and responsibilities, explaining the process based on a long past advisory. Developers were encouraged to help out secteam. NDAs and proper disclosure of vulnerabilities were also discussed, and the audience had some feedback and questions.\nWhen the coffee break was over, the FreeBSD 12.0 planning session happened. A Google doc served as a collaborative way of gathering features and things left to do. People signed up for it or were volunteered. Some features won’t make it into 12.0 as they are not 100% ready for prime time and need a few more rounds of testing and bugfixing. Still, 12.0 will have some compelling features.\nA 360° group picture was taken after lunch, and then people split up into the working groups for the afternoon or started hacking in the UofO Henderson residence.\nBenedict and Allan both attended the OpenZFS working group, lead by Matt Ahrens. He presented the completed and outstanding work in FreeBSD, without spoiling too much of the ZFS presentations of various people that happened later at the conference.\nBenedict joined the boot code session a bit late (hallway track is the reason) when most things seem to have already been discussed.\nBSDCan 2018 — Ottawa (In Pictures)\niXsystems Photos from BSDCan 2018\n\n\n\n\n##News Roundup\n###June HardenedBSD Foundation Update\n\n\nWe at HardenedBSD are working towards starting up a 501©(3) not-for-profit organization in the USA. Setting up this organization will allow future donations to be tax deductible. We’ve made progress and would like to share with you the current state of affairs.\n\n\n\nWe have identified, sent invitations out, and received acceptance letters from six people who will serve on the HardenedBSD Foundation Board of Directors. You can find their bios below. In the latter half of June 2018 or the beginning half of July 2018, we will meet for the first time as a board and formally begin the process of creating the documentation needed to submit to the local, state, and federal tax services.\n\n\n\nHere’s a brief introduction to those who will serve on the board:\n\n\n\n\nW. Dean Freeman (Advisor): Dean has ten years of professional experience with deploying and security Unix and networking systems, including assessing systems security for government certification and assessing the efficacy of security products. He was introduced to Unix via FreeBSD 2.2.8 on an ISP shell account as a teenager. Formerly, he was the Snort port maintainer for FreeBSD while working in the Sourcefire VRT, and has contributed entropy-related patches to the FreeBSD and HardenedBSD projects – a topic on which he presented at vBSDCon 2017.\n\n\nBen La Monica (Advisor): Ben is a Senior Technology Manager of Software Engineering at Morningstar, Inc and has been developing software for over 15 years in a variety of languages. He advocates open source software and enjoys tinkering with electronics and home automation.\n\n\nGeorge Saylor (Advisor): George is a Technical Directory at G2, Inc. Mr. Saylor has over 28 years of information systems and security experience in a broad range of disciplines. His core focus areas are automation and standards in the event correlation space as well as penetration and exploitation of computer systems. Mr Saylor was also a co-founder of the OpenSCAP project.\n\n\nVirginia Suydan (Accountant and general administrator): Accountant and general administrator for the HardenedBSD Foundation. She has worked with Shawn Webb for tax and accounting purposes for over six years.\n\n\nShawn Webb (Director): Co-founder of HardenedBSD and all-around infosec wonk. He has worked and played in the infosec industry, doing both offensive and defensive research, for around fifteen years. He loves open source technologies and likes to frustrate the bad guys.\n\n\nBen Welch (Advisor): Ben is currently a Security Engineer at G2, Inc. He graduated from Pennsylvania College of Technology with a Bachelors in Information Assurance and Security. Ben likes long walks, beaches, candlelight dinners, and attending various conferences like BSides and ShmooCon.\n\n\n\n\n\n###Your own VPN with OpenIKED &amp; OpenBSD\n\n\nRemote connectivity to your home network is something I think a lot of people find desirable. Over the years, I’ve just established an SSH tunnel and use it as a SOCKS proxy, sending my traffic through that. It’s a nice solution for a “poor man’s VPN”, but it can be a bit clunky, and it’s not great having to expose SSH to the world, even if you make sure to lock everything down \n\n\n\nI set out the other day to finally do it properly. I’d come across this great post by Gordon Turner: OpenBSD 6.2 VPN Endpoint for iOS and macOS\n\n\n\nWhilst it was exactly what I was looking for, it outlined how to set up an L2TP VPN. Really, I wanted IKEv2 for performance and security reasons (I won’t elaborate on this here, if you’re curious about the differences, there’s a lot of content out on the web explaining this).\n\n\n\nThe client systems I’d be using have native support for IKEv2 (iOS, macOS, other BSD systems). But, I couldn’t find any tutorials in the same vein.\n\n\n\nSo, let’s get stuck in!\n\n\n\nA quick note ✍️\n\n\n\nThis guide will walk through the set up of an IKEv2 VPN using OpenIKED on OpenBSD. It will detail a “road warrior” configuration, and use a PSK (pre-shared-key) for authentication. I’m sure it can be easily adapted to work on any other platforms that OpenIKED is available on, but keep in mind my steps are specifically for OpenBSD.\n\n\n\nServer Configuration\n\n\n\nAs with all my home infrastructure, I crafted this set-up declaratively. So, I had the deployment of the VM setup in Terraform (deployed on my private Triton cluster), and wrote the configuration in Ansible, then tied them together using radekg/terraform-provisioner-ansible.\n\n\n\nOne of the reasons I love Ansible is that its syntax is very simplistic, yet expressive. As such, I feel it fits very well into explaining these steps with snippets of the playbook I wrote.  I’ll link the full playbook a bit further down for those interested.\n\n\n\nSee the full article for the information on:\nsysctl parameters\nThe naughty list (optional)\nConfigure the VPN network interface\nConfigure the firewall\nConfigure the iked service\nGateway configuration\nClient configuration\nTroubleshooting\n\n\n\n\nDigitalOcean\n\n###FreeBSD on a System76 Galago Pro\n\n\nHey all, It’s been a while since I last posted but I thought I would hammer something out here. My most recent purchase was a System76 Galago Pro. I thought, afer playing with POP! OS a bit, is there any reason I couldn’t get BSD on this thing. Turns out the answer is no, no there isnt and it works pretty decently.\n\n\n\nTo get some accounting stuff out of the way I tested this all on FreeBSD Head and 11.1, and all of it is valid as of May 10, 2018. Head is a fast moving target so some of this is only bound to improve.\n\n\n\n\nThe hardware\n\n\nIntel Core i5 Gen 8\n\n\nUHD Graphics 620\n\n\n16 GB DDR4 Ram\n\n\nRTL8411B PCI Express Card Reader\n\n\nRTL8111 Gigabit ethernet controller\n\n\nIntel HD Audio\n\n\nSamsung SSD 960 PRO 512GB NVMe\n\n\nThe caveats\n\n\n\n\nThere are a few things that I cant seem to make work straight out of the box, and that is the SD Card reader, the backlight, and the audio is a bit finicky. Also the trackpad doesn’t respond to two finger scrolling. The wiki is mostly up to date, there are a few edits that need to be made still but there is a bug where I cant register an account yet so I haven’t made all the changes.\n\n\n\nProcessor\n\n\n\nIt works like any other Intel processor. Pstates and throttling work.\n\n\n\nGraphics\n\n\n\nThe boot menu sets itself to what looks like 1024x768, but works as you expect in a tiny window. The text console does the full 3200x1800 resolution, but the text is ultra tiny. There isnt a font for the console that covers hidpi screens yet. As for X Windows it requres the drm-kmod-next package. Once installed follow the directions from the package and it works with almost no fuss. I have it running on X with full intel acceleration, but it is running at it’s full 3200x1800 resolution, to scale that down just do xrandr --output eDP-1 --scale 0.5x0.5 it will blow it up to roughly 200%. Due to limitations with X windows and hidpi it is harder to get more granular.\n\n\n\nIntel Wireless 8265\n\n\n\nThe wireless uses the iwm module, as of right now it does not seem to automagically load right now. Adding iwm_load=“YES” will cause the module to load on boot and kldload iwm\n\n\n\nBattery\n\n\n\nI seem to be getting about 5 hours out of the battery, but everything reports out of the box as expected. I could get more by throttling the CPU down speed wise.\n\n\n\nOverall impression\n\n\n\nIt is a pretty decent experience. While not as polished as a Thinkpad there is a lot of potential with a bit of work and polishing. The laptop itself is not bad, the keyboard is responsive. The build quality is pretty solid. My only real complaint is the trackpad is stiff to click and sort of tiny. They seem to be a bit indifferent to non linux OSes running on the gear but that isnt anything new. I wont have any problems using it and is enough that when I work through this laptop, but I’m not sure at this stage if my next machine will be a System76 laptop, but they have impressed me enough to put them in the running when I go to look for my next portable machine but it hasn’t yet replaced the hole left in my heart by lenovo messing with the thinkpad.\n\n\n\n\n###Hardware accelerated AES/HMAC-SHA on octeons\n\nIn this commit, visa@ submitted code (disabled for now) to use built-in acceleration on octeon CPUs, much like AESNI for x86s.\n\nI decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.\n\nI didn't capture detailed perf stats from before the update, I had heard someone say that Edgerouter Lite boxes would only do some 6MBit/s over ipsec, so I set up a really simple ipsec.conf with ike esp from A to B leading to a policy of\n\nesp tunnel from A to B spi 0xdeadbeef auth hmac-sha2-256 enc aes\ngoing from one ERL to another (I collect octeons, so I have a bunch to test with) and let tcpbench run for a while on it. My numbers hovered around 7Mbit/s, which coincided with what I've heard, and also that most of the CPU gets used while doing it.\nThen I edited /sys/arch/octeon/conf/GENERIC, removed the # from octcrypto0 at mainbus0 and recompiled. Booted into the new kernel and got a octcrypto0 line in dmesg, and it was time to rock the ipsec tunnel again. The crypto algorithm and HMAC used by default on ipsec coincides nicely with the list of accelerated functions provided by the driver.\n\nBefore we get to tunnel traffic numbers, just one quick look at what systat pigs says while the ipsec is running at full steam:\n\n     PID USER        NAME                 CPU     20\\    40\\    60\\    80\\  100\\\n   58917 root        crypto             52.25 #################\n   42636 root        softnet            42.48 ##############\n                     (idle)             29.74 #########\n    1059 root        tcpbench           24.22 #######\n   67777 root        crynlk             19.58 ######\nSo this indicates that the load from doing ipsec and generating the traffic is somewhat nicely evened out over the two cores in the Edgerouter, and there's even some CPU left unused, which means I can actually ssh into it and have it usable. I have had it running for almost 2 days now, moving some 2.1TB over the tunnel.\nNow for the new and improved performance numbers:\n\n   204452123        4740752       37.402  100.00% \nConn:   1 Mbps:       37.402 Peak Mbps:       58.870 Avg Mbps:       37.402\n   204453149        4692968       36.628  100.00% \nConn:   1 Mbps:       36.628 Peak Mbps:       58.870 Avg Mbps:       36.628\n   204454167        5405552       42.480  100.00% \nConn:   1 Mbps:       42.480 Peak Mbps:       58.870 Avg Mbps:       42.480\n   204455188        5202496       40.804  100.00% \nConn:   1 Mbps:       40.804 Peak Mbps:       58.870 Avg Mbps:       40.804\n   204456194        5062208       40.256  100.00% \nConn:   1 Mbps:       40.256 Peak Mbps:       58.870 Avg Mbps:       40.256\n\nThe tcpbench numbers fluctuate up and down a bit, but the output is nice enough to actually keep tabs on the peak values. Peaking to 58.8MBit/s! Of course, as you can see, the average is lower but nice anyhow.\n\nA manyfold increase in performance, which is good enough in itself, but also moves the throughput from a speed that would make a poor but cheap gateway to something actually useful and decent for many home network speeds. Biggest problem after this gets enabled will be that my options to buy cheap used ERLs diminish.\n\n\n\n\n##Beastie Bits\n\n\nUsing FreeBSD Text Dumps\nllvm’s lld now the default linker for amd64 on FreeBSD\nAuthor Discoverability\nPledge and Unveil in OpenBSD {pdf}\nEuroBSDCon 2018 CFP Closes June 17, hurry up and get your submissions in\nJust want to attend, but need help getting to the conference? Applications for the Paul Schenkeveld travel grant accepted until June 15th\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nCasey - ZFS on Digital Ocean\nJürgen - A Question\nKevin - Failover best practice\nDennis - SQL\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.</p>\n\n<p>##Headlines##<br>\n###<a href=\"https://www.trueos.org/blog/trueosdownstream/\">TrueOS to Focus on Core Operating System</a></p>\n\n<blockquote>\n<p>The TrueOS Project has some big plans in the works, and we want to take a minute and share them with you. Many have come to know TrueOS as the “graphical FreeBSD” that makes things easy for newcomers to the BSDs. Today we’re announcing that TrueOS is shifting our focus a bit to become a cutting-edge operating system that keeps all of the stability that you know and love from ZFS (OpenZFS) and FreeBSD, and adds additional features to create a fresh, innovative operating system. Our goal is to create a core-centric operating system that is modular, functional, and perfect for do-it-yourselfers and advanced users alike.</p>\n</blockquote>\n\n<blockquote>\n<p>TrueOS will become a downstream fork that will build on FreeBSD by integrating new software technologies like OpenRC and LibreSSL. Work has already begun which allows TrueOS to be used as a base platform for other projects, including JSON-based manifests, integrated Poudriere / pkg tools and much more. We’re planning on a six month release cycle to keep development moving and fresh, allowing us to bring you hot new features to ZFS, bhyve and related tools in a timely manner. This makes TrueOS the perfect fit to serve as the basis for building other distributions.</p>\n</blockquote>\n\n<blockquote>\n<p>Some of you are probably asking yourselves “But what if I want to have a graphical desktop?” Don’t worry! We’re making sure that everyone who knows and loves the legacy desktop version of TrueOS will be able to continue using a FreeBSD-based, graphical operating system in the future. For instance, if you want to add KDE, just use sudo pkg install kde and voila! You have your new shiny desktop. Easy right? This allows us to get back to our roots of being a desktop agnostic operating system. If you want to add a new desktop environment, you get to pick the one that best suits your use.</p>\n</blockquote>\n\n<blockquote>\n<p>We know that some of you will still be looking for an out-of-the-box solution similar to legacy PC-BSD and TrueOS. We’re happy to announce that Project Trident will take over graphical FreeBSD development going forward. Not much is going to change in that regard other than a new name! You’ll still have Lumina Desktop as a lightweight and feature-rich desktop environment and tons of utilities from the legacy TrueOS toolchain like sysadm and AppCafe. There will be migration paths available for those that would like to move to other FreeBSD-based distributions like Project Trident or GhostBSD.</p>\n</blockquote>\n\n<blockquote>\n<p>We look forward to this new chapter for TrueOS and hope you will give the new edition a spin! Tell us what you think about the new changes by leaving us a comment. Don’t forget you can ask us questions on our Twitter and be a part of our community by joining the new TrueOS Forums when they go live in about a week. Thanks for being a loyal fan of TrueOS.</p>\n</blockquote>\n\n<p>###<a href=\"http://project-trident.org/faq\">Project Trident FAQ</a></p>\n\n<ul>\n<li>Q: Why did you pick the name “Project Trident”?</li>\n</ul>\n\n<blockquote>\n<p>A: We were looking for a name that was unique, yet would still relate to the BSD community. Since Beastie (the FreeBSD mascot) is always pictured with a trident, it felt like that would be a great name.</p>\n</blockquote>\n\n<ul>\n<li>Q: Where can users go for technical support?</li>\n</ul>\n\n<blockquote>\n<p>A: At the moment, Project Trident will continue sharing the TrueOS community forums and Telegram channels. We are currently evaluating dedicated options for support channels in the future.</p>\n</blockquote>\n\n<ul>\n<li>Q: Can I help contribute to the project?</li>\n</ul>\n\n<blockquote>\n<p>A: We are always looking for developers who want to join the project. If you’re not a developer you can still help, as a community project we will be more reliant on contributions from the community in the form of how-to guides and other user-centric documentation and support systems.</p>\n</blockquote>\n\n<ul>\n<li>Q: How is the project supported financially?</li>\n</ul>\n\n<blockquote>\n<p>A: Project Trident is sponsored by the community, from both individuals and corporations. iXsystems has stepped up as the first enterprise-level sponsor of the project, and has been instrumental in getting Project Trident up and running. Please visit the Sponsors page to see all the current sponsors.</p>\n</blockquote>\n\n<ul>\n<li>Q: How can I help support the project financially?</li>\n</ul>\n\n<blockquote>\n<p>A: Several methods exist, from one time or recurring donations via Paypal to limited time swag t-shirt campaigns during the year. We are also looking into more alternative methods of support, so please visit the Sponsors page to see all the current methods of sponsorship.</p>\n</blockquote>\n\n<ul>\n<li>Q: Will there be any transparency of the financial donations and expenditures?</li>\n</ul>\n\n<blockquote>\n<p>A: Yes, we will be totally open with how much money comes into the project and what it is spent on. Due to concerns of privacy, we will not identify individuals and their donation amounts unless they specifically request to be identified. We will release a monthly overview in/out ledger, so that community members can see where their money is going.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>Relationship with TrueOS</p>\n</li>\n<li>\n<p>Project Trident does have very close ties to the TrueOS project, since most of the original Project Trident developers were once part of the TrueOS project before it became a distribution platform. For users of the TrueOS desktop, we have some additional questions and answers below.</p>\n</li>\n<li>\n<p>Q: Do we need to be at a certain TrueOS install level/release to upgrade?</p>\n</li>\n</ul>\n\n<blockquote>\n<p>A: As long as you have a TrueOS system which has been updated to at least the 18.03 release you should be able to just perform a system update to be automatically upgraded to Project Trident.</p>\n</blockquote>\n\n<ul>\n<li>Q: Which members moved from TrueOS to Project Trident?</li>\n</ul>\n\n<blockquote>\n<p>A: Project Trident is being led by prior members of the TrueOS desktop team. Ken and JT (development), Tim (documentation) and Rod (Community/Support). Since Project Trident is a community-first project, we look forward to working with new members of the team.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###<a href=\"https://www.bsdcan.org/2018\">BSDCan</a></p>\n\n<ul>\n<li>BSDCan finished Saturday last week</li>\n<li>It started with the GoatBoF on Tuesday at the Royal Oak Pub, where people had a chance to meet and greet. Benedict could not attend due to an all-day FreeBSD Foundation meeting and and even FreeBSD Journal Editorial Board meeting.</li>\n<li>The FreeBSD devsummit was held the next two days in parallel to the tutorials. Gordon Tetlow, who organized the devsummit, opened the devsummit. Deb Goodkin from the FreeBSD Foundation gave the first talk with a Foundation update, highlighting current and future efforts. Li-Wen Hsu is now employed by the Foundation to assist in QA work (Jenkins, CI/CD) and Gordon Tetlow has a part-time contract to help secteam as their secretary.</li>\n<li>Next, the FreeBSD core team (among them Allan and Benedict) gave a talk about what has happened this last term. With a core election currently running, some of these items will carry over to the next core team, but there were also some finished ones like the FCP process and FreeBSD members initiative. People in the audience asked questions on various topics of interest.</li>\n<li>After the coffee break, the release engineering team gave a talk about their efforts in terms of making releases happen in time and good quality.</li>\n<li>Benedict had to give his Ansible tutorial in the afternoon, which had roughly 15 people attending. Most of them beginners, we could get some good discussions going and I also learned a few new tricks. The overall feedback was positive and one even asked what I’m going to teach next year.</li>\n<li>The second day of the FreeBSD devsummit began with Gordon Tetlow giving an insight into the FreeBSD Security team (aka secteam). He gave a overview of secteam members and responsibilities, explaining the process based on a long past advisory. Developers were encouraged to help out secteam. NDAs and proper disclosure of vulnerabilities were also discussed, and the audience had some feedback and questions.</li>\n<li>When the coffee break was over, the FreeBSD 12.0 planning session happened. A <a href=\"https://wiki.freebsd.org/DevSummit/201806/HaveNeedWant12\">Google doc</a> served as a collaborative way of gathering features and things left to do. People signed up for it or were volunteered. Some features won’t make it into 12.0 as they are not 100% ready for prime time and need a few more rounds of testing and bugfixing. Still, 12.0 will have some compelling features.</li>\n<li><a href=\"https://theta360.com/s/xuR4ogsjGmu584JJju0vUaTA\">A 360° group picture</a> was taken after lunch, and then people split up into the working groups for the afternoon or started hacking in the UofO Henderson residence.</li>\n<li>Benedict and Allan both attended the OpenZFS working group, lead by Matt Ahrens. He presented the completed and outstanding work in FreeBSD, without spoiling too much of the ZFS presentations of various people that happened later at the conference.</li>\n<li>Benedict joined the boot code session a bit late (hallway track is the reason) when most things seem to have already been discussed.</li>\n<li><a href=\"https://www.talegraph.com/tales/WmObSRejzT\">BSDCan 2018 — Ottawa (In Pictures)</a></li>\n<li><a href=\"https://photos.google.com/share/AF1QipPv_eOz9z-e8R23DkSEcMLF9ivl8est0H4k0lkAoIdY0Jgsn4eyKT54fPyy4EukCw?key=RmJoNS1uOHU2djRDdzZxNGM4ZEY1dFVKamhCNThR\">iXsystems Photos from BSDCan 2018</a></li>\n</ul>\n\n<p><hr></p>\n\n<p>##News Roundup<br>\n###<a href=\"https://hardenedbsd.org/article/shawn-webb/2018-06-09/june-hardenedbsd-foundation-update\">June HardenedBSD Foundation Update</a></p>\n\n<blockquote>\n<p>We at HardenedBSD are working towards starting up a 501©(3) not-for-profit organization in the USA. Setting up this organization will allow future donations to be tax deductible. We’ve made progress and would like to share with you the current state of affairs.</p>\n</blockquote>\n\n<blockquote>\n<p>We have identified, sent invitations out, and received acceptance letters from six people who will serve on the HardenedBSD Foundation Board of Directors. You can find their bios below. In the latter half of June 2018 or the beginning half of July 2018, we will meet for the first time as a board and formally begin the process of creating the documentation needed to submit to the local, state, and federal tax services.</p>\n</blockquote>\n\n<blockquote>\n<p>Here’s a brief introduction to those who will serve on the board:</p>\n</blockquote>\n\n<ul>\n<li>\n<p>W. Dean Freeman (Advisor): Dean has ten years of professional experience with deploying and security Unix and networking systems, including assessing systems security for government certification and assessing the efficacy of security products. He was introduced to Unix via FreeBSD 2.2.8 on an ISP shell account as a teenager. Formerly, he was the Snort port maintainer for FreeBSD while working in the Sourcefire VRT, and has contributed entropy-related patches to the FreeBSD and HardenedBSD projects – a topic on which he presented at vBSDCon 2017.</p>\n</li>\n<li>\n<p>Ben La Monica (Advisor): Ben is a Senior Technology Manager of Software Engineering at Morningstar, Inc and has been developing software for over 15 years in a variety of languages. He advocates open source software and enjoys tinkering with electronics and home automation.</p>\n</li>\n<li>\n<p>George Saylor (Advisor): George is a Technical Directory at G2, Inc. Mr. Saylor has over 28 years of information systems and security experience in a broad range of disciplines. His core focus areas are automation and standards in the event correlation space as well as penetration and exploitation of computer systems. Mr Saylor was also a co-founder of the OpenSCAP project.</p>\n</li>\n<li>\n<p>Virginia Suydan (Accountant and general administrator): Accountant and general administrator for the HardenedBSD Foundation. She has worked with Shawn Webb for tax and accounting purposes for over six years.</p>\n</li>\n<li>\n<p>Shawn Webb (Director): Co-founder of HardenedBSD and all-around infosec wonk. He has worked and played in the infosec industry, doing both offensive and defensive research, for around fifteen years. He loves open source technologies and likes to frustrate the bad guys.</p>\n</li>\n<li>\n<p>Ben Welch (Advisor): Ben is currently a Security Engineer at G2, Inc. He graduated from Pennsylvania College of Technology with a Bachelors in Information Assurance and Security. Ben likes long walks, beaches, candlelight dinners, and attending various conferences like BSides and ShmooCon.</p>\n</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://medium.com/@cmacrae/your-own-vpn-with-openiked-openbsd-13d7abd3d1d4\">Your own VPN with OpenIKED &amp; OpenBSD</a></p>\n\n<blockquote>\n<p>Remote connectivity to your home network is something I think a lot of people find desirable. Over the years, I’ve just established an SSH tunnel and use it as a SOCKS proxy, sending my traffic through that. It’s a nice solution for a “poor man’s VPN”, but it can be a bit clunky, and it’s not great having to expose SSH to the world, even if you make sure to lock everything down </p>\n</blockquote>\n\n<blockquote>\n<p>I set out the other day to finally do it properly. I’d come across this great post by Gordon Turner: <a href=\"https://blog.gordonturner.com/2018/02/25/openbsd-6-2-vpn-endpoint-for-ios-and-macos/\">OpenBSD 6.2 VPN Endpoint for iOS and macOS</a></p>\n</blockquote>\n\n<blockquote>\n<p>Whilst it was exactly what I was looking for, it outlined how to set up an L2TP VPN. Really, I wanted IKEv2 for performance and security reasons (I won’t elaborate on this here, if you’re curious about the differences, there’s a lot of content out on the web explaining this).</p>\n</blockquote>\n\n<blockquote>\n<p>The client systems I’d be using have native support for IKEv2 (iOS, macOS, other BSD systems). But, I couldn’t find any tutorials in the same vein.</p>\n</blockquote>\n\n<blockquote>\n<p>So, let’s get stuck in!</p>\n</blockquote>\n\n<ul>\n<li>A quick note ✍️</li>\n</ul>\n\n<blockquote>\n<p>This guide will walk through the set up of an IKEv2 VPN using OpenIKED on OpenBSD. It will detail a “road warrior” configuration, and use a PSK (pre-shared-key) for authentication. I’m sure it can be easily adapted to work on any other platforms that OpenIKED is available on, but keep in mind my steps are specifically for OpenBSD.</p>\n</blockquote>\n\n<ul>\n<li>Server Configuration</li>\n</ul>\n\n<blockquote>\n<p>As with all my home infrastructure, I crafted this set-up declaratively. So, I had the deployment of the VM setup in Terraform (deployed on my private Triton cluster), and wrote the configuration in Ansible, then tied them together using radekg/terraform-provisioner-ansible.</p>\n</blockquote>\n\n<blockquote>\n<p>One of the reasons I love Ansible is that its syntax is very simplistic, yet expressive. As such, I feel it fits very well into explaining these steps with snippets of the playbook I wrote.  I’ll link the full playbook a bit further down for those interested.</p>\n</blockquote>\n\n<ul>\n<li>See the full article for the information on:</li>\n<li>sysctl parameters</li>\n<li>The naughty list (optional)</li>\n<li>Configure the VPN network interface</li>\n<li>Configure the firewall</li>\n<li>Configure the iked service</li>\n<li>Gateway configuration</li>\n<li>Client configuration</li>\n<li>Troubleshooting</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>DigitalOcean</strong></p>\n\n<p>###<a href=\"https://corrupted.io/2018/05/15/system76-free-bsd.html\">FreeBSD on a System76 Galago Pro</a></p>\n\n<blockquote>\n<p>Hey all, It’s been a while since I last posted but I thought I would hammer something out here. My most recent purchase was a System76 Galago Pro. I thought, afer playing with POP! OS a bit, is there any reason I couldn’t get BSD on this thing. Turns out the answer is no, no there isnt and it works pretty decently.</p>\n</blockquote>\n\n<blockquote>\n<p>To get some accounting stuff out of the way I tested this all on FreeBSD Head and 11.1, and all of it is valid as of May 10, 2018. Head is a fast moving target so some of this is only bound to improve.</p>\n</blockquote>\n\n<ul>\n<li>\n<p>The hardware</p>\n</li>\n<li>\n<p>Intel Core i5 Gen 8</p>\n</li>\n<li>\n<p>UHD Graphics 620</p>\n</li>\n<li>\n<p>16 GB DDR4 Ram</p>\n</li>\n<li>\n<p>RTL8411B PCI Express Card Reader</p>\n</li>\n<li>\n<p>RTL8111 Gigabit ethernet controller</p>\n</li>\n<li>\n<p>Intel HD Audio</p>\n</li>\n<li>\n<p>Samsung SSD 960 PRO 512GB NVMe</p>\n</li>\n<li>\n<p>The caveats</p>\n</li>\n</ul>\n\n<blockquote>\n<p>There are a few things that I cant seem to make work straight out of the box, and that is the SD Card reader, the backlight, and the audio is a bit finicky. Also the trackpad doesn’t respond to two finger scrolling. The wiki is mostly up to date, there are a few edits that need to be made still but there is a bug where I cant register an account yet so I haven’t made all the changes.</p>\n</blockquote>\n\n<ul>\n<li>Processor</li>\n</ul>\n\n<blockquote>\n<p>It works like any other Intel processor. Pstates and throttling work.</p>\n</blockquote>\n\n<ul>\n<li>Graphics</li>\n</ul>\n\n<blockquote>\n<p>The boot menu sets itself to what looks like 1024x768, but works as you expect in a tiny window. The text console does the full 3200x1800 resolution, but the text is ultra tiny. There isnt a font for the console that covers hidpi screens yet. As for X Windows it requres the drm-kmod-next package. Once installed follow the directions from the package and it works with almost no fuss. I have it running on X with full intel acceleration, but it is running at it’s full 3200x1800 resolution, to scale that down just do xrandr --output eDP-1 --scale 0.5x0.5 it will blow it up to roughly 200%. Due to limitations with X windows and hidpi it is harder to get more granular.</p>\n</blockquote>\n\n<ul>\n<li>Intel Wireless 8265</li>\n</ul>\n\n<blockquote>\n<p>The wireless uses the iwm module, as of right now it does not seem to automagically load right now. Adding iwm_load=“YES” will cause the module to load on boot and kldload iwm</p>\n</blockquote>\n\n<ul>\n<li>Battery</li>\n</ul>\n\n<blockquote>\n<p>I seem to be getting about 5 hours out of the battery, but everything reports out of the box as expected. I could get more by throttling the CPU down speed wise.</p>\n</blockquote>\n\n<ul>\n<li>Overall impression</li>\n</ul>\n\n<blockquote>\n<p>It is a pretty decent experience. While not as polished as a Thinkpad there is a lot of potential with a bit of work and polishing. The laptop itself is not bad, the keyboard is responsive. The build quality is pretty solid. My only real complaint is the trackpad is stiff to click and sort of tiny. They seem to be a bit indifferent to non linux OSes running on the gear but that isnt anything new. I wont have any problems using it and is enough that when I work through this laptop, but I’m not sure at this stage if my next machine will be a System76 laptop, but they have impressed me enough to put them in the running when I go to look for my next portable machine but it hasn’t yet replaced the hole left in my heart by lenovo messing with the thinkpad.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://undeadly.org/cgi?action=article;sid=20180418073437\">Hardware accelerated AES/HMAC-SHA on octeons</a></p>\n\n<pre><code>In this commit, visa@ submitted code (disabled for now) to use built-in acceleration on octeon CPUs, much like AESNI for x86s.\n\nI decided to test tcpbench(1) and IPsec, before and after updating and enabling the octcrypto(4) driver.\n\nI didn't capture detailed perf stats from before the update, I had heard someone say that Edgerouter Lite boxes would only do some 6MBit/s over ipsec, so I set up a really simple ipsec.conf with ike esp from A to B leading to a policy of\n\nesp tunnel from A to B spi 0xdeadbeef auth hmac-sha2-256 enc aes\ngoing from one ERL to another (I collect octeons, so I have a bunch to test with) and let tcpbench run for a while on it. My numbers hovered around 7Mbit/s, which coincided with what I've heard, and also that most of the CPU gets used while doing it.\nThen I edited /sys/arch/octeon/conf/GENERIC, removed the # from octcrypto0 at mainbus0 and recompiled. Booted into the new kernel and got a octcrypto0 line in dmesg, and it was time to rock the ipsec tunnel again. The crypto algorithm and HMAC used by default on ipsec coincides nicely with the list of accelerated functions provided by the driver.\n\nBefore we get to tunnel traffic numbers, just one quick look at what systat pigs says while the ipsec is running at full steam:\n\n     PID USER        NAME                 CPU     20\\    40\\    60\\    80\\  100\\\n   58917 root        crypto             52.25 #################\n   42636 root        softnet            42.48 ##############\n                     (idle)             29.74 #########\n    1059 root        tcpbench           24.22 #######\n   67777 root        crynlk             19.58 ######\nSo this indicates that the load from doing ipsec and generating the traffic is somewhat nicely evened out over the two cores in the Edgerouter, and there's even some CPU left unused, which means I can actually ssh into it and have it usable. I have had it running for almost 2 days now, moving some 2.1TB over the tunnel.\nNow for the new and improved performance numbers:\n\n   204452123        4740752       37.402  100.00% \nConn:   1 Mbps:       37.402 Peak Mbps:       58.870 Avg Mbps:       37.402\n   204453149        4692968       36.628  100.00% \nConn:   1 Mbps:       36.628 Peak Mbps:       58.870 Avg Mbps:       36.628\n   204454167        5405552       42.480  100.00% \nConn:   1 Mbps:       42.480 Peak Mbps:       58.870 Avg Mbps:       42.480\n   204455188        5202496       40.804  100.00% \nConn:   1 Mbps:       40.804 Peak Mbps:       58.870 Avg Mbps:       40.804\n   204456194        5062208       40.256  100.00% \nConn:   1 Mbps:       40.256 Peak Mbps:       58.870 Avg Mbps:       40.256\n\nThe tcpbench numbers fluctuate up and down a bit, but the output is nice enough to actually keep tabs on the peak values. Peaking to 58.8MBit/s! Of course, as you can see, the average is lower but nice anyhow.\n\nA manyfold increase in performance, which is good enough in itself, but also moves the throughput from a speed that would make a poor but cheap gateway to something actually useful and decent for many home network speeds. Biggest problem after this gets enabled will be that my options to buy cheap used ERLs diminish.\n</code></pre>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"http://www.etinc.com/122/Using-FreeBSD-Text-Dumps\">Using FreeBSD Text Dumps</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=334391\">llvm’s lld now the default linker for amd64 on FreeBSD</a></li>\n<li><a href=\"https://blather.michaelwlucas.com/archives/3194\">Author Discoverability</a></li>\n<li><a href=\"https://www.openbsd.org/papers/BeckPledgeUnveilBSDCan2018.pdf\">Pledge and Unveil in OpenBSD {pdf}</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/call-for-papers/\">EuroBSDCon 2018 CFP Closes June 17, hurry up and get your submissions in</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/paul-schenkeveld-travel-grant/\">Just want to attend, but need help getting to the conference? Applications for the Paul Schenkeveld travel grant accepted until June 15th</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>Casey - <a href=\"http://dpaste.com/2H42V7W#wrap\">ZFS on Digital Ocean</a></li>\n<li>Jürgen - <a href=\"http://dpaste.com/3N7ZN8C#wrap\">A Question</a></li>\n<li>Kevin - <a href=\"http://dpaste.com/231CY5Z#wrap\">Failover best practice</a></li>\n<li>Dennis - <a href=\"http://dpaste.com/1QPNB25#wrap\">SQL</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"TrueOS becoming a downstream fork with Trident, our BSDCan 2018 recap, HardenedBSD Foundation founding efforts, VPN with OpenIKED on OpenBSD, FreeBSD on a System76 Galago Pro, and hardware accelerated crypto on Octeons.","date_published":"2018-06-14T07:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/4a856940-c133-4d38-98e6-88d80a82c29a.mp3","mime_type":"audio/mp3","size_in_bytes":60891452,"duration_in_seconds":6070}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2072","title":"Episode 249: Router On A Stick | BSD Now 249","url":"https://www.bsdnow.tv/249","content_text":"OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.\n\n\n##Headlines\n###ZFS and DTrace update lands in NetBSD\n\n\nmerge a new version of the CDDL dtrace and ZFS code. This changes the upstream vendor from OpenSolaris to FreeBSD, and this version is based on FreeBSD svn r315983.\n\n\n\nr315983 is from March 2017 (14 months ago), so there is still more work to do\n\n\n\nin addition to the 10 years of improvements from upstream, this version also has these NetBSD-specific enhancements:\n\ndtrace FBT probes can now be placed in kernel modules.\nZFS now supports mmap().\n\n\n\n\nThis brings NetBSD 10 years forward, and they should be able to catch the rest of the way up fairly quickly\n\n\n\n\n###NetBSD network stack security audit\n\n\nMaxime Villard has been working on an audit of the NetBSD network stack, a project sponsored by The NetBSD Foundation, which has served all users of BSD-derived operating systems.\n\n\n\nOver the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.\n\n\n\nChanges were made to strengthen the networking subsystems and improve code quality: reinforce the mbuf API, add many KASSERTs to enforce assumptions, simplify packet handling, and verify compliance with RFCs. This was done in several layers of the NetBSD kernel, from device drivers to L4 handlers.\nIn the course of investigating several bugs discovered in NetBSD, I happened to look at the network stacks of other operating systems, to see whether they had already fixed the issues, and if so how. Needless to say, I found bugs there too.\n\n\n\nA lot of code is shared between the BSDs, so it is especially helpful when one finds a bug, to check the other BSDs and share the fix.\n\n\n\nThe IPv6 Buffer Overflow: The overflow allowed an attacker to write one byte of packet-controlled data into ‘packet_storage+off’, where ‘off’ could be approximately controlled too. This allowed at least a pretty bad remote DoS/Crash\nThe IPsec Infinite Loop: When receiving an IPv6-AH packet, the IPsec entry point was not correctly computing the length of the IPv6 suboptions, and this, before authentication. As a result, a specially-crafted IPv6 packet could trigger an infinite loop in the kernel (making it unresponsive). In addition this flaw allowed a limited buffer overflow - where the data being written was however not controllable by the attacker.\nThe IPPROTO Typo: While looking at the IPv6 Multicast code, I stumbled across a pretty simple yet pretty bad mistake: at one point the Pim6 entry point would return IPPROTO_NONE instead of IPPROTO_DONE. Returning IPPROTO_NONE was entirely wrong: it caused the kernel to keep iterating on the IPv6 packet chain, while the packet storage was already freed.\nThe PF Signedness Bug: A bug was found in NetBSD’s implementation of the PF firewall, that did not affect the other BSDs. In the initial PF code a particular macro was used as an alias to a number. This macro formed a signed integer. NetBSD replaced the macro with a sizeof(), which returns an unsigned result.\nThe NPF Integer Overflow: An integer overflow could be triggered in NPF, when parsing an IPv6 packet with large options. This could cause NPF to look for the L4 payload at the wrong offset within the packet, and it allowed an attacker to bypass any L4 filtering rule on IPv6.\nThe IPsec Fragment Attack: I noticed some time ago that when reassembling fragments (in either IPv4 or IPv6), the kernel was not removing the M_PKTHDR flag on the secondary mbufs in mbuf chains. This flag is supposed to indicate that a given mbuf is the head of the chain it forms; having the flag on secondary mbufs was suspicious.\nWhat Now: Not all protocols and layers of the network stack were verified, because of time constraints, and also because of unexpected events: the recent x86 CPU bugs, which I was the only one able to fix promptly. A todo list will be left when the project end date is reached, for someone else to pick up. Me perhaps, later this year? We’ll see.\nThis security audit of NetBSD’s network stack is sponsored by The NetBSD Foundation, and serves all users of BSD-derived operating systems. The NetBSD Foundation is a non-profit organization, and welcomes any donations that help continue funding projects of this kind.\n\n\n\n\nDigitalOcean\n\n###MySQL on ZFS Performance\n\n\nI used sysbench to create a table of 10M rows and then, using export/import tablespace, I copied it 329 times. I ended up with 330 tables for a total size of about 850GB. The dataset generated by sysbench is not very compressible, so I used lz4 compression in ZFS. For the other ZFS settings, I used what can be found in my earlier ZFS posts but with the ARC size limited to 1GB. I then used that plain configuration for the first benchmarks. Here are the results with the sysbench point-select benchmark, a uniform distribution and eight threads. The InnoDB buffer pool was set to 2.5GB.\nIn both cases, the load is IO bound. The disk is doing exactly the allowed 3000 IOPS. The above graph appears to be a clear demonstration that XFS is much faster than ZFS, right? But is that really the case? The way the dataset has been created is extremely favorable to XFS since there is absolutely no file fragmentation. Once you have all the files opened, a read IOP is just a single fseek call to an offset and ZFS doesn’t need to access any intermediate inode. The above result is about as fair as saying MyISAM is faster than InnoDB based only on table scan performance results of unfragmented tables and default configuration. ZFS is much less affected by the file level fragmentation, especially for point access type.\n\n\n\nZFS stores the files in B-trees in a very similar fashion as InnoDB stores data. To access a piece of data in a B-tree, you need to access the top level page (often called root node) and then one block per level down to a leaf-node containing the data. With no cache, to read something from a three levels B-tree thus requires 3 IOPS.\n\n\n\nThe extra IOPS performed by ZFS are needed to access those internal blocks in the B-trees of the files. These internal blocks are labeled as metadata. Essentially, in the above benchmark, the ARC is too small to contain all the internal blocks of the table files’ B-trees. If we continue the comparison with InnoDB, it would be like running with a buffer pool too small to contain the non-leaf pages. The test dataset I used has about 600MB of non-leaf pages, about 0.1% of the total size, which was well cached by the 3GB buffer pool. So only one InnoDB page, a leaf page, needed to be read per point-select statement.\n\n\n\nTo correctly set the ARC size to cache the metadata, you have two choices. First, you can guess values for the ARC size and experiment. Second, you can try to evaluate it by looking at the ZFS internal data. Let’s review these two approaches.\n\n\n\nYou’ll read/hear often the ratio 1GB of ARC for 1TB of data, which is about the same 0.1% ratio as for InnoDB. I wrote about that ratio a few times, having nothing better to propose. Actually, I found it depends a lot on the recordsize used. The 0.1% ratio implies a ZFS recordsize of 128KB. A ZFS filesystem with a recordsize of 128KB will use much less metadata than another one using a recordsize of 16KB because it has 8x fewer leaf pages. Fewer leaf pages require less B-tree internal nodes, hence less metadata. A filesystem with a recordsize of 128KB is excellent for sequential access as it maximizes compression and reduces the IOPS but it is poor for small random access operations like the ones MySQL/InnoDB does.\n\n\n\nIn order to improve ZFS performance, I had 3 options:\nIncrease the ARC size to 7GB\nUse a larger Innodb page size like 64KB\nAdd a L2ARC\n\n\n\nI was reluctant to grow the ARC to 7GB, which was nearly half the overall system memory. At best, the ZFS performance would only match XFS. A larger InnoDB page size would increase the CPU load for decompression on an instance with only two vCPUs; not great either. The last option, the L2ARC, was the most promising.\n\n\n\nZFS is much more complex than XFS and EXT4 but, that also means it has more tunables/options. I used a simplistic setup and an unfair benchmark which initially led to poor ZFS results. With the same benchmark, very favorable to XFS, I added a ZFS L2ARC and that completely reversed the situation, more than tripling the ZFS results, now 66% above XFS.\n\n\n\nConclusion\n\n\n\nWe have seen in this post why the general perception is that ZFS under-performs compared to XFS or EXT4. The presence of B-trees for the files has a big impact on the amount of metadata ZFS needs to handle, especially when the recordsize is small. The metadata consists mostly of the non-leaf pages (or internal nodes) of the B-trees. When properly cached, the performance of ZFS is excellent. ZFS allows you to optimize the use of EBS volumes, both in term of IOPS and size when the instance has fast ephemeral storage devices. Using the ephemeral device of an i3.large instance for the ZFS L2ARC, ZFS outperformed XFS by 66%.\n\n\n\n\n###OpenSMTPD new config\n\nTL;DR:\nOpenBSD #p2k18 hackathon took place at Epitech in Nantes.\nI was organizing the hackathon but managed to make progress on OpenSMTPD.\nAs mentioned at EuroBSDCon the one-line per rule config format was a design error.\nA new configuration grammar is almost ready and the underlying structures are simplified.\nRefactor removes ~750 lines of code and solves _many_ issues that were side-effects of the design error.\nNew features are going to be unlocked thanks to this.\n\n\n\nAnatomy of a design error\n\n\n\nOpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.\nThe initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.\nWhen I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.\nIt helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.\nThat being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.\nOne-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.\nTo get to the point: we should move to two-line rules :-)\n\n\nAnatomy of a design error\nOpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.\n\nThe initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.\n\nWhen I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.\n\nIt helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.\n\nThat being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.\n\nOne-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.\n\nTo get to the point: we should move to two-line rules :-)\n\n\nThe problem with one-line rules\n\n\n\nOpenSMTPD decides to accept or reject messages based on one-line rules such as:\n\n\naccept from any for domain poolp.org deliver to mbox\n\n\nWhich can essentially be split into three units:\n\n\n\nthe decision: accept/reject\nthe matching: from any for domain poolp.org\nthe (default) action: deliver to mbox\n\n\n\nTo ensure that we meet the requirements of the transactions, the matching must be performed during the SMTP transaction before we take a decision for the recipient.\nGiven that the rule is atomic, that it doesn’t have an identifier and that the action is part of it, the two only ways to make sure we can remember the action to take later on at delivery time is to either:\n\n\n\nsave the action in the envelope, which is what we do today\nevaluate the envelope again at delivery\nAnd this this where it gets tricky… both solutions are NOT ok.\n\n\n\nThe first solution, which we’ve been using for a decade, was to save the action within the envelope and kind of carve it in stone. This works fine… however it comes with the downsides that errors fixed in configuration files can’t be caught up by envelopes, that delivery action must be validated way ahead of time during the SMTP transaction which is much trickier, that the parsing of delivery methods takes place as the _smtpd user rather than the recipient user, and that envelope structures that are passed all over OpenSMTPD carry delivery-time informations, and more, and more, and more. The code becomes more complex in general, less safe in some particular places, and some areas are nightmarish to deal with because they have to deal with completely unrelated code that can’t be dealt with later in the code path.\n\n\n\nThe second solution can’t be done. An envelope may be the result of nested rules, for example an external client, hitting an alias, hitting a user with a .forward file resolving to a user. An envelope on disk may no longer match any rule or it may match a completely different rule If we could ensure that it matched the same rule, evaluating the ruleset may spawn new envelopes which would violate the transaction. Trying to imagine how we could work around this leads to more and more and more RFC violations, incoherent states, duplicate mails, etc…\n\n\n\nThere is simply no way to deal with this with atomic rules, the matching and the action must be two separate units that are evaluated at two different times, failure to do so will necessarily imply that you’re either using our first solution and all its downsides, or that you are currently in a world of pain trying to figure out why everything is burning around you. The minute the action is written to an on-disk envelope, you have failed.\n\n\n\nA proper ruleset must define a set of matching patterns resolving to an action identifier that is carved in stone, AND a set of named action set that is resolved dynamically at delivery time.\n\n\n\nFollow the link above to see the rest of the article\n\n\n\n\nBreak\n\n##News Roundup\n###Backing up a legacy Windows machine to a FreeNAS with rsync\n\n\nI have some old Windows servers (10 years and counting) and I have been using rsync to back them up to my FreeNAS box. It has been working great for me.\n\n\n\nFirst of all, I do have my Windows servers backup in virtualized format. However, those are only one-time snapshops that I run once in a while. These are classic ASP IIS web servers that I can easily put up on a new VM. However, many of these legacy servers generate gigabytes of data a day in their repositories. Running VM conversion daily is not ideal.\n\n\n\nMy solution was to use some sort of rsync solution just for the data repos. I’ve tried some applications that didn’t work too well with Samba shares and these old servers have slow I/O. Copying files to external sata or usb drive was not ideal. We’ve moved on from Windows to Linux and do not have any Windows file servers of capacity to provide network backups.  Hence, I decided to use Delta Copy with FreeNAS. So here is a little write up on how to set it up. I have 4 Windows 2000 servers backing up daily with this method.\n\n\n\nFirst, download Delta Copy and install it. It is open-source and pretty much free. It is basically a wrapper for cygwin’s rsync. When you install it, it will ask you to install the Server services which allows you to run it as a Rsync server on Windows. You don’t need to do this. Instead, you will be just using the Delta Copy Client application. But before we do that, we will need to configure our Rsync service for our Windows Clients on FreeNAS.\n\n\n\nIn FreeNAS, go under Services , Select Rsync &gt;  Rsync Modules &gt; Add Rsync Module.\nThen fill out the form; giving the module a name and set the path. In my example, I simply called it WIN and linked it to a user called backupuser.\nThis process is much easier than trying to configure the daemon rsyncd.conf file by hand.\nNow, on the Windows Client, start the DeltaCopy Client. You will create a new Profile.\nYou will need to enter the IP of the Rsync server (FreeNAS) and specify the module name which will be called “Virtual Directory Name.”  When you pull the select menu, the list of Rsync Modules you created earlier in FreeNAS will populate.\nYou can set authentication. On the server, you can restrict by IP and do other things to lock down your rsync.\nNext, you will add folders (and/or files) you want to synchronize.\nOnce the paths are set up, you can run a sync by right clicking the profile name.\nHere, I made a test sync to a home folder of a virtualized windows box. As you can see, I mounted the rsync volume on my mac to see the progress. The rsync worked beautifully. DeltaCopy did what it was told.\nOnce you get everything working. The next thing to do is set schedules. If you done tasks schedules in Windows before, it is pretty straightforward. DeltaCopy has a link in the application to directly create a new task for you. I set my backups to run nightly and it has been working great.\n\n\n\nThere you have it. Windows rsync to FreeNAS using DeltaCopy.\nThe nice thing about FreeNAS is you don’t have to modify /etc/rsyncd.conf files. Everything can be done in the web admin.\n\n\n\n\niXsystems\n\n###How to write ATF tests for NetBSD\n\n\nI have recently started contributing to the amazing NetBSD foundation. I was thinking of trying out a new OS for a long time. Switching to the NetBSD OS has been a fun change.\n\n\n\nMy first contribution to the NetBSD foundation was adding regression tests for the Address Sanitizer (ASan) in the Automated Testing Framework(ATF) which NetBSD has. I managed to complete it with the help of my really amazing mentor Kamil. This post is gonna be about the ATF framework that NetBSD has and how to you can add multiple tests with ease.\n\n\n\nIntro\n\n\n\nIn ATF tests we will basically be talking about test programs which are a suite of test cases for a specific application or program.\n\n\n\nThe ATF suite of Commands\n\n\n\nThere are a variety of commands that the atf suite offers. These include :\n\n\n\n\natf-check: The versatile command that is a vital part of the checking process. man page\n\n\natf-run: Command used to run a test program. man page\n\n\natf-fail: Report failure of a test case.\n\n\natf-report: used to pretty print the atf-run. man page\n\n\natf-set: To set atf test conditions.\n\n\nWe will be taking a better look at the syntax and usage later.\n\n\nLet’s start with the Basics\n\n\n\n\nThe ATF testing framework comes preinstalled with a default NetBSD installation. It is used to write tests for various applications and commands in NetBSD.  One can write the Test programs in either the C language or in shell script. In this post I will be dealing with the Bash part.\n\n\n\nFollow the link above to see the rest of the article\n\n\n\n\n###The Importance of ZFS Block Size\n\n\nWarning! WARNING! Don’t just do things because some random blog says so\n\n\n\nOne of the important tunables in ZFS is the recordsize (for normal datasets) and volblocksize (for zvols). These default to 128KB and 8KB respectively.\nAs I understand it, this is the unit of work in ZFS. If you modify one byte in a large file with the default 128KB record size, it causes the whole 128KB to be read in, one byte to be changed, and a new 128KB block to be written out.\nAs a result, the official recommendation is to use a block size which aligns with the underlying workload: so for example if you are using a database which reads and writes 16KB chunks then you should use a 16KB block size, and if you are running VMs containing an ext4 filesystem, which uses a 4KB block size, you should set a 4KB block size\nYou can see it has a 16GB total file size, of which 8.5G has been touched and consumes space - that is, it’s a “sparse” file. The used space is also visible by looking at the zfs filesystem which this file resides in\nThen I tried to copy the image file whilst maintaining its “sparseness”, that is, only touching the blocks of the zvol which needed to be touched. The original used only 8.42G, but the copy uses 14.6GB - almost the entire 16GB has been touched! What’s gone wrong?\nI finally realised that the difference between the zfs filesystem and the zvol is the block size. I recreated the zvol with a 128K block size\nThat’s better. The disk usage of the zvol is now exactly the same as for the sparse file in the filesystem dataset\n\n\n\nIt does impact the read speed too. 4K blocks took 5:52, and 128K blocks took 3:20\nPart of this is the amount of metadata that has to be read, see the MySQL benchmarks from earlier in the show\nAnd yes, using a larger block size will increase the compression efficiency, since the compressor has more redundant data to optimize.\nSome of the savings, and the speedup is because a lot less metadata had to be written\nYour zpool layout also plays a big role, if you use 4Kn disks, and RAID-Z2, using a volblocksize of 8k will actually result in a large amount of wasted space because of RAID-Z padding. Although, if you enable compression, your 8k records may compress to only 4k, and then all the numbers change again.\n\n\n\n\n###Using a Raspberry Pi 2 as a Router on a Stick Starring NetBSD\n\n\nSorry we didn’t answer you quickly enough\n\n\n\nA few weeks ago I set about upgrading my feeble networking skills by playing around with a Cisco 2970 switch. I set up a couple of VLANs and found the urge to set up a router to route between them. The 2970 isn’t a modern layer 3 switch so what am I to do?\n\n\n\nWhy not make use of the Raspberry Pi 2 that I’ve never used and put it to some good use as a ‘router on a stick’.\n\n\n\nI could install a Linux based OS as I am quite familiar with it but where’s the fun in that? In my home lab I use SmartOS which by the way is a shit hot hypervisor but as far as I know there aren’t any Illumos distributions for the Raspberry Pi. On the desktop I use Solus OS which is by far the slickest Linux based OS that I’ve had the pleasure to use but Solus’ focus is purely desktop. It’s looking like BSD then!\n\n\n\nI believe FreeBSD is renowned for it’s top notch networking stack and so I wrote to the BSDNow show on Jupiter Broadcasting for some help but it seems that the FreeBSD chaps from the show are off on a jolly to some BSD conference or another(love the show by the way).\n\n\n\nIt looks like me and the luvverly NetBSD are on a date this Saturday. I’ve always had a secret love for NetBSD. She’s a beautiful, charming and promiscuous lover(looking at the supported architectures) and I just can’t stop going back to her despite her misgivings(ahem, zfs). Just my type of grrrl!\n\n\n\nLet’s crack on…\n\n\n\nFollow the link above to see the rest of the article\n\n\n\n\n##Beastie Bits\n\n\nBSD Jobs\nUniversity of Aberdeen’s Internet Transport Research Group is hiring\nVR demo on OpenBSD via OpenHMD with OSVR HDK2\npatch runs ed, and ed can run anything (mentions FreeBSD and OpenBSD)\nAlacritty (OpenGL-powered terminal emulator) now supports OpenBSD\nMAP_STACK Stack Register Checking Committed to -current\nEuroBSDCon CfP till June 17, 2018\n\n\n\n\nTarsnap\n\n##Feedback/Questions\n\n\nNeutronDaemon - Tutorial request\nKurt - Question about transferability/bi-directionality of ZFS snapshots and send/receive\nPeter - A Question and much love for BSD Now\nPeter - netgraph state\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.<br>\n<hr></p>\n\n<p>##Headlines<br>\n###<a href=\"https://mail-index.netbsd.org/source-changes/2018/05/28/msg095541.html\">ZFS and DTrace update lands in NetBSD</a></p>\n\n<blockquote>\n<p>merge a new version of the CDDL dtrace and ZFS code. This changes the upstream vendor from OpenSolaris to FreeBSD, and this version is based on FreeBSD svn r315983.</p>\n</blockquote>\n\n<ul>\n<li>r315983 is from March 2017 (14 months ago), so there is still more work to do</li>\n</ul>\n\n<blockquote>\n<p>in addition to the 10 years of improvements from upstream, this version also has these NetBSD-specific enhancements:</p>\n<ul>\n<li>dtrace FBT probes can now be placed in kernel modules.</li>\n<li>ZFS now supports mmap().</li>\n</ul>\n</blockquote>\n\n<ul>\n<li>This brings NetBSD 10 years forward, and they should be able to catch the rest of the way up fairly quickly</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://blog.netbsd.org/tnf/entry/network_security_audit\">NetBSD network stack security audit</a></p>\n\n<ul>\n<li>Maxime Villard has been working on an audit of the NetBSD network stack, a project sponsored by The NetBSD Foundation, which has served all users of BSD-derived operating systems.</li>\n</ul>\n\n<blockquote>\n<p>Over the last five months, hundreds of patches were committed to the source tree as a result of this work. Dozens of bugs were fixed, among which a good number of actual, remotely-triggerable vulnerabilities.</p>\n</blockquote>\n\n<blockquote>\n<p>Changes were made to strengthen the networking subsystems and improve code quality: reinforce the mbuf API, add many KASSERTs to enforce assumptions, simplify packet handling, and verify compliance with RFCs. This was done in several layers of the NetBSD kernel, from device drivers to L4 handlers.<br>\nIn the course of investigating several bugs discovered in NetBSD, I happened to look at the network stacks of other operating systems, to see whether they had already fixed the issues, and if so how. Needless to say, I found bugs there too.</p>\n</blockquote>\n\n<ul>\n<li>A lot of code is shared between the BSDs, so it is especially helpful when one finds a bug, to check the other BSDs and share the fix.</li>\n</ul>\n\n<blockquote>\n<p>The IPv6 Buffer Overflow: The overflow allowed an attacker to write one byte of packet-controlled data into ‘packet_storage+off’, where ‘off’ could be approximately controlled too. This allowed at least a pretty bad remote DoS/Crash<br>\nThe IPsec Infinite Loop: When receiving an IPv6-AH packet, the IPsec entry point was not correctly computing the length of the IPv6 suboptions, and this, before authentication. As a result, a specially-crafted IPv6 packet could trigger an infinite loop in the kernel (making it unresponsive). In addition this flaw allowed a limited buffer overflow - where the data being written was however not controllable by the attacker.<br>\nThe IPPROTO Typo: While looking at the IPv6 Multicast code, I stumbled across a pretty simple yet pretty bad mistake: at one point the Pim6 entry point would return IPPROTO_NONE instead of IPPROTO_DONE. Returning IPPROTO_NONE was entirely wrong: it caused the kernel to keep iterating on the IPv6 packet chain, while the packet storage was already freed.<br>\nThe PF Signedness Bug: A bug was found in NetBSD’s implementation of the PF firewall, that did not affect the other BSDs. In the initial PF code a particular macro was used as an alias to a number. This macro formed a signed integer. NetBSD replaced the macro with a sizeof(), which returns an unsigned result.<br>\nThe NPF Integer Overflow: An integer overflow could be triggered in NPF, when parsing an IPv6 packet with large options. This could cause NPF to look for the L4 payload at the wrong offset within the packet, and it allowed an attacker to bypass any L4 filtering rule on IPv6.<br>\nThe IPsec Fragment Attack: I noticed some time ago that when reassembling fragments (in either IPv4 or IPv6), the kernel was not removing the M_PKTHDR flag on the secondary mbufs in mbuf chains. This flag is supposed to indicate that a given mbuf is the head of the chain it forms; having the flag on secondary mbufs was suspicious.<br>\nWhat Now: Not all protocols and layers of the network stack were verified, because of time constraints, and also because of unexpected events: the recent x86 CPU bugs, which I was the only one able to fix promptly. A todo list will be left when the project end date is reached, for someone else to pick up. Me perhaps, later this year? We’ll see.<br>\nThis security audit of NetBSD’s network stack is sponsored by The NetBSD Foundation, and serves all users of BSD-derived operating systems. The NetBSD Foundation is a non-profit organization, and welcomes any donations that help continue funding projects of this kind.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>DigitalOcean</strong></p>\n\n<p>###<a href=\"https://www.percona.com/blog/2018/05/15/about-zfs-performance/\">MySQL on ZFS Performance</a></p>\n\n<blockquote>\n<p>I used sysbench to create a table of 10M rows and then, using export/import tablespace, I copied it 329 times. I ended up with 330 tables for a total size of about 850GB. The dataset generated by sysbench is not very compressible, so I used lz4 compression in ZFS. For the other ZFS settings, I used what can be found in my earlier ZFS posts but with the ARC size limited to 1GB. I then used that plain configuration for the first benchmarks. Here are the results with the sysbench point-select benchmark, a uniform distribution and eight threads. The InnoDB buffer pool was set to 2.5GB.<br>\nIn both cases, the load is IO bound. The disk is doing exactly the allowed 3000 IOPS. The above graph appears to be a clear demonstration that XFS is much faster than ZFS, right? But is that really the case? The way the dataset has been created is extremely favorable to XFS since there is absolutely no file fragmentation. Once you have all the files opened, a read IOP is just a single fseek call to an offset and ZFS doesn’t need to access any intermediate inode. The above result is about as fair as saying MyISAM is faster than InnoDB based only on table scan performance results of unfragmented tables and default configuration. ZFS is much less affected by the file level fragmentation, especially for point access type.</p>\n</blockquote>\n\n<blockquote>\n<p>ZFS stores the files in B-trees in a very similar fashion as InnoDB stores data. To access a piece of data in a B-tree, you need to access the top level page (often called root node) and then one block per level down to a leaf-node containing the data. With no cache, to read something from a three levels B-tree thus requires 3 IOPS.</p>\n</blockquote>\n\n<blockquote>\n<p>The extra IOPS performed by ZFS are needed to access those internal blocks in the B-trees of the files. These internal blocks are labeled as metadata. Essentially, in the above benchmark, the ARC is too small to contain all the internal blocks of the table files’ B-trees. If we continue the comparison with InnoDB, it would be like running with a buffer pool too small to contain the non-leaf pages. The test dataset I used has about 600MB of non-leaf pages, about 0.1% of the total size, which was well cached by the 3GB buffer pool. So only one InnoDB page, a leaf page, needed to be read per point-select statement.</p>\n</blockquote>\n\n<blockquote>\n<p>To correctly set the ARC size to cache the metadata, you have two choices. First, you can guess values for the ARC size and experiment. Second, you can try to evaluate it by looking at the ZFS internal data. Let’s review these two approaches.</p>\n</blockquote>\n\n<blockquote>\n<p>You’ll read/hear often the ratio 1GB of ARC for 1TB of data, which is about the same 0.1% ratio as for InnoDB. I wrote about that ratio a few times, having nothing better to propose. Actually, I found it depends a lot on the recordsize used. The 0.1% ratio implies a ZFS recordsize of 128KB. A ZFS filesystem with a recordsize of 128KB will use much less metadata than another one using a recordsize of 16KB because it has 8x fewer leaf pages. Fewer leaf pages require less B-tree internal nodes, hence less metadata. A filesystem with a recordsize of 128KB is excellent for sequential access as it maximizes compression and reduces the IOPS but it is poor for small random access operations like the ones MySQL/InnoDB does.</p>\n</blockquote>\n\n<ul>\n<li>In order to improve ZFS performance, I had 3 options:</li>\n<li>Increase the ARC size to 7GB</li>\n<li>Use a larger Innodb page size like 64KB</li>\n<li>Add a L2ARC</li>\n</ul>\n\n<blockquote>\n<p>I was reluctant to grow the ARC to 7GB, which was nearly half the overall system memory. At best, the ZFS performance would only match XFS. A larger InnoDB page size would increase the CPU load for decompression on an instance with only two vCPUs; not great either. The last option, the L2ARC, was the most promising.</p>\n</blockquote>\n\n<blockquote>\n<p>ZFS is much more complex than XFS and EXT4 but, that also means it has more tunables/options. I used a simplistic setup and an unfair benchmark which initially led to poor ZFS results. With the same benchmark, very favorable to XFS, I added a ZFS L2ARC and that completely reversed the situation, more than tripling the ZFS results, now 66% above XFS.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion</li>\n</ul>\n\n<blockquote>\n<p>We have seen in this post why the general perception is that ZFS under-performs compared to XFS or EXT4. The presence of B-trees for the files has a big impact on the amount of metadata ZFS needs to handle, especially when the recordsize is small. The metadata consists mostly of the non-leaf pages (or internal nodes) of the B-trees. When properly cached, the performance of ZFS is excellent. ZFS allows you to optimize the use of EBS volumes, both in term of IOPS and size when the instance has fast ephemeral storage devices. Using the ephemeral device of an i3.large instance for the ZFS L2ARC, ZFS outperformed XFS by 66%.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p>###<a href=\"https://poolp.org/posts/2018-04-30/opensmtpd-new-config/\">OpenSMTPD new config</a></p>\n\n<pre><code>TL;DR:\nOpenBSD #p2k18 hackathon took place at Epitech in Nantes.\nI was organizing the hackathon but managed to make progress on OpenSMTPD.\nAs mentioned at EuroBSDCon the one-line per rule config format was a design error.\nA new configuration grammar is almost ready and the underlying structures are simplified.\nRefactor removes ~750 lines of code and solves _many_ issues that were side-effects of the design error.\nNew features are going to be unlocked thanks to this.\n</code></pre>\n\n<ul>\n<li>Anatomy of a design error</li>\n</ul>\n\n<blockquote>\n<p>OpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.<br>\nThe initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.<br>\nWhen I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.<br>\nIt helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.<br>\nThat being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.<br>\nOne-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.<br>\nTo get to the point: we should move to two-line rules :-)</p>\n</blockquote>\n\n<p>Anatomy of a design error<br>\nOpenSMTPD started ten years ago out of dissatisfaction with other solutions, mainly because I considered them way too complex for me not to get things wrong from time to time.</p>\n\n<p>The initial configuration format was very different, I was inspired by pyr@’s hoststated, which eventually became relayd, and designed my configuration format with blocks enclosed by brackets.</p>\n\n<p>When I first showed OpenSMTPD to pyr@, he convinced me that PF-like one-line rules would be awesome, and it was awesome indeed.</p>\n\n<p>It helped us maintain our goal of simple configuration files, it helped fight feature creeping, it helped us gain popularity and become a relevant MTA, it helped us get where we are now 10 years later.</p>\n\n<p>That being said, I believe this was a design error. A design error that could not have been predicted until we hit the wall to understand WHY this was an error. One-line rules are semantically wrong, they are SMTP wrong, they are wrong.</p>\n\n<p>One-line rules are making the entire daemon more complex, preventing some features from being implemented, making others more complex than they should be, they no longer serve our goals.</p>\n\n<p>To get to the point: we should move to two-line rules :-)</p>\n\n<ul>\n<li>The problem with one-line rules</li>\n</ul>\n\n<blockquote>\n<p>OpenSMTPD decides to accept or reject messages based on one-line rules such as:</p>\n</blockquote>\n\n<p><code>accept from any for domain poolp.org deliver to mbox</code></p>\n\n<blockquote>\n<p>Which can essentially be split into three units:</p>\n</blockquote>\n\n<ul>\n<li>the decision: accept/reject</li>\n<li>the matching: from any for domain <a href=\"http://poolp.org\">poolp.org</a></li>\n<li>the (default) action: deliver to mbox</li>\n</ul>\n\n<blockquote>\n<p>To ensure that we meet the requirements of the transactions, the matching must be performed during the SMTP transaction before we take a decision for the recipient.<br>\nGiven that the rule is atomic, that it doesn’t have an identifier and that the action is part of it, the two only ways to make sure we can remember the action to take later on at delivery time is to either:</p>\n</blockquote>\n\n<ul>\n<li>save the action in the envelope, which is what we do today</li>\n<li>evaluate the envelope again at delivery</li>\n<li>And this this where it gets tricky… both solutions are NOT ok.</li>\n</ul>\n\n<blockquote>\n<p>The first solution, which we’ve been using for a decade, was to save the action within the envelope and kind of carve it in stone. This works fine… however it comes with the downsides that errors fixed in configuration files can’t be caught up by envelopes, that delivery action must be validated way ahead of time during the SMTP transaction which is much trickier, that the parsing of delivery methods takes place as the _smtpd user rather than the recipient user, and that envelope structures that are passed all over OpenSMTPD carry delivery-time informations, and more, and more, and more. The code becomes more complex in general, less safe in some particular places, and some areas are nightmarish to deal with because they have to deal with completely unrelated code that can’t be dealt with later in the code path.</p>\n</blockquote>\n\n<blockquote>\n<p>The second solution can’t be done. An envelope may be the result of nested rules, for example an external client, hitting an alias, hitting a user with a .forward file resolving to a user. An envelope on disk may no longer match any rule or it may match a completely different rule If we could ensure that it matched the same rule, evaluating the ruleset may spawn new envelopes which would violate the transaction. Trying to imagine how we could work around this leads to more and more and more RFC violations, incoherent states, duplicate mails, etc…</p>\n</blockquote>\n\n<blockquote>\n<p>There is simply no way to deal with this with atomic rules, the matching and the action must be two separate units that are evaluated at two different times, failure to do so will necessarily imply that you’re either using our first solution and all its downsides, or that you are currently in a world of pain trying to figure out why everything is burning around you. The minute the action is written to an on-disk envelope, you have failed.</p>\n</blockquote>\n\n<blockquote>\n<p>A proper ruleset must define a set of matching patterns resolving to an action identifier that is carved in stone, AND a set of named action set that is resolved dynamically at delivery time.</p>\n</blockquote>\n\n<ul>\n<li>Follow the link above to see the rest of the article</li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Break</strong></p>\n\n<p>##News Roundup<br>\n###<a href=\"http://fortysomethinggeek.blogspot.com/2012/09/legacy-windows-rsync-backup-to-freenas.html\">Backing up a legacy Windows machine to a FreeNAS with rsync</a></p>\n\n<blockquote>\n<p>I have some old Windows servers (10 years and counting) and I have been using rsync to back them up to my FreeNAS box. It has been working great for me.</p>\n</blockquote>\n\n<blockquote>\n<p>First of all, I do have my Windows servers backup in virtualized format. However, those are only one-time snapshops that I run once in a while. These are classic ASP IIS web servers that I can easily put up on a new VM. However, many of these legacy servers generate gigabytes of data a day in their repositories. Running VM conversion daily is not ideal.</p>\n</blockquote>\n\n<blockquote>\n<p>My solution was to use some sort of rsync solution just for the data repos. I’ve tried some applications that didn’t work too well with Samba shares and these old servers have slow I/O. Copying files to external sata or usb drive was not ideal. We’ve moved on from Windows to Linux and do not have any Windows file servers of capacity to provide network backups.  Hence, I decided to use Delta Copy with FreeNAS. So here is a little write up on how to set it up. I have 4 Windows 2000 servers backing up daily with this method.</p>\n</blockquote>\n\n<blockquote>\n<p>First, download Delta Copy and install it. It is open-source and pretty much free. It is basically a wrapper for cygwin’s rsync. When you install it, it will ask you to install the Server services which allows you to run it as a Rsync server on Windows. You don’t need to do this. Instead, you will be just using the Delta Copy Client application. But before we do that, we will need to configure our Rsync service for our Windows Clients on FreeNAS.</p>\n</blockquote>\n\n<ul>\n<li>In FreeNAS, go under Services , Select Rsync &gt;  Rsync Modules &gt; Add Rsync Module.</li>\n<li>Then fill out the form; giving the module a name and set the path. In my example, I simply called it WIN and linked it to a user called backupuser.</li>\n<li>This process is much easier than trying to configure the daemon rsyncd.conf file by hand.</li>\n<li>Now, on the Windows Client, start the DeltaCopy Client. You will create a new Profile.</li>\n<li>You will need to enter the IP of the Rsync server (FreeNAS) and specify the module name which will be called “Virtual Directory Name.”  When you pull the select menu, the list of Rsync Modules you created earlier in FreeNAS will populate.</li>\n<li>You can set authentication. On the server, you can restrict by IP and do other things to lock down your rsync.</li>\n<li>Next, you will add folders (and/or files) you want to synchronize.</li>\n<li>Once the paths are set up, you can run a sync by right clicking the profile name.</li>\n<li>Here, I made a test sync to a home folder of a virtualized windows box. As you can see, I mounted the rsync volume on my mac to see the progress. The rsync worked beautifully. DeltaCopy did what it was told.</li>\n<li>Once you get everything working. The next thing to do is set schedules. If you done tasks schedules in Windows before, it is pretty straightforward. DeltaCopy has a link in the application to directly create a new task for you. I set my backups to run nightly and it has been working great.</li>\n</ul>\n\n<blockquote>\n<p>There you have it. Windows rsync to FreeNAS using DeltaCopy.<br>\nThe nice thing about FreeNAS is you don’t have to modify /etc/rsyncd.conf files. Everything can be done in the web admin.</p>\n</blockquote>\n\n<p><hr></p>\n\n<p><strong>iXsystems</strong></p>\n\n<p>###<a href=\"https://r3xnation.wordpress.com/2018/04/10/how-to-write-atf-tests-for-netbsd/amp/\">How to write ATF tests for NetBSD</a></p>\n\n<blockquote>\n<p>I have recently started contributing to the amazing NetBSD foundation. I was thinking of trying out a new OS for a long time. Switching to the NetBSD OS has been a fun change.</p>\n</blockquote>\n\n<blockquote>\n<p>My first contribution to the NetBSD foundation was adding regression tests for the Address Sanitizer (ASan) in the Automated Testing Framework(ATF) which NetBSD has. I managed to complete it with the help of my really amazing mentor Kamil. This post is gonna be about the ATF framework that NetBSD has and how to you can add multiple tests with ease.</p>\n</blockquote>\n\n<ul>\n<li>Intro</li>\n</ul>\n\n<blockquote>\n<p>In ATF tests we will basically be talking about test programs which are a suite of test cases for a specific application or program.</p>\n</blockquote>\n\n<ul>\n<li>The ATF suite of Commands</li>\n</ul>\n\n<blockquote>\n<p>There are a variety of commands that the atf suite offers. These include :</p>\n</blockquote>\n\n<ul>\n<li>\n<p>atf-check: The versatile command that is a vital part of the checking process. man page</p>\n</li>\n<li>\n<p>atf-run: Command used to run a test program. man page</p>\n</li>\n<li>\n<p>atf-fail: Report failure of a test case.</p>\n</li>\n<li>\n<p>atf-report: used to pretty print the atf-run. man page</p>\n</li>\n<li>\n<p>atf-set: To set atf test conditions.</p>\n</li>\n<li>\n<p>We will be taking a better look at the syntax and usage later.</p>\n</li>\n<li>\n<p>Let’s start with the Basics</p>\n</li>\n</ul>\n\n<blockquote>\n<p>The ATF testing framework comes preinstalled with a default NetBSD installation. It is used to write tests for various applications and commands in NetBSD.  One can write the Test programs in either the C language or in shell script. In this post I will be dealing with the Bash part.</p>\n</blockquote>\n\n<ul>\n<li>Follow the link above to see the rest of the article</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"http://brian.candler.me/posts/the-importance-of-zfs-blocksize/\">The Importance of ZFS Block Size</a></p>\n\n<ul>\n<li>Warning! WARNING! Don’t just do things because some random blog says so</li>\n</ul>\n\n<blockquote>\n<p>One of the important tunables in ZFS is the recordsize (for normal datasets) and volblocksize (for zvols). These default to 128KB and 8KB respectively.<br>\nAs I understand it, this is the unit of work in ZFS. If you modify one byte in a large file with the default 128KB record size, it causes the whole 128KB to be read in, one byte to be changed, and a new 128KB block to be written out.<br>\nAs a result, the official recommendation is to use a block size which aligns with the underlying workload: so for example if you are using a database which reads and writes 16KB chunks then you should use a 16KB block size, and if you are running VMs containing an ext4 filesystem, which uses a 4KB block size, you should set a 4KB block size<br>\nYou can see it has a 16GB total file size, of which 8.5G has been touched and consumes space - that is, it’s a “sparse” file. The used space is also visible by looking at the zfs filesystem which this file resides in<br>\nThen I tried to copy the image file whilst maintaining its “sparseness”, that is, only touching the blocks of the zvol which needed to be touched. The original used only 8.42G, but the copy uses 14.6GB - almost the entire 16GB has been touched! What’s gone wrong?<br>\nI finally realised that the difference between the zfs filesystem and the zvol is the block size. I recreated the zvol with a 128K block size<br>\nThat’s better. The disk usage of the zvol is now exactly the same as for the sparse file in the filesystem dataset</p>\n</blockquote>\n\n<ul>\n<li>It does impact the read speed too. 4K blocks took 5:52, and 128K blocks took 3:20</li>\n<li>Part of this is the amount of metadata that has to be read, see the MySQL benchmarks from earlier in the show</li>\n<li>And yes, using a larger block size will increase the compression efficiency, since the compressor has more redundant data to optimize.</li>\n<li>Some of the savings, and the speedup is because a lot less metadata had to be written</li>\n<li>Your zpool layout also plays a big role, if you use 4Kn disks, and RAID-Z2, using a volblocksize of 8k will actually result in a large amount of wasted space because of RAID-Z padding. Although, if you enable compression, your 8k records may compress to only 4k, and then all the numbers change again.</li>\n</ul>\n\n<p><hr></p>\n\n<p>###<a href=\"https://www.fukr.org.uk/?p=184\">Using a Raspberry Pi 2 as a Router on a Stick Starring NetBSD</a></p>\n\n<ul>\n<li>Sorry we didn’t answer you quickly enough</li>\n</ul>\n\n<blockquote>\n<p>A few weeks ago I set about upgrading my feeble networking skills by playing around with a Cisco 2970 switch. I set up a couple of VLANs and found the urge to set up a router to route between them. The 2970 isn’t a modern layer 3 switch so what am I to do?</p>\n</blockquote>\n\n<blockquote>\n<p>Why not make use of the Raspberry Pi 2 that I’ve never used and put it to some good use as a ‘router on a stick’.</p>\n</blockquote>\n\n<blockquote>\n<p>I could install a Linux based OS as I am quite familiar with it but where’s the fun in that? In my home lab I use SmartOS which by the way is a shit hot hypervisor but as far as I know there aren’t any Illumos distributions for the Raspberry Pi. On the desktop I use Solus OS which is by far the slickest Linux based OS that I’ve had the pleasure to use but Solus’ focus is purely desktop. It’s looking like BSD then!</p>\n</blockquote>\n\n<blockquote>\n<p>I believe FreeBSD is renowned for it’s top notch networking stack and so I wrote to the BSDNow show on Jupiter Broadcasting for some help but it seems that the FreeBSD chaps from the show are off on a jolly to some BSD conference or another(love the show by the way).</p>\n</blockquote>\n\n<blockquote>\n<p>It looks like me and the luvverly NetBSD are on a date this Saturday. I’ve always had a secret love for NetBSD. She’s a beautiful, charming and promiscuous lover(looking at the supported architectures) and I just can’t stop going back to her despite her misgivings(ahem, zfs). Just my type of grrrl!</p>\n</blockquote>\n\n<blockquote>\n<p>Let’s crack on…</p>\n</blockquote>\n\n<ul>\n<li>Follow the link above to see the rest of the article</li>\n</ul>\n\n<p><hr></p>\n\n<p>##Beastie Bits</p>\n\n<ul>\n<li><a href=\"https://www.bsdjobs.com/\">BSD Jobs</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html\">University of Aberdeen’s Internet Transport Research Group is hiring</a></li>\n<li><a href=\"https://youtu.be/YnNpgtjrM9U\">VR demo on OpenBSD via OpenHMD with OSVR HDK2</a></li>\n<li><a href=\"https://rachelbythebay.com/w/2018/04/05/bangpatch/\">patch runs ed, and ed can run anything (mentions FreeBSD and OpenBSD)</a></li>\n<li><a href=\"https://github.com/jwilm/alacritty/blob/master/README.md\">Alacritty (OpenGL-powered terminal emulator) now supports OpenBSD</a></li>\n<li><a href=\"https://undeadly.org/cgi?action=article;sid=20180413065457\">MAP_STACK Stack Register Checking Committed to -current</a></li>\n<li><a href=\"https://2018.eurobsdcon.org/call-for-papers/\">EuroBSDCon CfP till June 17, 2018</a></li>\n</ul>\n\n<p><hr></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<p>##Feedback/Questions</p>\n\n<ul>\n<li>NeutronDaemon - <a href=\"http://dpaste.com/3E0SR5Y#wrap\">Tutorial request</a></li>\n<li>Kurt - <a href=\"http://dpaste.com/01CWKM5#wrap\">Question about transferability/bi-directionality of ZFS snapshots and send/receive</a></li>\n<li>Peter - <a href=\"http://dpaste.com/3N1BGQF#wrap\">A Question and much love for BSD Now</a></li>\n<li>Peter - <a href=\"http://dpaste.com/20R2DTG\">netgraph state</a></li>\n</ul>\n\n<p><hr></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr></p>","summary":"OpenZFS and DTrace updates in NetBSD, NetBSD network security stack audit, Performance of MySQL on ZFS, OpenSMTP results from p2k18, legacy Windows backup to FreeNAS, ZFS block size importance, and NetBSD as router on a stick.","date_published":"2018-06-06T14:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/9447bcc4-4425-4ae0-bc1e-0fb13362e0e2.mp3","mime_type":"audio/mp3","size_in_bytes":51237875,"duration_in_seconds":5117}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-2016","title":"Episode 248: Show Me The Mooney | BSD Now 248","url":"https://www.bsdnow.tv/248","content_text":"DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.\n\nHeadlines\n\nDragonFlyBSD: release52 (w/stable HAMMER2, as default root)\n\n\nDragonflyBSD 5.2.1 was released on May 21, 2018\n&gt; Big Ticket items:\n\n\n\n  Meltdown and Spectre mitigation support\n  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectremitigation and machdep.meltdownmitigation.\n  HAMMER2\n  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.\n  Clustered support is not yet available.\n  ipfw Updates\n  Implement state based \"redirect\", i.e. without using libalias.\n  ipfw now supports all possible ICMP types.\n  Fix ICMPMAXTYPE assumptions (now 40 as of this release).\n  Improved graphics support\n  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs\n  Add 24-bit pixel format support to the EFI frame buffer code.\n  Significantly improve fbio support for the \"scfb\" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.\n  Partly implement the FBIOBLANK ioctl for display powersaving.\n  Syscons waits for drm modesetting at appropriate places, avoiding races.\n  \n  \n\n\nPS4 4.55 BPF Race Condition Kernel Exploit Writeup\n\n\n\n\n  Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I've published it under the \"FreeBSD\" folder and not the \"PS4\" folder.\n\n\n\nIntroduction\n\n\n\n  Welcome to the kernel portion of the PS4 4.55FW full exploit chain write-up. This bug was found by qwerty, and is fairly unique in the way it's exploited, so I wanted to do a detailed write-up on how it worked. The full source of the exploit can be found here. I've previously covered the webkit exploit implementation for userland access here.\n\n\n\nFreeBSD or Sony's fault? Why not both...\n\n\n\n  Interestingly, this bug is actually a FreeBSD bug and was not (at least directly) introduced by Sony code. While this is a FreeBSD bug however, it's not very useful for most systems because the /dev/bpf device driver is root-owned, and the permissions for it are set to 0600 (meaning owner has read/write privileges, and nobody else does) - though it can be used for escalating from root to kernel mode code execution. However, let’s take a look at the make_dev() call inside the PS4 kernel for /dev/bpf (taken from a 4.05 kernel dump).\n\n\n\nseg000:FFFFFFFFA181F15B                 lea     rdi, unk_FFFFFFFFA2D77640\nseg000:FFFFFFFFA181F162                 lea     r9, aBpf        ; \"bpf\"\nseg000:FFFFFFFFA181F169                 mov     esi, 0\nseg000:FFFFFFFFA181F16E                 mov     edx, 0\nseg000:FFFFFFFFA181F173                 xor     ecx, ecx\nseg000:FFFFFFFFA181F175                 mov     r8d, 1B6h\nseg000:FFFFFFFFA181F17B                 xor     eax, eax\nseg000:FFFFFFFFA181F17D                 mov     cs:qword_FFFFFFFFA34EC770, 0\nseg000:FFFFFFFFA181F188                 call    make_dev\n\n\n\n  We see UID 0 (the UID for the root user) getting moved into the register for the 3rd argument, which is the owner argument. However, the permissions bits are being set to 0x1B6, which in octal is 0666. This means anyone can open /dev/bpf with read/write privileges. I’m not sure why this is the case, qwerty speculates that perhaps bpf is used for LAN gaming. In any case, this was a poor design decision because bpf is usually considered privileged, and should not be accessible to a process that is completely untrusted, such as WebKit. On most platforms, permissions for /dev/bpf will be set to 0x180, or 0600.\n\n\n\nRace Conditions - What are they?\n\n\n\n  The class of the bug abused in this exploit is known as a \"race condition\". Before we get into bug specifics, it's important for the reader to understand what race conditions are and how they can be an issue (especially in something like a kernel). Often in complex software (such as a kernel), resources will be shared (or \"global\"). This means other threads could potentially execute code that will access some resource that could be accessed by another thread at the same point in time. What happens if one thread accesses this resource while another thread does without exclusive access? Race conditions are introduced.\n  \n  Race conditions are defined as possible scenarios where events happen in a sequence different than the developer intended which leads to undefined behavior. In simple, single-threaded programs, this is not an issue because execution is linear. In more complex programs where code can be running in parallel however, this becomes a real issue. To prevent these problems, atomic instructions and locking mechanisms were introduced. When one thread wants to access a critical resource, it will attempt to acquire a \"lock\". If another thread is already using this resource, generally the thread attempting to acquire the lock will wait until the other thread is finished with it. Each thread must release the lock to the resource after they're done with it, failure to do so could result in a deadlock.\n  \n  While locking mechanisms such as mutexes have been introduced, developers sometimes struggle to use them properly. For example, what if a piece of shared data gets validated and processed, but while the processing of the data is locked, the validation is not? There is a window between validation and locking where that data can change, and while the developer thinks the data has been validated, it could be substituted with something malicious after it is validated, but before it is used. Parallel programming can be difficult, especially when, as a developer, you also want to factor in the fact that you don't want to put too much code in between locking and unlocking as it can impact performance.\n\n\n\nSee article for the rest\n\n\n\n\niXsystems\n\nRemote Debugging the running OpenBSD kernel\n\n\nSubtitled: A way to understand the OpenBSD internals\n+&gt; The Problem\n+&gt; A few month ago, I tried porting the FreeBSD kdb along with it's gdb stub implementations to OpenBSD as a practice of learning the internals of an BSD operating system. The ddb code in both FreeBSD and OpenBSD looks pretty much the same and the GDB Remote Serial Protocol looks very minimal.\n+&gt; But sadly I got very busy and the work is stalled but I'm planning on resuming the attempt as soon as I get the chance, But there is an alternative way to Debugging the OpenBSD kernel via QEMU. What I did below is basically the same with a few minor changes which I hope to describe it as best.\n+&gt; Installing OpenBSD on Qemu\n+&gt; For debugging the kernel, we need a working OpenBSD system running on Qemu. I chose to create a raw disk file to be able to easily mount it later via the host and copy the custom kernel onto it.\n\n\n\n  $ qemu-img create -f raw disk.raw 5G\n  $ qemu-system-x8664 -m 256M \\\n  -drive format=raw,file=install63.fs \\\n  -drive format=raw,file=disk.raw\n  +&gt; Custom Kernel\n  +&gt; To debug the kernel, we need a version of the kernel with debugging symbols and for that we have to recompile it first. The process is documented at Building the System from Source:\n  ...\n  +&gt; Then we can copy the bsd kernel to the guest machine and keep the bsd.gdb on the host to start the remote debugging via gdb.\n  +&gt; Remote debugging kernel\n  +&gt; Now it's to time to boot the guest with the new custom kernel. Remember that the -s argument enables the gdb server on qemu on localhost port 1234 by default:\n  $ qemu-system-x8664 -m 256M -s \\\n     -net nic -net user \\\n  -drive format=raw,file=install63.fs \\\n  +&gt; Now to finally attach to the running kernel:\n  \n  \n\n\nInterview - Patrick Mooney - Software Engineer pmooney@pfmooney.com / @pfmooney\n\n\nBR: How did you first get introduced to UNIX?\nAJ: What got you started contributing to an open source project?\nBR: What sorts of things have you worked on in the past?\nAJ: Can you tell us more about what attracted you to illumos?\nBR: How did you get interested in, and started with, systems development?\nAJ: When did you first get interested in bhyve?\nBR: How much work was it to take the years-old port of bhyve and get it working on modern IllumOS?\nAJ: What was the process for getting the bhyve port caught up to current FreeBSD?\nBR: How usable is bhyve on illumOS?\nAJ: What area are you most interested in improving in bhyve?\nBR: Do you think the FreeBSD and illumos versions of bhyve will stay in sync with each other?\nAJ: What do you do for fun?\nBR: Anything else you want to mention?\n\n\n\n\nNews Roundup\n\nSetting up buildbot in FreeBSD Jails\n\n\n  In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism \"jails\". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.\n\n\n\nTable of contents\n\nChoosing host operating system and version for buildbot\nCreate a FreeBSD playground\nIntroduction to jails\nOverview of buildbot\nSet up jails\nInstall buildbot master\nRun buildbot master\nInstall buildbot worker\nRun buildbot worker\nSet up web server nginx to access buildbot UI\nRun your first build\nProduction hints\nFinished!\nChoosing host operating system and version for buildbot\n\n\n\n  We choose the released version of FreeBSD (11.1-RELEASE at the moment). There is no particular reason for it, and as a matter of fact buildbot as a Python-based server is very cross-platform; therefore the underlying OS platform and version should not make a large difference.\n  \n  It will make a difference for what you do with buildbot, however. For instance, poudriere is the de-facto standard for building packages from source on FreeBSD. Builds run in jails which may be any FreeBSD base system version older or equal to the host’s version (reason will be explained below). In other words, if the host is FreeBSD 11.1, build jails created by poudriere could e.g. use 9.1, 10.3, 11.0, 11.1, but potentially not version 12 or newer because of incompatibilities with the host’s kernel (jails do not run their own kernel as full virtual machines do). To not prolong this article over the intended scope, the details of which nice things could be done or automated with buildbot are not covered.\n  \n  Package names on the FreeBSD platform are independent of the OS version, since external software (as in: not part of base system) is maintained in FreeBSD ports. So, if your chosen FreeBSD version (here: 11) is still officially supported, the packages mentioned in this post should work. In the unlikely event of package name changes before you read this article, you should be able to find the actual package names like pkg search buildbot.\n  \n  Other operating systems like the various Linux distributions will use different package names but might also offer buildbot pre-packaged. If not, the buildbot installation manual offers steps to install it manually. In such case, the downside is that you will have to maintain and update the buildbot modules outside the stability and (semi-)automatic updates of your OS packages.\n\n\n\nSee article for the rest\n\n\n\n\nDigitalOcean\n\nDumping your USB\n\n\n  One of the many new features of OpenBSD 6.3 is the possibility to dump USB traffic to userland via bpf(4). This can be done with tcpdump(8) by specifying a USB bus as interface:\n\n\n```\n\ntcpdump -Xx -i usb0\n\ntcpdump: listening on usb0, link-type USBPCAP\n12:28:03.317945 bus 0 &lt; addr 1: ep1 intr 2\n  0000: 0400                                     ..\n\n12:28:03.318018 bus 0 &gt; addr 1: ep0 ctrl 8\n  0000: 00a3 0000 0002 0004 00                   ......... \n[...]\n```\n\n\n  As you might have noted I decided to implement the existing USBPcap capture format. A capture format is required because USB packets do not include all the necessary information to properly interpret them. I first thought I would implement libpcap's DLTUSB but then I quickly realize that this was not a standard. It is instead a FreeBSD specific format which has been since then renamed DLTUSBFREEBSD.\n  But I didn't want to embrace xkcd #927, so I look at the existing formats: DLTUSBFREEBSD, DLTUSBLINUX, DLTUSBLINUXMMAPPED, DLTUSBDARWIN and DLT_USBPCAP. I was first a bit sad to see that nobody could agree on a common format then I moved on and picked the simplest one: USBPcap.\n  Implementing an already existing format gives us out-of-box support for all the tools supporting it. That's why having common formats let us share our energy. In the case of USBPcap it is already supported by Wireshark, so you can already inspect your packet graphically. For that you need to first capture raw packets:\n\n\n```\n\ntcpdump -s 3303 -w usb.pcap -i usb0\n\ntcpdump: listening on usb0, link-type USBPCAP\n^C\n208 packets received by filter\n0 packets dropped by kernel\n```\n\n\n  USB packets can be quite big, that's why I'm not using tcpdump(8)'s default packet size. In this case, I want to make sure I can dump the complete uaudio(4) frames.\n  It is important to say that what is dumped to userland is what the USB stack sees. Packets sent on the wire might differ, especially when it comes to retries and timing. So this feature is not here to replace any USB analyser, however I hope that it will help people understand how things work and what the USB stack is doing. Even I found some interesting timing issues while implementing isochronous support.\n\n\n\n\nRun OpenBSD on your web server\n\n\nDeploy and login to your OpenBSD server first.\n\n\n\n  As soon as you're there you can enable an httpd(8) daemon, it's already installed on OpenBSD, you just need to configure it:\n\n\nwww# vi /etc/httpd.conf\n\n\nAdd two server sections---one for www and another for naked domain (all requests are redirected to www).\n\n\n```\nserver \"www.example.com\" {\n  listen on * port 80\n  root \"/htdocs/www.example.com\"\n}\n\nserver \"example.com\" {\n  listen on * port 80\n  block return 301 \"http://www.example.com$REQUEST_URI\"\n}\n```\n\n\nhttpd is chrooted to /var/www by default, so let's make a document root directory:\n\n\nwww# mkdir -p /var/www/htdocs/www.example.com\n\n\nSave and check this configuration:\n\n\n\nwww# httpd -n\nconfiguration ok\n\n\n\nEnable httpd(8) daemon and start it.\n\n\n\nwww# rcctl enable httpd\nwww# rcctl start httpd\n\n\n\nPublish your website\nCopy your website content into /var/www/htdocs/www.example.com and then test it your web browser.\n\n\nhttp://XXX.XXX.XXX.XXX/\n\n\n  Your web server should be up and running.\n\n\n\nUpdate DNS records\n\n\n\n  If there is another HTTPS server using this domain, configure that server to redirect all HTTPS requests to HTTP.\n  \n  Now as your new server is ready you can update DNS records accordingly.\n\n\n\n    example.com. 300 IN     A XXX.XXX.XXX.XXX\nwww.example.com. 300 IN     A XXX.XXX.XXX.XXX\n\n\n\nExamine your DNS is propagated.\n\n\n$ dig example.com www.example.com\n\n\nCheck IP addresses it answer sections. If they are correct, you should be able to access your new web server by its domain name.\nWhat's next? Enable HTTPS on your server.\n\n\n\n\nModern Akonadi and KMail on FreeBSD\n\n\n  For, quite literally a year or more, KMail and Akonadi on FreeBSD have been only marginally useful, at best. KDE4 era KMail was pretty darn good, but everything after that has had a number of FreeBSD users tearing out their hair. Sure, you can go to Trojitá, which has its own special problems and is generally “meh”, or bail out entirely to webmail, but .. KMail is a really great mail client when it works. Which, on Linux desktops, is nearly always, and on FreeBSD, is was nearly never.\n  \n  I looked at it with Dan and Volker last summer, briefly, and we got not much further than “hmm”. There’s a message about “The world is going to end!” which hardly makes sense, it means that a message has been truncated or corrupted while traversing a UNIX domain socket.\n  \n  Now Alexandre Martins — praise be! — has wandered in with a likely solution. KDE Bug 381850 contains a suggestion, which deserves to be publicised (and tested):\n\n\nsysctl net.local.stream.recvspace=65536\nsysctl net.local.stream.sendspace=65536\n\n\n  The default FreeBSD UNIX local socket buffer space is 8kiB. Bumping the size up to 64kiB — which matches the size that Linux has by default — suddenly makes KMail and Akonadi shine again. No other changes, no recompiling, just .. bump the sysctls (perhaps also in /etc/sysctl.conf) and KMail from Area51 hums along all day without ending the world.\n  \n  Since changing this value may have other effects, and Akonadi shouldn’t be dependent on a specific buffer size anyway, I’m looking into the Akonadi code (encouraged by Dan) to either automatically size the socket buffers, or to figure out where in the underlying code the assumption about buffer size lives. So for now, sysctl can make KMail users on FreeBSD happy, and later we hope to have things fully automatic (and if that doesn’t pan out, well, pkg-message exists).\n  \n  PS. Modern KDE PIM applications — Akonadi, KMail — which live in the deskutils/ category of the official FreeBSD ports were added to the official tree April 10th, so you can get your fix now from the official tree.\n\n\n\n\nBeastie Bits\n\n\npkg-provides support for DragonFly (from Rodrigo Osorio)\nMemories of writing a parser for man pages\nBryan Cantrill interview over at DeveloperOnFire podcast\n1978-03-25 - 2018-03-25: 40 years BSD Mail\nMy 5 years of FreeBSD gaming: a compendium of free games and engines running natively on FreeBSD\nSequential Resilver being upstreamed to FreeBSD, from FreeNAS, where it was ported from ZFS-on-Linux\nUniversity of Aberdeen’s Internet Transport Research Group is hiring  \n\n\n\n\nTarsnap ad\n\nFeedback/Questions\n\n\nDave - mounting non-filesystem things inside jails\nMorgan - ZFS on Linux Data loss bug\nRene - How to keep your ISP’s nose out of your browser history with encrypted DNS\nRodriguez - Feedback question! Relating to Windows\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.dragonflybsd.org/release52/\">DragonFlyBSD: release52 (w/stable HAMMER2, as default root)</a></h3>\n\n<ul>\n<li>DragonflyBSD 5.2.1 was released on May 21, 2018</li>\n<li>> Big Ticket items:\n\n\n<blockquote>\n  Meltdown and Spectre mitigation support\n  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.\n  HAMMER2\n  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.\n  Clustered support is not yet available.\n  ipfw Updates\n  Implement state based \"redirect\", i.e. without using libalias.\n  ipfw now supports all possible ICMP types.\n  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).\n  Improved graphics support\n  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs\n  Add 24-bit pixel format support to the EFI frame buffer code.\n  Significantly improve fbio support for the \"scfb\" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.\n  Partly implement the FBIO</em>BLANK ioctl for display powersaving.\n  Syscons waits for drm modesetting at appropriate places, avoiding races.</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h3><a href=\"https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md\">PS4 4.55 BPF Race Condition Kernel Exploit Writeup</a></h3>\n\n\n\n<blockquote>\n  <p>Note: While this bug is primarily interesting for exploitation on the PS4, this bug can also potentially be exploited on other unpatched platforms using FreeBSD if the attacker has read/write permissions on /dev/bpf, or if they want to escalate from root user to kernel code execution. As such, I've published it under the \"FreeBSD\" folder and not the \"PS4\" folder.</p>\n</blockquote>\n\n<ul>\n<li>Introduction</li>\n</ul>\n\n<blockquote>\n  <p>Welcome to the kernel portion of the PS4 4.55FW full exploit chain write-up. This bug was found by qwerty, and is fairly unique in the way it's exploited, so I wanted to do a detailed write-up on how it worked. The full source of the exploit can be found <a href=\"https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit\">here</a>. I've previously covered the webkit exploit implementation for userland access <a href=\"https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md\">here</a>.</p>\n</blockquote>\n\n<ul>\n<li>FreeBSD or Sony's fault? Why not both...</li>\n</ul>\n\n<blockquote>\n  <p>Interestingly, this bug is actually a FreeBSD bug and was not (at least directly) introduced by Sony code. While this is a FreeBSD bug however, it's not very useful for most systems because the /dev/bpf device driver is root-owned, and the permissions for it are set to 0600 (meaning owner has read/write privileges, and nobody else does) - though it can be used for escalating from root to kernel mode code execution. However, let’s take a look at the make_dev() call inside the PS4 kernel for /dev/bpf (taken from a 4.05 kernel dump).</p>\n</blockquote>\n\n<p><code>\nseg000:FFFFFFFFA181F15B                 lea     rdi, unk_FFFFFFFFA2D77640\nseg000:FFFFFFFFA181F162                 lea     r9, aBpf        ; \"bpf\"\nseg000:FFFFFFFFA181F169                 mov     esi, 0\nseg000:FFFFFFFFA181F16E                 mov     edx, 0\nseg000:FFFFFFFFA181F173                 xor     ecx, ecx\nseg000:FFFFFFFFA181F175                 mov     r8d, 1B6h\nseg000:FFFFFFFFA181F17B                 xor     eax, eax\nseg000:FFFFFFFFA181F17D                 mov     cs:qword_FFFFFFFFA34EC770, 0\nseg000:FFFFFFFFA181F188                 call    make_dev\n</code></p>\n\n<blockquote>\n  <p>We see UID 0 (the UID for the root user) getting moved into the register for the 3rd argument, which is the owner argument. However, the permissions bits are being set to 0x1B6, which in octal is 0666. This means anyone can open /dev/bpf with read/write privileges. I’m not sure why this is the case, qwerty speculates that perhaps bpf is used for LAN gaming. In any case, this was a poor design decision because bpf is usually considered privileged, and should not be accessible to a process that is completely untrusted, such as WebKit. On most platforms, permissions for /dev/bpf will be set to 0x180, or 0600.</p>\n</blockquote>\n\n<ul>\n<li>Race Conditions - What are they?</li>\n</ul>\n\n<blockquote>\n  <p>The class of the bug abused in this exploit is known as a \"race condition\". Before we get into bug specifics, it's important for the reader to understand what race conditions are and how they can be an issue (especially in something like a kernel). Often in complex software (such as a kernel), resources will be shared (or \"global\"). This means other threads could potentially execute code that will access some resource that could be accessed by another thread at the same point in time. What happens if one thread accesses this resource while another thread does without exclusive access? Race conditions are introduced.</p>\n  \n  <p>Race conditions are defined as possible scenarios where events happen in a sequence different than the developer intended which leads to undefined behavior. In simple, single-threaded programs, this is not an issue because execution is linear. In more complex programs where code can be running in parallel however, this becomes a real issue. To prevent these problems, atomic instructions and locking mechanisms were introduced. When one thread wants to access a critical resource, it will attempt to acquire a \"lock\". If another thread is already using this resource, generally the thread attempting to acquire the lock will wait until the other thread is finished with it. Each thread must release the lock to the resource after they're done with it, failure to do so could result in a deadlock.</p>\n  \n  <p>While locking mechanisms such as mutexes have been introduced, developers sometimes struggle to use them properly. For example, what if a piece of shared data gets validated and processed, but while the processing of the data is locked, the validation is not? There is a window between validation and locking where that data can change, and while the developer thinks the data has been validated, it could be substituted with something malicious after it is validated, but before it is used. Parallel programming can be difficult, especially when, as a developer, you also want to factor in the fact that you don't want to put too much code in between locking and unlocking as it can impact performance.</p>\n</blockquote>\n\n<ul>\n<li>See <a href=\"https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md\">article</a> for the rest</li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong></p>\n\n<h3><a href=\"http://bijanebrahimi.github.io/blog/remote-debugging-the-running-openbsd-kernel.html\">Remote Debugging the running OpenBSD kernel</a></h3>\n\n<ul>\n<li>Subtitled: A way to understand the OpenBSD internals\n+> The Problem\n+> A few month ago, I tried porting the FreeBSD kdb along with it's gdb stub implementations to OpenBSD as a practice of learning the internals of an BSD operating system. The ddb code in both FreeBSD and OpenBSD looks pretty much the same and the GDB Remote Serial Protocol looks very minimal.\n+> But sadly I got very busy and the work is stalled but I'm planning on resuming the attempt as soon as I get the chance, But there is an alternative way to Debugging the OpenBSD kernel via QEMU. What I did below is basically the same with a few minor changes which I hope to describe it as best.\n+> Installing OpenBSD on Qemu\n+> For debugging the kernel, we need a working OpenBSD system running on Qemu. I chose to create a raw disk file to be able to easily mount it later via the host and copy the custom kernel onto it.\n\n\n<blockquote>\n  $ qemu-img create -f raw disk.raw 5G\n  $ qemu-system-x86<em>64 -m 256M \\\n  -drive format=raw,file=install63.fs \\\n  -drive format=raw,file=disk.raw\n  +> Custom Kernel\n  +> To debug the kernel, we need a version of the kernel with debugging symbols and for that we have to recompile it first. The process is documented at Building the System from Source:\n  ...\n  +> Then we can copy the bsd kernel to the guest machine and keep the bsd.gdb on the host to start the remote debugging via gdb.\n  +> Remote debugging kernel\n  +> Now it's to time to boot the guest with the new custom kernel. Remember that the -s argument enables the gdb server on qemu on localhost port 1234 by default:\n  $ qemu-system-x86</em>64 -m 256M -s \\\n     -net nic -net user \\\n  -drive format=raw,file=install63.fs \\\n  +> Now to finally attach to the running kernel:</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h2>Interview - Patrick Mooney - Software Engineer <a href=\"pmooney@pfmooney.com\">pmooney@pfmooney.com</a> / <a href=\"https://twitter.com/pfmooney\">@pfmooney</a></h2>\n\n<ul>\n<li>BR: How did you first get introduced to UNIX?</li>\n<li>AJ: What got you started contributing to an open source project?</li>\n<li>BR: What sorts of things have you worked on in the past?</li>\n<li>AJ: Can you tell us more about what attracted you to illumos?</li>\n<li>BR: How did you get interested in, and started with, systems development?</li>\n<li>AJ: When did you first get interested in bhyve?</li>\n<li>BR: How much work was it to take the years-old port of bhyve and get it working on modern IllumOS?</li>\n<li>AJ: What was the process for getting the bhyve port caught up to current FreeBSD?</li>\n<li>BR: How usable is bhyve on illumOS?</li>\n<li>AJ: What area are you most interested in improving in bhyve?</li>\n<li>BR: Do you think the FreeBSD and illumos versions of bhyve will stay in sync with each other?</li>\n<li>AJ: What do you do for fun?</li>\n<li>BR: Anything else you want to mention?</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails\">Setting up buildbot in FreeBSD Jails</a></h3>\n\n<blockquote>\n  <p>In this article, I would like to present a tutorial to set up buildbot, a continuous integration (CI) software (like Jenkins, drone, etc.), making use of FreeBSD’s containerization mechanism \"jails\". We will cover terminology, rationale for using both buildbot and jails together, and installation steps. At the end, you will have a working buildbot instance using its sample build configuration, ready to play around with your own CI plans (or even CD, it’s very flexible!). Some hints for production-grade installations are given, but the tutorial steps are meant for a test environment (namely a virtual machine). Buildbot’s configuration and detailed concepts are not in scope here.</p>\n</blockquote>\n\n<ul>\n<li><p>Table of contents</p>\n\n<ul><li>Choosing host operating system and version for buildbot</li>\n<li>Create a FreeBSD playground</li>\n<li>Introduction to jails</li>\n<li>Overview of buildbot</li>\n<li>Set up jails</li>\n<li>Install buildbot master</li>\n<li>Run buildbot master</li>\n<li>Install buildbot worker</li>\n<li>Run buildbot worker</li>\n<li>Set up web server nginx to access buildbot UI</li>\n<li>Run your first build</li>\n<li>Production hints</li>\n<li>Finished!</li></ul></li>\n<li><p>Choosing host operating system and version for buildbot</p></li>\n</ul>\n\n<blockquote>\n  <p>We choose the released version of FreeBSD (11.1-RELEASE at the moment). There is no particular reason for it, and as a matter of fact buildbot as a Python-based server is very cross-platform; therefore the underlying OS platform and version should not make a large difference.</p>\n  \n  <p>It will make a difference for what you do with buildbot, however. For instance, poudriere is the de-facto standard for building packages from source on FreeBSD. Builds run in jails which may be any FreeBSD base system version older or equal to the host’s version (reason will be explained below). In other words, if the host is FreeBSD 11.1, build jails created by poudriere could e.g. use 9.1, 10.3, 11.0, 11.1, but potentially not version 12 or newer because of incompatibilities with the host’s kernel (jails do not run their own kernel as full virtual machines do). To not prolong this article over the intended scope, the details of which nice things could be done or automated with buildbot are not covered.</p>\n  \n  <p>Package names on the FreeBSD platform are independent of the OS version, since external software (as in: not part of base system) is maintained in FreeBSD ports. So, if your chosen FreeBSD version (here: 11) is still officially supported, the packages mentioned in this post should work. In the unlikely event of package name changes before you read this article, you should be able to find the actual package names like pkg search buildbot.</p>\n  \n  <p>Other operating systems like the various Linux distributions will use different package names but might also offer buildbot pre-packaged. If not, the buildbot installation manual offers steps to install it manually. In such case, the downside is that you will have to maintain and update the buildbot modules outside the stability and (semi-)automatic updates of your OS packages.</p>\n</blockquote>\n\n<ul>\n<li>See <a href=\"https://andidog.de/blog/2018-04-22-buildbot-setup-freebsd-jails\">article</a> for the rest</li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong></p>\n\n<h3><a href=\"http://www.grenadille.net/post/2018/03/29/Dumping-your-USB\">Dumping your USB</a></h3>\n\n<blockquote>\n  <p>One of the many new features of OpenBSD 6.3 is the possibility to dump USB traffic to userland via bpf(4). This can be done with tcpdump(8) by specifying a USB bus as interface:</p>\n</blockquote>\n\n<p>```</p>\n\n<h1>tcpdump -Xx -i usb0</h1>\n\n<p>tcpdump: listening on usb0, link-type USBPCAP\n12:28:03.317945 bus 0 &lt; addr 1: ep1 intr 2\n  0000: 0400                                     ..</p>\n\n<p>12:28:03.318018 bus 0 > addr 1: ep0 ctrl 8\n  0000: 00a3 0000 0002 0004 00                   ......... <br />\n[...]\n```</p>\n\n<blockquote>\n  <p>As you might have noted I decided to implement the existing USBPcap capture format. A capture format is required because USB packets do not include all the necessary information to properly interpret them. I first thought I would implement libpcap's DLT<em>USB but then I quickly realize that this was not a standard. It is instead a FreeBSD specific format which has been since then renamed DLT</em>USB<em>FREEBSD.\n  But I didn't want to embrace xkcd #927, so I look at the existing formats: DLT</em>USB<em>FREEBSD, DLT</em>USB<em>LINUX, DLT</em>USB<em>LINUX</em>MMAPPED, DLT<em>USB</em>DARWIN and DLT_USBPCAP. I was first a bit sad to see that nobody could agree on a common format then I moved on and picked the simplest one: USBPcap.\n  Implementing an already existing format gives us out-of-box support for all the tools supporting it. That's why having common formats let us share our energy. In the case of USBPcap it is already supported by Wireshark, so you can already inspect your packet graphically. For that you need to first capture raw packets:</p>\n</blockquote>\n\n<p>```</p>\n\n<h1>tcpdump -s 3303 -w usb.pcap -i usb0</h1>\n\n<p>tcpdump: listening on usb0, link-type USBPCAP\n^C\n208 packets received by filter\n0 packets dropped by kernel\n```</p>\n\n<blockquote>\n  <p>USB packets can be quite big, that's why I'm not using tcpdump(8)'s default packet size. In this case, I want to make sure I can dump the complete uaudio(4) frames.\n  It is important to say that what is dumped to userland is what the USB stack sees. Packets sent on the wire might differ, especially when it comes to retries and timing. So this feature is not here to replace any USB analyser, however I hope that it will help people understand how things work and what the USB stack is doing. Even I found some interesting timing issues while implementing isochronous support.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.romanzolotarev.com/openbsd/webserver.html\">Run OpenBSD on your web server</a></h3>\n\n<ul>\n<li><a href=\"https://www.romanzolotarev.com/vultr.html\">Deploy and login to your OpenBSD server first.</a></li>\n</ul>\n\n<blockquote>\n  <p>As soon as you're there you can enable an httpd(8) daemon, it's already installed on OpenBSD, you just need to configure it:</p>\n</blockquote>\n\n<p><code>www# vi /etc/httpd.conf</code></p>\n\n<ul>\n<li>Add two server sections---one for www and another for naked domain (all requests are redirected to www).</li>\n</ul>\n\n<p>```\nserver \"www.example.com\" {\n  listen on * port 80\n  root \"/htdocs/www.example.com\"\n}</p>\n\n<p>server \"example.com\" {\n  listen on * port 80\n  block return 301 \"http://www.example.com$REQUEST_URI\"\n}\n```</p>\n\n<ul>\n<li>httpd is chrooted to /var/www by default, so let's make a document root directory:</li>\n</ul>\n\n<p><code>www# mkdir -p /var/www/htdocs/www.example.com</code></p>\n\n<ul>\n<li>Save and check this configuration:</li>\n</ul>\n\n<p><code>\nwww# httpd -n\nconfiguration ok\n</code></p>\n\n<ul>\n<li>Enable httpd(8) daemon and start it.</li>\n</ul>\n\n<p><code>\nwww# rcctl enable httpd\nwww# rcctl start httpd\n</code></p>\n\n<ul>\n<li><p>Publish your website</p></li>\n<li><p>Copy your website content into /var/www/htdocs/www.example.com and then test it your web browser.</p></li>\n</ul>\n\n<p><code>http://XXX.XXX.XXX.XXX/</code></p>\n\n<blockquote>\n  <p>Your web server should be up and running.</p>\n</blockquote>\n\n<ul>\n<li>Update DNS records</li>\n</ul>\n\n<blockquote>\n  <p>If there is another HTTPS server using this domain, configure that server to redirect all HTTPS requests to HTTP.</p>\n  \n  <p>Now as your new server is ready you can update DNS records accordingly.</p>\n</blockquote>\n\n<p><code>\n    example.com. 300 IN     A XXX.XXX.XXX.XXX\nwww.example.com. 300 IN     A XXX.XXX.XXX.XXX\n</code></p>\n\n<ul>\n<li>Examine your DNS is propagated.</li>\n</ul>\n\n<p><code>$ dig example.com www.example.com</code></p>\n\n<ul>\n<li><p>Check IP addresses it answer sections. If they are correct, you should be able to access your new web server by its domain name.</p></li>\n<li><p><a href=\"https://www.romanzolotarev.com/openbsd/acme-client.html\">What's next? Enable HTTPS on your server.</a></p></li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://euroquis.nl/bobulate/?p=1827\">Modern Akonadi and KMail on FreeBSD</a></h3>\n\n<blockquote>\n  <p>For, quite literally a year or more, KMail and Akonadi on FreeBSD have been only marginally useful, at best. KDE4 era KMail was pretty darn good, but everything after that has had a number of FreeBSD users tearing out their hair. Sure, you can go to Trojitá, which has its own special problems and is generally “meh”, or bail out entirely to webmail, but .. KMail is a really great mail client when it works. Which, on Linux desktops, is nearly always, and on FreeBSD, is was nearly never.</p>\n  \n  <p>I looked at it with Dan and Volker last summer, briefly, and we got not much further than “hmm”. There’s a message about “The world is going to end!” which hardly makes sense, it means that a message has been truncated or corrupted while traversing a UNIX domain socket.</p>\n  \n  <p>Now Alexandre Martins — praise be! — has wandered in with a likely solution. KDE Bug 381850 contains a suggestion, which deserves to be publicised (and tested):</p>\n</blockquote>\n\n<p><code>sysctl net.local.stream.recvspace=65536</code>\n<code>sysctl net.local.stream.sendspace=65536</code></p>\n\n<blockquote>\n  <p>The default FreeBSD UNIX local socket buffer space is 8kiB. Bumping the size up to 64kiB — which matches the size that Linux has by default — suddenly makes KMail and Akonadi shine again. No other changes, no recompiling, just .. bump the sysctls (perhaps also in /etc/sysctl.conf) and KMail from Area51 hums along all day without ending the world.</p>\n  \n  <p>Since changing this value may have other effects, and Akonadi shouldn’t be dependent on a specific buffer size anyway, I’m looking into the Akonadi code (encouraged by Dan) to either automatically size the socket buffers, or to figure out where in the underlying code the assumption about buffer size lives. So for now, sysctl can make KMail users on FreeBSD happy, and later we hope to have things fully automatic (and if that doesn’t pan out, well, pkg-message exists).</p>\n  \n  <p>PS. Modern KDE PIM applications — Akonadi, KMail — which live in the deskutils/ category of the official FreeBSD ports were added to the official tree April 10th, so you can get your fix now from the official tree.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://lists.dragonflybsd.org/pipermail/users/2018-April/335722.html\">pkg-provides support for DragonFly (from Rodrigo Osorio)</a></li>\n<li><a href=\"https://monades.roperzh.com/memories-writing-parser-man-pages/\">Memories of writing a parser for man pages</a></li>\n<li><a href=\"http://developeronfire.com/podcast/episode-198-bryan-cantrill-persistence-and-action\">Bryan Cantrill interview over at DeveloperOnFire podcast</a></li>\n<li><a href=\"http://minnie.tuhs.org/pipermail/tuhs/2018-March/013285.html\">1978-03-25 - 2018-03-25: 40 years BSD Mail</a></li>\n<li><a href=\"https://imgur.com/a/KOTJS\">My 5 years of FreeBSD gaming: a compendium of free games and engines running natively on FreeBSD</a></li>\n<li><a href=\"https://reviews.freebsd.org/D15562\">Sequential Resilver being upstreamed to FreeBSD, from FreeNAS, where it was ported from ZFS-on-Linux</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-jobs/2018-May/000944.html\">University of Aberdeen’s Internet Transport Research Group is hiring  </a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>Tarsnap ad</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Dave - <a href=\"http://dpaste.com/0KHRB4Z#wrap\">mounting non-filesystem things inside jails</a></li>\n<li>Morgan - <a href=\"http://dpaste.com/10QD42T#wrap\">ZFS on Linux Data loss bug</a></li>\n<li>Rene - <a href=\"http://dpaste.com/30VM51S#wrap\">How to keep your ISP’s nose out of your browser history with encrypted DNS</a></li>\n<li>Rodriguez - <a href=\"http://dpaste.com/3WVYR9D#wrap\">Feedback question! Relating to Windows</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"DragonflyBSD release 5.2.1 is here, BPF kernel exploit writeup, Remote Debugging the running OpenBSD kernel, interview with Patrick Mooney, FreeBSD buildbot setup in a jail, dumping your USB, and 5 years of gaming on FreeBSD.","date_published":"2018-05-29T14:30:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a0ea5b3c-e781-499e-bfa4-cee1d550f915.mp3","mime_type":"audio/mp3","size_in_bytes":62803024,"duration_in_seconds":6273}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1994","title":"Episode 247: Interning for FreeBSD | BSD Now 247","url":"https://www.bsdnow.tv/247","content_text":"FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.\n\nHeadlines\n\nWhat I learned during my FreeBSD intership\n\n\n  Hi, my name is Mitchell Horne. I am a computer engineering student at the University of Waterloo, currently in my third year of studies, and fortunate to have been one of the FreeBSD Foundation’s co-op students this past term (January to April). During this time I worked under Ed Maste, in the Foundation’s small Kitchener office, along with another co-op student Arshan Khanifar. My term has now come to an end, and so I’d like to share a little bit about my experience as a newcomer to FreeBSD and open-source development.\n  \n  I’ll begin with some quick background — and a small admission of guilt. I have been an open-source user for a large part of my life. When I was a teenager I started playing around with Linux, which opened my eyes to the wider world of free software. Other than some small contributions to GNOME, my experience has been mostly as an end user; however, the value of these projects and the open-source philosophy was not lost on me, and is most of what motivated my interest in this position. Before beginning this term I had no personal experience with any of the BSDs, although I knew of their existence and was extremely excited to receive the position. I knew it would be a great opportunity for growth, but I must confess that my naivety about FreeBSD caused me to make the silent assumption that this would be a form of compromise — a stepping stone that would eventually allow me to work on open-source projects that are somehow “greater” or more “legitimate”. After four months spent immersed in this project I have learned how it operates, witnessed its community, and learned about its history. I am happy to admit that I was completely mistaken. Saying it now seems obvious, but FreeBSD is a project with its own distinct uses, goals, and identity. For many there may exist no greater opportunity than to work on FreeBSD full time, and with what I know now I would have a hard time coming up with a project that is more “legitimate”.\n\n\n\nWhat I Liked\n\n\n\n  In all cases, the work I submitted this term was reviewed by no less than two people before being committed. The feedback and criticism I received was always both constructive and to the point, and it commented on everything from high-level ideas to small style issues. I appreciate having these thorough reviews in place, since I believe it ultimately encourages people to accept only their best work. It is indicative of the high quality that already exists within every aspect of this project, and this commitment to quality is something that should continue to be honored as a core value. As I’ve discovered in some of my previous work terms, it is all too easy cut corners in the name of a deadline or changing priorities, but the fact that FreeBSD doesn’t need to make these types of compromises is a testament to the power of free software.\n  \n  It’s a small thing, but the quality and completeness of the FreeBSD documentation was hugely helpful throughout my term. Everything you might need to know about utilities, library functions, the kernel, and more can be found in a man page; and the handbook is a great resource as both an introduction to the operating system and a reference. I only wish I had taken some time earlier in the term to explore the different documents more thoroughly, as they cover a wide range of interesting and useful topics. The effort people put into writing and maintaining FreeBSD’s documentation is easy to overlook, but its value cannot be overstated.\n\n\n\nWhat I Learned\n\n\n\n  Although there was a lot I enjoyed, there were certainly many struggles I faced throughout the term, and lessons to be learned from them. I expect that some of issues I faced may be specific to FreeBSD, while others may be common to open-source projects in general. I don’t have enough experience to speculate on which is which, so I will leave this to the reader.\n  \n  The first lesson can be summed up simply: you have to advocate for your own work. FreeBSD is made up in large part by volunteer efforts, and in many cases there is more work to go around than people available to do it. A consequence of this is that there will not be anybody there to check up on you. Even in my position where I actually had a direct supervisor, Ed often had his plate full with so many other things that the responsibility to find someone to look at my work fell to me. Admittedly, a couple of smaller changes I worked on got left behind or stuck in review simply because there wasn’t a clear person/place to reach out to.\n  \n  I think this is both a barrier of entry to FreeBSD and a mental hurdle that I needed to get over. If there’s a change you want to see included or reviewed, then you may have to be the one to push for it, and there’s nothing wrong with that. Perhaps this process should be easier for newcomers or infrequent contributors (the disconnect between Bugzilla and Phabricator definitely leaves a lot to be desired), but we also have to be aware that this simply isn’t the reality right now. Getting your work looked at may require a little bit more self-motivation, but I’d argue that there are much worse problems a project like FreeBSD could have than this.\n  \n  I understand this a lot better now, but it is still something I struggle with. I’m not naturally the type of person who easily connects with others or asks for help, so I see this as an area for future growth rather than simply a struggle I encountered and overcame over the course of this work term. Certainly it is an important skill to understand the value of your own work, and equally important is the ability to communicate that value to others.\n  \n  I also learned the importance of starting small. My first week or two on the job mainly involved getting set up and comfortable with the workflow. After this initial stage, I began exploring the project and found myself overwhelmed by its scale. With so many possible areas to investigate, and so much work happening at once, I felt quite lost on where to begin. Many of the potential projects I found were too far beyond my experience level, and most small bugs were picked up and fixed quickly by more experienced contributors before I could even get to them.\n  \n  It’s easy to make the mistake that FreeBSD is made up solely of a few rock-star committers that do everything. This is how it appears at face-value, as reading through commits, bug reports, and mailing lists yields a few of the same names over and over. The reality is that just as important are the hundreds of users and infrequent contributors who take the time to submit bug reports, patches, or feedback. Even though there are some people who would fall under the umbrella of a rock-star committer, they didn’t get there overnight. Rather, they have built their skills and knowledge through many years of involvement in FreeBSD and similar projects.\n  \n  As a student coming into this project and having high expectations of myself, it was easy to set the bar too high by comparing myself against those big committers, and feel that my work was insignificant, inadequate, and simply too infrequent. In reality, there is no reason I should have felt this way. In a way, this comparison is disrespectful to those who have reached this level, as it took them a long time to get there, and it’s a humbling reminder that any skill worth learning requires time, patience, and dedication. It is easy to focus on an end product and simply wish to be there, but in order to be truly successful one must start small, and find satisfaction in the struggle of learning something new. I take pride in the many small successes I’ve had throughout my term here, and appreciate the fact that my journey into FreeBSD and open-source software is only just beginning.\n\n\n\nClosing Thoughts\n\n\n\n  I would like to close with some brief thank-you’s. First, to everyone at the Foundation for being so helpful, and allowing this position to exist in the first place. I am extremely grateful to have been given this unique opportunity to learn about and give back to the open-source world. I’d also like to thank my office mates; Ed: for being an excellent mentor, who offered an endless wealth of knowledge and willingness to share it. My classmate and fellow intern Arshan: for giving me a sense of camaraderie and the comforting reminder that at many moments he was as lost as I was. Finally, a quick thanks to everyone else I crossed paths with who offered reviews and advice. I appreciate your help and look forward to working with you all further.\n  \n  I am walking away from this co-op with a much greater appreciation for this project, and have made it a goal to remain involved in some capacity. I feel that I’ve gained a little bit of a wider perspective on my place in the software world, something I never really got from my previous co-ops. Whether it ends up being just a stepping stone, or the beginning of much larger involvement, I thoroughly enjoyed my time here.\n\n\n\n\nRecent Developments in FreeBSD\n\n\nSupport for encrypted, compressed (gzip and zstd), and network crash dumps enabled by default on most platforms\nIntel Microcode Splitter\nIntel Spec Store Bypass Disable control\nRaspberry Pi 3B+ Ethernet Driver\nIBRS for i386\nUpcoming:\nMicrocode updater for AMD CPUs\nthe RACK TCP/IP stack, from Netflix\nVoting in the FreeBSD Core Election begins today:\n\n\n\n\nDigitalOcean\nDigital Ocean Promo Link for BSD Now Listeners\n\n\n\nRunning FreeNAS on a DigitalOcean Droplet\n\n\nNeed to backup your FreeNAS offsite? Run a locked down instance in the cloud, and replicate to it\nThe tutorial walks though the steps of converting a fresh FreeBSD based droplet into a FreeNAS\nCreate a droplet, and add a small secondary block-storage device\nBoot the droplet, login, and download FreeNAS\nDisable swap, enable ‘foot shooting’ mode in GEOM\nuse dd to write the FreeNAS installer to the boot disk\nReboot the droplet, and use the FreeNAS installer to install FreeNAS to the secondary block storage device\nNow, reimage the droplet with FreeBSD again, to replace the FreeNAS installer\nBoot, and dd FreeNAS from the secondary block storage device back to the boot disk\nYou can now destroy the secondary block device\nNow you have a FreeNAS, and can take it from there.\nUse the FreeNAS replication wizard to configure sending snapshots from your home NAS to your cloud NAS\nNote: You might consider creating a new block storage device to create a larger pool, that you can more easily grow over time, rather than using the boot device in the droplet as your main pool.\n\n\n\n\nNews Roundup\n\nNetwork Manager Control for OpenBSD (Updated)\n\n\nGeneralities\nI just remind the scope of this small tool:\n\nallow you to pre-define several cable or wifi connections\nlet nmctl to connect automatically to the first available one\nallow you to easily switch from one network connection to an other one\ncreate openbox dynamic menus\nEnhancements in this version\n\n\n\n  This is my second development version: 0.2.\n  I've added performed several changes in the code:\n\n\n\ncode style cleanup, to better match the python recommendations\nadapt the tool to allow to connect to an Open-wifi having blancs in the name. This happens in some hotels\nimplement a loop as work-around concerning the arp table issue.\n\n\n\n  The source code is still on the git of Sourceforge.net. \n   You can see the files here\n  \n  And you can download the last version here\n\n\n\nFeedbacks after few months\n\n\n\n  I'm using this script on my OpenBSD laptop since about 5 months. In my case, I'm mainly using the openbox menus and the --restart option.\n\n\n\nThe Openbox menus\n\n\n\n  The openbox menus are working fine. As explain in my previous blog, I just have to create 2 entries in my openbox's menu.xml file, and all the rest comes automatically from nmctl itself thanks to the --list and --scan options.\n  I've not changed this part of nmctl since it works as expected (for me :-) ).\n\n\n\nThe --restart option\n\n\n\n  Because I'm very lazy, and because OpenBSD is very simple to use, I've added the command \"nmctl --restart\" in the /etc/apm/resume script. Thanks to apmd, this script will be used each time I'm opening the lid of my laptop. \n  In other words, each time I'll opening my laptop, nmctl will search the optimum network connection for me.\n  But I had several issues in this scenario.\n  Most of the problems were linked to the arp table issues. Indeed, in some circumstances, my proxy IP address was associated to the cable interface instead of the wifi interface or vice-versa. As consequence I'm not able to connect to the proxy, thus not able to connect to internet. So the ping to google (final test nmctl perform) is failing.\n  Knowing that anyhow, I'm doing a full arp cleanup, it's not clear for me from where this problem come from. To solve this situation I've implemented a \"retry\" concept. In other words, before testing an another possible network connection (as listed in my /etc/nmctl.conf file), the script try 3x the current connection's parameters.\n  If you want to reduce or increase this figures, you can do it via the --retry parameter.\n\n\n\nResults of my expertise with this small tool\n\n\n\n  Where ever I'm located, my laptop is now connecting automatically to the wifi / cable connection previously identified for this location.\n  Currently I have 3 places where I have Wifi credentials and 2 offices places where I just have to plug the network cable.\n  Since the /etc/apm/resume scripts is triggered when I open the lid of the laptop, I just have to make sure that I plug the RJ45 before opening the laptop. For the rest, I do not have to type any commands, OpenBSD do all what is needed ;-).\n  I hotels or restaurants, I can just connect to the Open Wifi thanks to the openbox menu created by \"nmctl --scan\".\n\n\n\nNext steps\nDocumentation\n\n\n\n  The tool is missing lot of documentation. I appreciate OpenBSD for his great documentation, so I have to do the same.\n  I plan to write a README and a man page at first instances.\n  But since my laziness, I will do it as soon as I see some interest for this tool from other persons.\n\n\n\nTests\n\n\n\n  I now have to travel and see how to see the script react on the different situations.\n  Interested persons are welcome to share with me the outcome of their tests.\n  I'm curious how it work.\n\n\n\n\nOpenBSD 6.3 on EdgeRouter Lite simple upgrade method\n\n\nTL;DR\n\n\n\n  OpenBSD 6.3 oceton upgrade instructions may not factor that your ERL is running from the USB key they want wiped with the miniroot63.fs image loaded on.\n  Place the bsd.rd for OpenBSD 6.3 on the sd0i slice used by U-Boot for the kernel, and then edit the boot command to run it.\n\n\n\na tiny upgrade\n\n\n\n  The OpenBSD documentation is comprehensive, but there might be rough corners around what are probably edge cases in their user base. People running EdgeRouter Lite hardware for example, who are looking to upgrade from 6.2 to 6.3.\n  The documentation, which gave us everything we needed last time, left me with some questions about how to upgrade. In INSTALL.octeon, the Upgrading section does mention:\n  The best solution, whenever possible, is to backup your data and reinstall from scratch\n  I had to check if that directive existed in the documentation for other architectures. I wondered if oceton users were getting singled out. We were not. Just simplicity and pragmatism.\n\n\n\nReading on:\n\n\n\n  To upgrade OpenBSD 6.3 from a previous version, start with the general instructions in the section \"Installing OpenBSD\".\n  But that section requires us to boot off of TFTP or NFS. Which I don’t want to do right now. Could also use a USB stick with the miniroot63.fs installed on it.\n  But as the ERL only has a single USB port, we would have to remove the USB stick with the current install on it. Once we get to the Install or Upgrade prompt, there would be nothing to upgrade.\n  Well, I guess I could use a USB hub. But the ERL’s USB port is inside the case. With all the screws in. And the tools are neatly put away. And I’d have to pull the USB hub from behind a workstation. And it’s two am. And I cleaned up the cabling in the lab this past weekend. Looks nice for once.\n  So I don’t want to futz around with all that.\n  There must be an almost imperceptibly easier way of doing this than setting up a TFTP server or NFS share in five minutes… Right?\n\n\n\n\niXsystems\nBoise Technology Show 2018 Recap\n\nOpenZFS User Conference Slides &amp; Videos\n\n\nThank you ZFS\nZSTD Compression\nPool Layout Considerations\nZFS Releases\nHelping Developers Help You\nZFS and MySQL on Linux\nMicron\nOSNEXUS\nZFS at Six Feet Up\nFlexible Disk Use with OpenZFS\n\n\n\n\nBatch editing files with ed\n\n\nwhat’s ‘ed’?\n\n\n\n  ed is this sort of terrifying text editor. A typical interaction with ed for me in the past has gone something like this:\n\n\n\n$ ed\nhelp\n?\nh\n?\nasdfasdfasdfsadf\n?\n&lt;close terminal in frustration&gt;\n\n\n\n  Basically if you do something wrong, ed will just print out a single, unhelpful, ?. So I’d basically dismissed ed as an old arcane Unix tool that had no practical use today.\n  vi is a successor to ed, except with a visual interface instead of this ?\n\n\n\nsurprise: Ed is actually sort of cool and fun\n\n\n\n  So if Ed is a terrifying thing that only prints ? at you, why am I writing a blog post about it? WELL!!!!\n  On April 1 this year, Michael W Lucas published a new short book called Ed Mastery. I like his writing, and even though it was sort of an april fool’s joke, it was ALSO a legitimate actual real book, and so I bought it and read it to see if his claims that Ed is actually interesting were true.\n  And it was so cool!!!! I found out:\n\n\n\nhow to get Ed to give you better error messages than just ?\nthat the name of the grep command comes from ed syntax (g/re/p)\nthe basics of how to navigate and edit files using ed\n\n\n\n  All of that was a cool Unix history lesson, but did not make me want to actually use Ed in real life. But!!!\n  \n  The other neat thing about Ed (that did make me want to use it!) is that any Ed session corresponds to a script that you can replay! So if I know Ed, then I can use Ed basically as a way to easily apply vim-macro-like programs to my files.\n\n\n\n\nBeastie Bits\n\n\nFreeBSD Mastery: Jails -- Help make it happen \nVideo: OpenZFS Basics presented by George Wilson and Matt Ahrens at Scale 16x back in March 2018\nDragonFlyBSD’s IPFW gets highspeed lockless in-kernel NAT\nA Love Letter to OpenBSD\nNew talks, and the F-bomb\nPractical UNIX Manuals: mdoc\nBSD Meetup in Zurich: May 24th\nBSD Meetup in Warsaw: May 24th\nMeetBSD 2018\n\n\n\n\nTarsnap\n\nFeedback/Questions\n\n\nSeth - First time poudriere Builder\nFarhan - Why we didn't go FreeBSD\narchitech - Encryption Feedback\nDave - Handy Tip on setting up automated coredump handling for FreeBSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.freebsdfoundation.org/blog/guest-blog-what-i-learned-during-my-freebsd-internship/\">What I learned during my FreeBSD intership</a></h3>\n\n<blockquote>\n  <p>Hi, my name is Mitchell Horne. I am a computer engineering student at the University of Waterloo, currently in my third year of studies, and fortunate to have been one of the FreeBSD Foundation’s co-op students this past term (January to April). During this time I worked under Ed Maste, in the Foundation’s small Kitchener office, along with another co-op student Arshan Khanifar. My term has now come to an end, and so I’d like to share a little bit about my experience as a newcomer to FreeBSD and open-source development.</p>\n  \n  <p>I’ll begin with some quick background — and a small admission of guilt. I have been an open-source user for a large part of my life. When I was a teenager I started playing around with Linux, which opened my eyes to the wider world of free software. Other than some small contributions to GNOME, my experience has been mostly as an end user; however, the value of these projects and the open-source philosophy was not lost on me, and is most of what motivated my interest in this position. Before beginning this term I had no personal experience with any of the BSDs, although I knew of their existence and was extremely excited to receive the position. I knew it would be a great opportunity for growth, but I must confess that my naivety about FreeBSD caused me to make the silent assumption that this would be a form of compromise — a stepping stone that would eventually allow me to work on open-source projects that are somehow “greater” or more “legitimate”. After four months spent immersed in this project I have learned how it operates, witnessed its community, and learned about its history. I am happy to admit that I was completely mistaken. Saying it now seems obvious, but FreeBSD is a project with its own distinct uses, goals, and identity. For many there may exist no greater opportunity than to work on FreeBSD full time, and with what I know now I would have a hard time coming up with a project that is more “legitimate”.</p>\n</blockquote>\n\n<ul>\n<li>What I Liked</li>\n</ul>\n\n<blockquote>\n  <p>In all cases, the work I submitted this term was reviewed by no less than two people before being committed. The feedback and criticism I received was always both constructive and to the point, and it commented on everything from high-level ideas to small style issues. I appreciate having these thorough reviews in place, since I believe it ultimately encourages people to accept only their best work. It is indicative of the high quality that already exists within every aspect of this project, and this commitment to quality is something that should continue to be honored as a core value. As I’ve discovered in some of my previous work terms, it is all too easy cut corners in the name of a deadline or changing priorities, but the fact that FreeBSD doesn’t need to make these types of compromises is a testament to the power of free software.</p>\n  \n  <p>It’s a small thing, but the quality and completeness of the FreeBSD documentation was hugely helpful throughout my term. Everything you might need to know about utilities, library functions, the kernel, and more can be found in a man page; and the handbook is a great resource as both an introduction to the operating system and a reference. I only wish I had taken some time earlier in the term to explore the different documents more thoroughly, as they cover a wide range of interesting and useful topics. The effort people put into writing and maintaining FreeBSD’s documentation is easy to overlook, but its value cannot be overstated.</p>\n</blockquote>\n\n<ul>\n<li>What I Learned</li>\n</ul>\n\n<blockquote>\n  <p>Although there was a lot I enjoyed, there were certainly many struggles I faced throughout the term, and lessons to be learned from them. I expect that some of issues I faced may be specific to FreeBSD, while others may be common to open-source projects in general. I don’t have enough experience to speculate on which is which, so I will leave this to the reader.</p>\n  \n  <p>The first lesson can be summed up simply: you have to advocate for your own work. FreeBSD is made up in large part by volunteer efforts, and in many cases there is more work to go around than people available to do it. A consequence of this is that there will not be anybody there to check up on you. Even in my position where I actually had a direct supervisor, Ed often had his plate full with so many other things that the responsibility to find someone to look at my work fell to me. Admittedly, a couple of smaller changes I worked on got left behind or stuck in review simply because there wasn’t a clear person/place to reach out to.</p>\n  \n  <p>I think this is both a barrier of entry to FreeBSD and a mental hurdle that I needed to get over. If there’s a change you want to see included or reviewed, then you may have to be the one to push for it, and there’s nothing wrong with that. Perhaps this process should be easier for newcomers or infrequent contributors (the disconnect between Bugzilla and Phabricator definitely leaves a lot to be desired), but we also have to be aware that this simply isn’t the reality right now. Getting your work looked at may require a little bit more self-motivation, but I’d argue that there are much worse problems a project like FreeBSD could have than this.</p>\n  \n  <p>I understand this a lot better now, but it is still something I struggle with. I’m not naturally the type of person who easily connects with others or asks for help, so I see this as an area for future growth rather than simply a struggle I encountered and overcame over the course of this work term. Certainly it is an important skill to understand the value of your own work, and equally important is the ability to communicate that value to others.</p>\n  \n  <p>I also learned the importance of starting small. My first week or two on the job mainly involved getting set up and comfortable with the workflow. After this initial stage, I began exploring the project and found myself overwhelmed by its scale. With so many possible areas to investigate, and so much work happening at once, I felt quite lost on where to begin. Many of the potential projects I found were too far beyond my experience level, and most small bugs were picked up and fixed quickly by more experienced contributors before I could even get to them.</p>\n  \n  <p>It’s easy to make the mistake that FreeBSD is made up solely of a few rock-star committers that do everything. This is how it appears at face-value, as reading through commits, bug reports, and mailing lists yields a few of the same names over and over. The reality is that just as important are the hundreds of users and infrequent contributors who take the time to submit bug reports, patches, or feedback. Even though there are some people who would fall under the umbrella of a rock-star committer, they didn’t get there overnight. Rather, they have built their skills and knowledge through many years of involvement in FreeBSD and similar projects.</p>\n  \n  <p>As a student coming into this project and having high expectations of myself, it was easy to set the bar too high by comparing myself against those big committers, and feel that my work was insignificant, inadequate, and simply too infrequent. In reality, there is no reason I should have felt this way. In a way, this comparison is disrespectful to those who have reached this level, as it took them a long time to get there, and it’s a humbling reminder that any skill worth learning requires time, patience, and dedication. It is easy to focus on an end product and simply wish to be there, but in order to be truly successful one must start small, and find satisfaction in the struggle of learning something new. I take pride in the many small successes I’ve had throughout my term here, and appreciate the fact that my journey into FreeBSD and open-source software is only just beginning.</p>\n</blockquote>\n\n<ul>\n<li>Closing Thoughts</li>\n</ul>\n\n<blockquote>\n  <p>I would like to close with some brief thank-you’s. First, to everyone at the Foundation for being so helpful, and allowing this position to exist in the first place. I am extremely grateful to have been given this unique opportunity to learn about and give back to the open-source world. I’d also like to thank my office mates; Ed: for being an excellent mentor, who offered an endless wealth of knowledge and willingness to share it. My classmate and fellow intern Arshan: for giving me a sense of camaraderie and the comforting reminder that at many moments he was as lost as I was. Finally, a quick thanks to everyone else I crossed paths with who offered reviews and advice. I appreciate your help and look forward to working with you all further.</p>\n  \n  <p>I am walking away from this co-op with a much greater appreciation for this project, and have made it a goal to remain involved in some capacity. I feel that I’ve gained a little bit of a wider perspective on my place in the software world, something I never really got from my previous co-ops. Whether it ends up being just a stepping stone, or the beginning of much larger involvement, I thoroughly enjoyed my time here.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3>Recent Developments in FreeBSD</h3>\n\n<ul>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=333890\">Support for encrypted, compressed (gzip and zstd), and network crash dumps enabled by default on most platforms</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=333649\">Intel Microcode Splitter</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=334005\">Intel Spec Store Bypass Disable control</a></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=333713\">Raspberry Pi 3B+ Ethernet Driver</a></li>\n<li><a href=\"https://reviews.freebsd.org/D15522\">IBRS for i386</a></li>\n<li>Upcoming:</li>\n<li><a href=\"https://reviews.freebsd.org/D15523\">Microcode updater for AMD CPUs</a></li>\n<li><a href=\"https://reviews.freebsd.org/D15525\">the RACK TCP/IP stack, from Netflix</a></li>\n<li>Voting in the FreeBSD Core Election begins today:</li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong>\n<a href=\"http://do.co/bsdnow\">Digital Ocean Promo Link for BSD Now Listeners</a></p>\n\n<p><hr /></p>\n\n<h3><a href=\"http://www.shlomimarco.com/blog/running-freenas-on-a-digitalocean-droplet\">Running FreeNAS on a DigitalOcean Droplet</a></h3>\n\n<ul>\n<li>Need to backup your FreeNAS offsite? Run a locked down instance in the cloud, and replicate to it</li>\n<li>The tutorial walks though the steps of converting a fresh FreeBSD based droplet into a FreeNAS</li>\n<li>Create a droplet, and add a small secondary block-storage device</li>\n<li>Boot the droplet, login, and download FreeNAS</li>\n<li>Disable swap, enable ‘foot shooting’ mode in GEOM</li>\n<li>use dd to write the FreeNAS installer to the boot disk</li>\n<li>Reboot the droplet, and use the FreeNAS installer to install FreeNAS to the secondary block storage device</li>\n<li>Now, reimage the droplet with FreeBSD again, to replace the FreeNAS installer</li>\n<li>Boot, and dd FreeNAS from the secondary block storage device back to the boot disk</li>\n<li>You can now destroy the secondary block device</li>\n<li>Now you have a FreeNAS, and can take it from there.</li>\n<li>Use the FreeNAS replication wizard to configure sending snapshots from your home NAS to your cloud NAS</li>\n<li>Note: You might consider creating a new block storage device to create a larger pool, that you can more easily grow over time, rather than using the boot device in the droplet as your main pool.</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://www.vincentdelft.be/post/post_20180411\">Network Manager Control for OpenBSD (Updated)</a></h3>\n\n<ul>\n<li>Generalities</li>\n<li><p>I just remind the scope of this small tool:</p>\n\n<ul><li>allow you to pre-define several cable or wifi connections</li>\n<li>let nmctl to connect automatically to the first available one</li>\n<li>allow you to easily switch from one network connection to an other one</li>\n<li>create openbox dynamic menus</li></ul></li>\n<li><p>Enhancements in this version</p></li>\n</ul>\n\n<blockquote>\n  <p>This is my second development version: 0.2.\n  I've added performed several changes in the code:</p>\n</blockquote>\n\n<ul>\n<li>code style cleanup, to better match the python recommendations</li>\n<li>adapt the tool to allow to connect to an Open-wifi having blancs in the name. This happens in some hotels</li>\n<li>implement a loop as work-around concerning the arp table issue.</li>\n</ul>\n\n<blockquote>\n  <p>The source code is still on the git of Sourceforge.net. \n   You can see the files <a href=\"https://sourceforge.net/p/nmctl/code/ci/master/tree/\">here</a></p>\n  \n  <p>And you can download the last version <a href=\"https://sourceforge.net/p/nmctl/code/ci/master/tarball\">here</a></p>\n</blockquote>\n\n<ul>\n<li>Feedbacks after few months</li>\n</ul>\n\n<blockquote>\n  <p>I'm using this script on my OpenBSD laptop since about 5 months. In my case, I'm mainly using the openbox menus and the --restart option.</p>\n</blockquote>\n\n<ul>\n<li>The Openbox menus</li>\n</ul>\n\n<blockquote>\n  <p>The openbox menus are working fine. As explain in my previous blog, I just have to create 2 entries in my openbox's menu.xml file, and all the rest comes automatically from nmctl itself thanks to the --list and --scan options.\n  I've not changed this part of nmctl since it works as expected (for me :-) ).</p>\n</blockquote>\n\n<ul>\n<li>The --restart option</li>\n</ul>\n\n<blockquote>\n  <p>Because I'm very lazy, and because OpenBSD is very simple to use, I've added the command \"nmctl --restart\" in the /etc/apm/resume script. Thanks to apmd, this script will be used each time I'm opening the lid of my laptop. \n  In other words, each time I'll opening my laptop, nmctl will search the optimum network connection for me.\n  But I had several issues in this scenario.\n  Most of the problems were linked to the arp table issues. Indeed, in some circumstances, my proxy IP address was associated to the cable interface instead of the wifi interface or vice-versa. As consequence I'm not able to connect to the proxy, thus not able to connect to internet. So the ping to google (final test nmctl perform) is failing.\n  Knowing that anyhow, I'm doing a full arp cleanup, it's not clear for me from where this problem come from. To solve this situation I've implemented a \"retry\" concept. In other words, before testing an another possible network connection (as listed in my /etc/nmctl.conf file), the script try 3x the current connection's parameters.\n  If you want to reduce or increase this figures, you can do it via the --retry parameter.</p>\n</blockquote>\n\n<ul>\n<li>Results of my expertise with this small tool</li>\n</ul>\n\n<blockquote>\n  <p>Where ever I'm located, my laptop is now connecting automatically to the wifi / cable connection previously identified for this location.\n  Currently I have 3 places where I have Wifi credentials and 2 offices places where I just have to plug the network cable.\n  Since the /etc/apm/resume scripts is triggered when I open the lid of the laptop, I just have to make sure that I plug the RJ45 before opening the laptop. For the rest, I do not have to type any commands, OpenBSD do all what is needed ;-).\n  I hotels or restaurants, I can just connect to the Open Wifi thanks to the openbox menu created by \"nmctl --scan\".</p>\n</blockquote>\n\n<ul>\n<li><p>Next steps</p></li>\n<li><p>Documentation</p></li>\n</ul>\n\n<blockquote>\n  <p>The tool is missing lot of documentation. I appreciate OpenBSD for his great documentation, so I have to do the same.\n  I plan to write a README and a man page at first instances.\n  But since my laziness, I will do it as soon as I see some interest for this tool from other persons.</p>\n</blockquote>\n\n<ul>\n<li>Tests</li>\n</ul>\n\n<blockquote>\n  <p>I now have to travel and see how to see the script react on the different situations.\n  Interested persons are welcome to share with me the outcome of their tests.\n  I'm curious how it work.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://an.undulating.space/post/180411-erl-openbsd-upgrade/\">OpenBSD 6.3 on EdgeRouter Lite simple upgrade method</a></h3>\n\n<ul>\n<li>TL;DR</li>\n</ul>\n\n<blockquote>\n  <p>OpenBSD 6.3 oceton upgrade instructions may not factor that your ERL is running from the USB key they want wiped with the miniroot63.fs image loaded on.\n  Place the bsd.rd for OpenBSD 6.3 on the sd0i slice used by U-Boot for the kernel, and then edit the boot command to run it.</p>\n</blockquote>\n\n<ul>\n<li>a tiny upgrade</li>\n</ul>\n\n<blockquote>\n  <p>The OpenBSD documentation is comprehensive, but there might be rough corners around what are probably edge cases in their user base. People running EdgeRouter Lite hardware for example, who are looking to upgrade from 6.2 to 6.3.\n  The documentation, which gave us everything we needed last time, left me with some questions about how to upgrade. In INSTALL.octeon, the Upgrading section does mention:\n  The best solution, whenever possible, is to backup your data and reinstall from scratch\n  I had to check if that directive existed in the documentation for other architectures. I wondered if oceton users were getting singled out. We were not. Just simplicity and pragmatism.</p>\n</blockquote>\n\n<ul>\n<li>Reading on:</li>\n</ul>\n\n<blockquote>\n  <p>To upgrade OpenBSD 6.3 from a previous version, start with the general instructions in the section \"Installing OpenBSD\".\n  But that section requires us to boot off of TFTP or NFS. Which I don’t want to do right now. Could also use a USB stick with the miniroot63.fs installed on it.\n  But as the ERL only has a single USB port, we would have to remove the USB stick with the current install on it. Once we get to the Install or Upgrade prompt, there would be nothing to upgrade.\n  Well, I guess I could use a USB hub. But the ERL’s USB port is inside the case. With all the screws in. And the tools are neatly put away. And I’d have to pull the USB hub from behind a workstation. And it’s two am. And I cleaned up the cabling in the lab this past weekend. Looks nice for once.\n  So I don’t want to futz around with all that.\n  There must be an almost imperceptibly easier way of doing this than setting up a TFTP server or NFS share in five minutes… Right?</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong>\n<a href=\"https://www.ixsystems.com/blog/boisetechshow-2018/\">Boise Technology Show 2018 Recap</a></p>\n\n<h3><a href=\"http://zfs.datto.com/\">OpenZFS User Conference Slides &amp; Videos</a></h3>\n\n<ul>\n<li><a href=\"https://vimeo.com/album/5150026/video/266112599\">Thank you ZFS</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266112475\">ZSTD Compression</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266111164\">Pool Layout Considerations</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266111346\">ZFS Releases</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266112077\">Helping Developers Help You</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266112233\">ZFS and MySQL on Linux</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266110985\">Micron</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266108105\">OSNEXUS</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266107946\">ZFS at Six Feet Up</a></li>\n<li><a href=\"https://vimeo.com/album/5150026/video/266107372\">Flexible Disk Use with OpenZFS</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://jvns.ca/blog/2018/05/11/batch-editing-files-with-ed/\">Batch editing files with ed</a></h3>\n\n<ul>\n<li>what’s ‘ed’?</li>\n</ul>\n\n<blockquote>\n  <p>ed is this sort of terrifying text editor. A typical interaction with ed for me in the past has gone something like this:</p>\n</blockquote>\n\n<p><code>\n$ ed\nhelp\n?\nh\n?\nasdfasdfasdfsadf\n?\n&lt;close terminal in frustration&gt;\n</code></p>\n\n<blockquote>\n  <p>Basically if you do something wrong, ed will just print out a single, unhelpful, ?. So I’d basically dismissed ed as an old arcane Unix tool that had no practical use today.\n  vi is a successor to ed, except with a visual interface instead of this ?</p>\n</blockquote>\n\n<ul>\n<li>surprise: Ed is actually sort of cool and fun</li>\n</ul>\n\n<blockquote>\n  <p>So if Ed is a terrifying thing that only prints ? at you, why am I writing a blog post about it? WELL!!!!\n  On April 1 this year, Michael W Lucas published a new short book called Ed Mastery. I like his writing, and even though it was sort of an april fool’s joke, it was ALSO a legitimate actual real book, and so I bought it and read it to see if his claims that Ed is actually interesting were true.\n  And it was so cool!!!! I found out:</p>\n</blockquote>\n\n<ul>\n<li>how to get Ed to give you better error messages than just ?</li>\n<li>that the name of the grep command comes from ed syntax (g/re/p)</li>\n<li>the basics of how to navigate and edit files using ed</li>\n</ul>\n\n<blockquote>\n  <p>All of that was a cool Unix history lesson, but did not make me want to actually use Ed in real life. But!!!</p>\n  \n  <p>The other neat thing about Ed (that did make me want to use it!) is that any Ed session corresponds to a script that you can replay! So if I know Ed, then I can use Ed basically as a way to easily apply vim-macro-like programs to my files.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://blather.michaelwlucas.com/archives/3186\">FreeBSD Mastery: Jails -- Help make it happen </a></li>\n<li><a href=\"https://www.youtube.com/watch?v=MsY-BafQgj4\">Video: OpenZFS Basics presented by George Wilson and Matt Ahrens at Scale 16x back in March 2018</a></li>\n<li><a href=\"https://www.dragonflydigest.com/2018/05/17/21257.html\">DragonFlyBSD’s IPFW gets highspeed lockless in-kernel NAT</a></li>\n<li><a href=\"https://www.reddit.com/r/openbsd/comments/8ei00k/a_love_letter_to_openbsd/\">A Love Letter to OpenBSD</a></li>\n<li><a href=\"https://blather.michaelwlucas.com/archives/3176\">New talks, and the F-bomb</a></li>\n<li><a href=\"https://manpages.bsd.lv/mdoc.html\">Practical UNIX Manuals: mdoc</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-advocacy/2018-May/004758.html\">BSD Meetup in Zurich: May 24th</a></li>\n<li><a href=\"https://www.eventbrite.com/e/the-polish-bsd-user-group-1-meetup-tickets-45941857332\">BSD Meetup in Warsaw: May 24th</a></li>\n<li><a href=\"http://meetbsd.com/\">MeetBSD 2018</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Seth - <a href=\"http://dpaste.com/12R65X4#wrap\">First time poudriere Builder</a></li>\n<li>Farhan - <a href=\"http://dpaste.com/1GHCGY5#wrap\">Why we didn't go FreeBSD</a></li>\n<li>architech - <a href=\"http://dpaste.com/1H72FGE#wrap\">Encryption Feedback</a></li>\n<li>Dave - <a href=\"http://dpaste.com/27YH93Y#wrap\">Handy Tip on setting up automated coredump handling for FreeBSD</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"FreeBSD internship learnings, exciting developments coming to FreeBSD, running FreeNAS on DigitalOcean, Network Manager control for OpenBSD, OpenZFS User Conference Videos are here and batch editing files with ed.","date_published":"2018-05-24T15:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/31bf045b-2e53-459e-a40e-993a51ceccdb.mp3","mime_type":"audio/mp3","size_in_bytes":54062460,"duration_in_seconds":5399}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1954","title":"Episode 246: Properly Coordinated Disclosure | BSD Now 246","url":"https://www.bsdnow.tv/246","content_text":"How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.\n\nHeadlines\n\nIntel documentation flaw sees instruction misimplemented in almost every OS\n\n\n  A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.\n  OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. \n  + A detailed white paper describes this behavior here\n  + FreeBSD Commit\n  Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.\n  Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.\n  + FreeBSD Security Advisory\n  + DragonFlyBSD Post\n  + NetBSD does not support debug register and so is not affected.\n  + OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”\n  + IllumOS Not Impacted\n\n\n\n\nGuest Post – A Look at SDN Emulator Mininet\n\n\nA guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe\n\n\n\n  At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.\n  Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)\n  I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.\n  Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.\n  Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.\n  I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.\n  This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.\n  In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.\n  Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.\n  If you want to see the OpenBSD version of the talk, the video from AsiaBSDCon is here, and it will be presented again at BSDCan.\n  \n  \n\n\n**iXsystems**\n[iXsystems LFNW Recap](https://www.ixsystems.com/blog/lfnw-2018-recap/)\n\n\n\n\n\n\n\n\n10 Beginner Do's and Don't for FreeBSD\n\n\n1) Don't mix ports and binary packages\n2) Don't edit 'default' files\n3) Don't mess with /etc/crontab\n4) Don't mess with /etc/passwd and /etc/groups either!\n5) Reconsider the removal of any options from your customized kernel configuration\n6) Don't change the root shell to something else\n7) Don't use the root user all the time\n8) /var/backups is a thing\n9) Check system integrity using /etc/mtree\n10) What works for me doesn't have to work for you!\n\n\n\n\nNews Roundup\n\nOpenBSD Community Goes Gold for 2018!\n\n\nKen Westerback (krw@ when wearing his developer hat) writes:\n\n\n```\nMonthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!\n\n2018 is the third consecutive year that the community has reached Gold status or better.\n\nThese monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.\n\nSign up now for a monthly donation!\n\nNote that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.\n\nhttps://www.openbsdfoundation.org/donations.html\n```\n\n\n\ned(1) mastery is a must read for real unix people\n\n\n  In some circles on the Internet, your choice of text editor is a serious matter.\n  \n  We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.\n  \n  And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.\n  \n  Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.\n  \n  But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.\n  \n  Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.\n  \n  To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.\n\n\n\n\nDigitalOcean\nDigital Ocean Promo Link for BSD Now Listeners\n\n\n\nDistributed Object Storage with Minio on FreeBSD\n\n\n  Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.\n\n\n\nArchitecture Diagram \n\n\nThe Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.\n\n\nSetup\n\n\n\n  The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.\n\n\n\nJails\n\n\n\n  First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.\n\n\n\nWeI know the FreeNAS people have been working on integrating this\n\n\n\n\nBest practises for pledge(2) security\n\n\n  Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.\n\n\n\nTheory\n\n\n\n  Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).\n  \n  How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.\n  \n  Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.\n\n\n\n\nBeastie Bits\n\n\nApril's London *BSD meetup - notes\nMay’s London *BSD Meetup: May 22nd \nCall for Papers for EuroBSDcon 2018\nFreeBSD Journal March/April Desktop/Laptop issue\nLWN followup on the PostgreSQL fsync() issue\nThe Association for Computing Machinery recognizes Steve Bourne for outstanding contributions\n\n\n\n\nFeedback/Questions\n\n\nRay - Speaking at Conferences\nCasey - Questions\nJeremy - zfs in the enterprise\nHAST + ZFS\nLars - Civil Infrastructure Platform use of *BSD\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html\">Intel documentation flaw sees instruction misimplemented in almost every OS</a></h3>\n\n<blockquote>\n  <p>A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.\n  OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. \n  + A detailed white paper describes this behavior <a href=\"http://everdox.net/popss.pdf\">here</a>\n  + <a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=333368\">FreeBSD Commit</a>\n  Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.\n  Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.\n  + <a href=\"https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc\">FreeBSD Security Advisory</a>\n  + <a href=\"https://www.dragonflydigest.com/2018/05/09/21231.html\">DragonFlyBSD Post</a>\n  + <a href=\"https://www.kb.cert.org/vuls/id/CHEU-AYC3MZ\">NetBSD does not support debug register and so is not affected.</a>\n  + <a href=\"https://www.kb.cert.org/vuls/id/CHEU-AYC3MR\">OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”</a>\n  + <a href=\"https://illumos.topicbox.com/groups/developer/T9cd475bd5497caa9\">IllumOS Not Impacted</a></p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.freebsdfoundation.org/blog/guest-post-a-look-at-sdn-emulator-mininet/\">Guest Post – A Look at SDN Emulator Mininet</a></h3>\n\n<ul>\n<li>A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe\n\n\n<blockquote>\n  At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.\n  Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)\n  I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.\n  Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.\n  Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.\n  I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.\n  This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.\n  In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.</li>\n  <li>Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.</li>\n  <li>If you want to see the OpenBSD version of the talk, the video from <a href=\"https://www.youtube.com/watch?v=Vg9Czjm9aV8\">AsiaBSDCon is here</a>, and it will be presented again at BSDCan.</li>\n  </ul>\n  <hr />\n</blockquote>\n\n**iXsystems**\n[iXsystems LFNW Recap](https://www.ixsystems.com/blog/lfnw-2018-recap/)\n\n\n<hr />\n\n\n\n\n\n<h3><a href=\"https://forums.freebsd.org/threads/10-dos-and-dont-for-freebsd.65618/\">10 Beginner Do's and Don't for FreeBSD</a></h3>\n\n<ul>\n<li>1) Don't mix ports and binary packages</li>\n<li>2) Don't edit 'default' files</li>\n<li>3) Don't mess with /etc/crontab</li>\n<li>4) Don't mess with /etc/passwd and /etc/groups either!</li>\n<li>5) Reconsider the removal of any options from your customized kernel configuration</li>\n<li>6) Don't change the root shell to something else</li>\n<li>7) Don't use the root user all the time</li>\n<li>8) /var/backups is a thing</li>\n<li>9) Check system integrity using /etc/mtree</li>\n<li>10) What works for me doesn't have to work for you!</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20180419060427\">OpenBSD Community Goes Gold for 2018!</a></h3>\n\n<ul>\n<li>Ken Westerback (krw@ when wearing his developer hat) writes:</li>\n</ul>\n\n<p>```\nMonthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!</p>\n\n<p>2018 is the third consecutive year that the community has reached Gold status or better.</p>\n\n<p>These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.</p>\n\n<p>Sign up now for a monthly donation!</p>\n\n<p>Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.</p>\n\n<p>https://www.openbsdfoundation.org/donations.html\n```</p>\n\n<p><hr /></p>\n\n<h3><a href=\"http://bsdly.blogspot.com/2018/04/ed1-mastery-is-must-for-real-unix-person.html\">ed(1) mastery is a must read for real unix people</a></h3>\n\n<blockquote>\n  <p>In some circles on the Internet, your choice of text editor is a serious matter.</p>\n  \n  <p>We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.</p>\n  \n  <p>And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.</p>\n  \n  <p>Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.</p>\n  \n  <p>But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.</p>\n  \n  <p>Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.</p>\n  \n  <p>To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong>\n<a href=\"http://do.co/bsdnow\">Digital Ocean Promo Link for BSD Now Listeners</a></p>\n\n<p><hr /></p>\n\n<h3><a href=\"https://vermaden.wordpress.com/2018/04/16/distributed-object-storage-with-minio-on-freebsd/\">Distributed Object Storage with Minio on FreeBSD</a></h3>\n\n<blockquote>\n  <p>Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://vermaden.files.wordpress.com/2018/04/minio-architecture-diagram-distributed.jpg?w=960\">Architecture Diagram </a></li>\n</ul>\n\n<p>The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.</p>\n\n<ul>\n<li>Setup</li>\n</ul>\n\n<blockquote>\n  <p>The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.</p>\n</blockquote>\n\n<ul>\n<li>Jails</li>\n</ul>\n\n<blockquote>\n  <p>First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.</p>\n</blockquote>\n\n<ul>\n<li>WeI know the FreeNAS people have been working on integrating this</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://kristaps.bsd.lv/kcgi/tutorial6.html\">Best practises for pledge(2) security</a></h3>\n\n<blockquote>\n  <p>Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.</p>\n</blockquote>\n\n<ul>\n<li>Theory</li>\n</ul>\n\n<blockquote>\n  <p>Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).</p>\n  \n  <p>How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.</p>\n  \n  <p>Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-April/014194.html\">April's London *BSD meetup - notes</a></li>\n<li><a href=\"http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-May/014198.html\">May’s London *BSD Meetup: May 22nd </a></li>\n<li><a href=\"https://2018.eurobsdcon.org/call-for-papers/\">Call for Papers for EuroBSDcon 2018</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/journal/\">FreeBSD Journal March/April Desktop/Laptop issue</a></li>\n<li><a href=\"https://lwn.net/Articles/752063/\">LWN followup on the PostgreSQL fsync() issue</a></li>\n<li><a href=\"https://awards.acm.org/outstanding-contribution\">The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Ray - <a href=\"http://dpaste.com/1F8RX6H#wrap\">Speaking at Conferences</a></li>\n<li>Casey - <a href=\"http://dpaste.com/364FTMM#wrap\">Questions</a></li>\n<li>Jeremy - <a href=\"http://dpaste.com/3GWHP9N#wrap\">zfs in the enterprise</a>\n<ul><li><a href=\"https://wiki.freebsd.org/HAST\">HAST + ZFS</a></li></ul></li>\n<li>Lars - <a href=\"http://dpaste.com/1HDZFA3\">Civil Infrastructure Platform use of *BSD</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.","date_published":"2018-05-17T01:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/ef0afdeb-1a67-441c-9317-8405a2572cd6.mp3","mime_type":"audio/mp3","size_in_bytes":54017115,"duration_in_seconds":5394}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1913","title":"Episode 245: ZFS User Conf 2018 | BSD Now 245","url":"https://www.bsdnow.tv/245","content_text":"Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.\n\n\nHeadlines\n\nZFS User Conference Recap\n\n\nAttendees met for breakfast on the fourth floor, in a lunchroom type area just outside of the theatre. One entire wall was made of lego base plates, and there were buckets of different coloured lego embedded in the wall.\nThe talks started with Matt Ahrens discussing how the 2nd most requested feature of ZFS, Device Removal, has now landed, then pivoting into the MOST requested feature, RAID-Z expansion, and his work on that so far, which included the first functional prototype, on FreeBSD.\nThen our friend Calvin Hendryx-Parker presented how he solves all of his backup headaches with ZFS. I provided him some helpful hints to optimize his setup and improve the throughput of his backups\nThen Steven Umbehocker of OSNEXUS talked about their products, and how they manage large numbers of ZFS nodes\nAfter a very nice lunch, Orlando Pichardo of Micron talked about the future of flash, and their new 7.5TB SATA SSDs. Discussion of these devices after the talk may lead to enhancements to ZFS to better support these new larger flash devices that use larger logical sector sizes.\nAlek Pinchuk of Datto talked about Pool Layout Considerations\nthen Tony Hutter of LLNL talked about the release process for ZFS on Linux\nThen Tom Caputi of Datto presented: Helping Developers Help You, guidance for users submitting bug reports, with some good and bad examples\nThen we had a nice cocktail party and dinner, and stayed late into the night talked about ZFS\nThe next day, Jervin Real of Percona, presented: ZFS and MySQL on Linux, the Sweet Spots. Mostly outlining some benchmark they had done, some of the results were curious and some additional digging may turn up enhancements that can be made to ZFS, or just better tuning advice for high traffic MySQL servers.\nThen I presented my ZSTD compression work, which had been referenced in 2 of the previous talks, as people are anxious to get their hands on this code.\nLastly, Eric Sproul of Circonus, gave his talk: Thank You, ZFS. It thanked ZFS and its Community for making their companies product possible, and then provided an update to his presentation from last year, where they were having problems with extremely high levels of ZFS fragmentation. This also sparked a longer conversation after the talk was over.\nThen we had a BBQ lunch, and after some more talking, the conference broke up.\n\n\n\n\nInitial OmniOS impressions by a BSD user\n\n\n  I had been using FreeBSD as my main web server OS since 2012 and I liked it so much that I even contributed money and code to it. However, since the FreeBSD guys (and gals) decided to install anti-tech feminism, I have been considering to move away from it for quite some time now.\n  \n  As my growing needs require stronger hardware, it was finally time to rent a new server. I do not intend to run FreeBSD on it. Although the most obvious choice would be OpenBSD (I run it on another server and it works just fine), I plan to have a couple of databases running on the new machine, and database throughput has never been one of OpenBSD's strong points. This is my chance to give illumos another try. As neither WiFi nor desktop environments are relevant on a no-X11 server, the server-focused OmniOS seemed to fit my needs.\n  \n  My current (to be phased out) setup on FreeBSD is:\n\n\n\napache24 with SSL support, running five websites on six domains (both HTTP and HTTPS)\na (somewhat large) Tiny Tiny RSS installation from git, updated via cronjob\nsbcl running a daily cronjob of my Web-to-RSS parser\nan FTP server where I share stuff with friends\nan IRC bouncer\nMariaDB and PostgreSQL for some of the hosted services\n\n\n\n  I would not consider anything of that too esoteric for a modern operating system. Since I was not really using anything mod_rewrite-related, I was perfectly ready to replace apache24 by nginx, remembering that the prepackaged apache24 on FreeBSD did not support HTTPS out of the box and I had ended up installing it from the ports. That is the only change in my setup which I am actively planning.\n  \n  So here's what I noticed.\n\n\n\nFirst impressions:\n\n\n\n  Hooray, a BSD boot loader! Finally an operating system without grub - I made my experiences with that and I don't want to repeat them too often.\n  \n  It is weird that the installer won't accept \"mydomain.org\" as a hostname but sendmail complains that \"mydomain\" is not a valid hostname right from the start, OmniOS sent me into Maintenance Mode to fix that. A good start, right? So the first completely new thing I had to find out on my new shiny toy was how to change the hostname. There is no /etc/rc.conf in it and hostname mydomain.org was only valid for one login session. I found out that the hostname has to be changed in three different files under /etc on Solaris - the third one did not even exist for me. Changing the other two files seems to have solved this problem for me.\n\n\n\nRandom findings:\n\n\n\n  ~ I was wondering how many resources my (mostly idle) new web server was using - I always thought Solaris was rather fat, but it still felt fast to me.\n  \n  Ah, right - we're in Unixland and we need to think outside of the box. This table was really helpful: although a number of things are different between OmniOS and SmartOS, I found out that the *stat tools do what top does. I could probably just install top from one of the package managers, but I failed to find a reason to do so. I had 99% idle CPU and RAM - that's all I wanted to know.\n  \n  ~ Trying to set up twtxt informed me that Python 3.6 (from pkgin) expects LANG and LC_ALL to be set. Weird - did FreeBSD do that for me? It's been a while ... at least that was easy to fix.\n  \n  ~ SMF - Solaris's version of init - confuses me. It has \"levels\" similar to Gentoo's OpenRC, but it mostly shuts up during the boot process. Stuff from pkgsrc, e.g. nginx, comes with a description how to set up the particular service, but I should probably read more about it. What if, one day, I install a package which is not made ready for OmniOS? I'll have to find out how to write SMF scripts. But that should not be my highest priority.\n  \n  ~ The OmniOS documentation talks a lot about \"zones\" which, if I understand that correctly, mostly equal FreeBSD's \"jails\". This could be my chance to try to respect a better separation between my various services - if my lazyness won't take over again. (It probably will.)\n  \n  ~ OmniOS's default shell - rather un-unixy - seems to be the bash. Update: I was informed about a mistake here: the default shell is ksh93, there are bogus .bashrc files lying around though.\n  \n  ~ Somewhere in between, my sshd had a hiccup or, at least, logging into it took longer than usual. If that happens again, I should investigate.\n\n\n\nConclusion:\n\n\n\n  By the time of me writing this, I have a basic web server with an awesome performance and a lot of applications ready to be configured only one click away. The more I play with it, the more I have the feeling that I have missed a lot while wasting my time with FreeBSD. For a system that is said to be \"dying\", OmniOS feels well-thought and, when equipped with a reasonable package management, comes with everything I need to reproduce my FreeBSD setup without losing functionality.\n  \n  I'm looking forward to what will happen with it.\n\n\n\n\nDigitalOcean\nhttp://do.co/bsdnow\n\n[Open Source Hardware Camp 2018 — Sat 30/06 &amp; Sun 01/07, Lincoln, UK\n\n(includes 'Open-source RISC-V core quickstart' and 'An introductory workshop to NetBSD on embedded platforms')](http://oshug.org/pipermail/oshug/2018-April/000635.html)\n\n```\nHi All,\n\nI'm pleased to announce that we have 10 talks and 7 workshops confirmed\nfor Open Source Hardware Camp 2018, with the possibility of one or two\nmore. Registration is now open!\n\nFor the first time ever we will be hosting OSHCamp in Lincoln and a huge\nthanks to Sarah Markall for helping to make this happen.\n\nAs in previous years, there will be a social event on the Saturday\nevening and we have a room booked at the Wig and Mitre. Food will be\navailable.\n\nThere will likely be a few of us meeting up for pre-conference drinks on\nthe Friday evening also.\n\nDetails of the programme can be found below and, as ever, we have an\nexcellent mix of topics being covered.\n\nCheers,\n\nAndrew\n```\n\n\nOpen Source Hardware Camp 2018\n\n\n\n  On the 30th June 2018, 09:00 Saturday morning - 16:00 on the Sunday\n  afternoon at The Blue Room, The Lawn, Union Rd, Lincoln, LN1 3BU.\n\n\n\nRegistration: http://oshug.org/event/oshcamp2018\nOpen Source Hardware Camp 2018 will be hosted in the historic county\ntown of Lincoln — home to, amongst others, noted engine builders Ruston\n&amp; Hornsby (now Siemens, via GEC and English Electric).\nLincoln is well served by rail, reachable from Leeds and London within\n2-2.5 hours, and 4-5 hours from Edinburgh and Southampton.\nThere will be a social at the Wig and Mitre on the Saturday evening.\nFor travel and accommodation information information please see the\nevent page on oshug.org.\n\n\n\n\nNews Roundup\n\nNextcloud 13 on FreeBSD\n\n\n  Today I would like to share a setup of Nextcloud 13 running on a FreeBSD system. To make things more interesting it would be running inside a FreeBSD Jail. I will not describe the Nextcloud setup itself here as its large enough for several blog posts.\n  \n  Official Nextcloud 13 documentation recommends following setup:\n\n\n\nMySQL/MariaDB\nPHP 7.0 (or newer)\nApache 2.4 (with mod_php)\n\n\n\n  I prefer PostgreSQL database to MySQL/MariaDB and I prefer fast and lean Nginx web server to Apache, so my setup is based on these components:\n\n\n\nPostgreSQL 10.3\nPHP 7.2.4\nNginx 1.12.2 (with php-fpm)\nMemcached 1.5.7\n\n\n\n  The Memcached subsystem is least important, it can be easily changed into something more modern like Redis for example. I prefer not to use any third party tools for FreeBSD Jails management. Not because they are bad or something like that. There are just many choices for good FreeBSD Jails management and I want to provide a GENERIC example for Nextcloud 13 in a Jail, not for a specific management tool.\n\n\n\nHost\n\n\n\n  Lets start with preparing the FreeBSD Host with needed settings. We need to allow using raw sockets in Jails. For the future optional upgrades of the Jail we will also allow using chflags(1) in Jails.\n\n\n\n\nOpenBSD on my fanless desktop computer\n\n\n  You asked me about my setup. Here you go.\n  \n  I’ve been using OpenBSD on servers for years as a web developer, but never had a chance to dive in to system administration before. If you appreciate the simplicity of OpenBSD and you have to give it a try on your desktop.\n  \n  Bear in mind, this is a relatively cheap ergonomic setup, because all I need is xterm(1) with Vim and Firefox, I don’t care about CPU/GPU performance or mobility too much, but I want a large screen and a good keyboard.\n\n\n\nItem                                    Price, USD\nZotac CI527 NANO-BE                        $371\n16GB RAM Crucial DDR4-2133                    $127\n250GB SSD Samsung 850 EVO                    $104\nAsus VZ249HE 23.8\" IPS Full HD                    $129\nErgoDox EZ V3, Cherry MX Brown, blank DCS            $325\nKensington Orbit Trackball                        $33\nTotal                                    $1,107\n\n\n\nOpenBSD\n\n\n\n  I tried few times to install OpenBSD on my MacBooks—I heard some models are compatible with it,—but in my case it was a bit of a fiasco (thanks to Nvidia and Broadcom). That’s why I bought a new computer, just to be able to run this wonderful operating system.\n  \n  Now I run -stable on my desktop and servers. Servers are supposed to be reliable, that’s obvious, why not run -current on a desktop? Because -stable is shipped every six months and I that’s is often enough for me. I prefer slow fashion.\n\n\n\n\niXsystems\niX Ad Spot NAB 2018 – Michael Dexter’s Recap\n\nIntroduction to HardenedBSD World\n\n\n  HardenedBSD is a security enhanced fork of FreeBSD which happened in 2014. HardenedBSD is implementing many exploit mitigation and security technologies on top of FreeBSD which all started with implementation of Address Space Layout Randomization (ASLR). The fork has been created for ease of development.\n  \n  To cite the https://hardenedbsd.org/content/about page – “HardenedBSD aims to implement innovative exploit mitigation and security solutions for the FreeBSD community. (…) HardenedBSD takes a holistic approach to security by hardening the system and implementing exploit mitigation technologies.”\n  \n  Most FreeBSD enthusiasts know mfsBSD project by Martin Matuska – http://mfsbsd.vx.sk/ – FreeBSD system loaded completely into memory. The mfsBSD synonym for the HardenedBSD world is SoloBSD – http://www.solobsd.org/ – which is based on HardenedBSD sources.\n  \n  One may ask how HardenedBSD project compared to more well know for its security OpenBSD system and it is very important question. The OpenBSD developers try to write ‘good’ code without dirty hacks for performance or other reasons. Clean and secure code is most important in OpenBSD world. The OpenBSD project even made security audit of all OpenBSD code available, line by line. This was easier to achieve in FreeBSD or HardenedBSD because OpenBSD code base its about ten times smaller. This has also other implications, possibilities. While FreeBSD (and HardenedBSD) offer many new features like mature SMP subsystem even with some NUMA support, ZFS filesystem, GEOM storage framework, Bhyve virtualization, Virtualbox option and many other new modern features the OpenBSD remains classic UNIX system with UFS filesystem and with very ‘theoretical’ SMP support. The vmm project tried to implement new hypervisor in OpenBSD world, but because of lack of support for graphics its for OpenBSD, Illumos and Linux currently, You will not virtualize Windows or Mac OS X there. This is also only virtualization option for OpenBSD as there are no Jails on OpenBSD. Current Bhyve implementation allows one even to boot latest Windows 2019 Technology Preview.\n  \n  A HardenedBSD project is FreeBSD system code base with LOTS of security mechanisms and mitigations that are not available on FreeBSD system. For example entire lib32 tree has been disabled by default on HardenedBSD to make it more secure. Also LibreSSL is the default SSL library on HardenedBSD, same as OpenBSD while FreeBSD uses OpenSSL for compatibility reasons.\n  \n  Comparison between LibreSSL and OpenSSL vulnerabilities.\n\n\n\nhttps://en.wikipedia.org/wiki/LibreSSL#Security\nhttps://wiki.freebsd.org/LibreSSL#LibreSSL.28andOpenSSL.29SecurityVulnerabilities\n\n\n\n  One may see HardenedBSD as FreeBSD being successfully pulled up to the OpenBSD level (at least that is the goal), but as FreeBSD has tons more code and features it will be harder and longer process to achieve the goal.\n  \n  As I do not have that much competence on the security field I will just repost the comparison from the HardenedBSD project versus other BSD systems. The comparison is also available here – https://hardenedbsd.org/content/easy-feature-comparison – on the HardenedBSD website.\n\n\n\n\nRunning my own git server\n\n\n  Note: This article is predominantly based on work by Hiltjo Posthuma who you should read because I would have spent far too much time failing to set things up if it wasn’t for their post. Not only have they written lots of very interesting posts, they write some really brilliant programs\n  \n  Since I started university 3 years ago, I started using lots of services from lots of different companies. The “cloud” trend led me to believe that I wanted other people to look after my data for me. I was wrong. Since finding myself loving the ethos of OpenBSD, I found myself wanting to apply this ethos to the services I use as well. Not only is it important to me because of the security benefits, but also because I like the minimalist style OpenBSD portrays. This is the first in a mini-series documenting my move from bloated, hosted, sometimes proprietary services to minimal, well-written, free, self-hosted services.\n\n\n\nTools &amp; applications\n\n\n\n  These are the programs I am going to be using to get my git server up and running:\n\n\n\nhttpd(8)\nacme-client(1)\ngit(1)\ncgit(1)\nslowcgi(8)\n\n\n\nSetting up httpd\n\n\n\n  Ensure you have the necessary flags enabled in your /etc/rc.conf.local:\n\n\n\nConfiguring cgit\n\n\n\n  When using the OpenBSD httpd(8), it will serve it’s content in a chrooted environment,which defaults to the home directory of the user it runs as, which is www in this case. This means that the chroot is limited to the directory /var/www and it’s contents.\n  \n  In order to configure cgit, there must be a cgitrc file available to cgit. This is found at the location stored in $CGIT_CONFIG, which defaults to /conf/cgitrc. Because of the chroot, this file is actually stored at /var/www/conf/cgitrc.\n\n\n\n\nBeastie Bits\n\n\nMy Penguicon 2018 Schedule\nsigaction: see who killed you (and more)\nTakeshi steps down from NetBSD core team after 13 years\nDragonFlyBSD Kernel Gets Some SMP Improvements – Phoronix\nWriting FreeBSD Malware\n\n\nTarsnap ad\n\nFeedback/Questions\n\n\nTroels - Question regarding ZFS xattr\nMike - Sharing your screen\nWilyarti - Adlocking on FreeBSD\nBrad - Recommendations for snapshot strategy\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.<br>\n<hr /></p>\n\n<h2>Headlines</h2>\n\n<h3>ZFS User Conference Recap</h3>\n\n<ul>\n<li>Attendees met for breakfast on the fourth floor, in a lunchroom type area just outside of the theatre. One entire wall was made of lego base plates, and there were buckets of different coloured lego embedded in the wall.</li>\n<li>The talks started with Matt Ahrens discussing how the 2nd most requested feature of ZFS, Device Removal, has now landed, then pivoting into the MOST requested feature, RAID-Z expansion, and his work on that so far, which included the first functional prototype, on FreeBSD.</li>\n<li>Then our friend Calvin Hendryx-Parker presented how he solves all of his backup headaches with ZFS. I provided him some helpful hints to optimize his setup and improve the throughput of his backups</li>\n<li>Then Steven Umbehocker of OSNEXUS talked about their products, and how they manage large numbers of ZFS nodes</li>\n<li>After a very nice lunch, Orlando Pichardo of Micron talked about the future of flash, and their new 7.5TB SATA SSDs. Discussion of these devices after the talk may lead to enhancements to ZFS to better support these new larger flash devices that use larger logical sector sizes.</li>\n<li>Alek Pinchuk of Datto talked about Pool Layout Considerations</li>\n<li>then Tony Hutter of LLNL talked about the release process for ZFS on Linux</li>\n<li>Then Tom Caputi of Datto presented: Helping Developers Help You, guidance for users submitting bug reports, with some good and bad examples</li>\n<li>Then we had a nice cocktail party and dinner, and stayed late into the night talked about ZFS</li>\n<li>The next day, Jervin Real of Percona, presented: ZFS and MySQL on Linux, the Sweet Spots. Mostly outlining some benchmark they had done, some of the results were curious and some additional digging may turn up enhancements that can be made to ZFS, or just better tuning advice for high traffic MySQL servers.</li>\n<li>Then I presented my ZSTD compression work, which had been referenced in 2 of the previous talks, as people are anxious to get their hands on this code.</li>\n<li>Lastly, Eric Sproul of Circonus, gave his talk: Thank You, ZFS. It thanked ZFS and its Community for making their companies product possible, and then provided an update to his presentation from last year, where they were having problems with extremely high levels of ZFS fragmentation. This also sparked a longer conversation after the talk was over.</li>\n<li>Then we had a BBQ lunch, and after some more talking, the conference broke up.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.linuxquestions.org/questions/solaris-opensolaris-20/initial-omnios-impressions-by-a-bsd-user-4175626757/\">Initial OmniOS impressions by a BSD user</a></h3>\n\n<blockquote>\n  <p>I had been using FreeBSD as my main web server OS since 2012 and I liked it so much that I even contributed money and code to it. However, since the FreeBSD guys (and gals) decided to install anti-tech feminism, I have been considering to move away from it for quite some time now.</p>\n  \n  <p>As my growing needs require stronger hardware, it was finally time to rent a new server. I do not intend to run FreeBSD on it. Although the most obvious choice would be OpenBSD (I run it on another server and it works just fine), I plan to have a couple of databases running on the new machine, and database throughput has never been one of OpenBSD's strong points. This is my chance to give illumos another try. As neither WiFi nor desktop environments are relevant on a no-X11 server, the server-focused OmniOS seemed to fit my needs.</p>\n  \n  <p>My current (to be phased out) setup on FreeBSD is:</p>\n</blockquote>\n\n<ul>\n<li>apache24 with SSL support, running five websites on six domains (both HTTP and HTTPS)</li>\n<li>a (somewhat large) Tiny Tiny RSS installation from git, updated via cronjob</li>\n<li>sbcl running a daily cronjob of my Web-to-RSS parser</li>\n<li>an FTP server where I share stuff with friends</li>\n<li>an IRC bouncer</li>\n<li>MariaDB and PostgreSQL for some of the hosted services</li>\n</ul>\n\n<blockquote>\n  <p>I would not consider anything of that too esoteric for a modern operating system. Since I was not really using anything mod_rewrite-related, I was perfectly ready to replace apache24 by nginx, remembering that the prepackaged apache24 on FreeBSD did not support HTTPS out of the box and I had ended up installing it from the ports. That is the only change in my setup which I am actively planning.</p>\n  \n  <p>So here's what I noticed.</p>\n</blockquote>\n\n<ul>\n<li>First impressions:</li>\n</ul>\n\n<blockquote>\n  <p>Hooray, a BSD boot loader! Finally an operating system without grub - I made my experiences with that and I don't want to repeat them too often.</p>\n  \n  <p>It is weird that the installer won't accept \"mydomain.org\" as a hostname but sendmail complains that \"mydomain\" is not a valid hostname right from the start, OmniOS sent me into Maintenance Mode to fix that. A good start, right? So the first completely new thing I had to find out on my new shiny toy was how to change the hostname. There is no /etc/rc.conf in it and hostname mydomain.org was only valid for one login session. I found out that the hostname has to be changed in three different files under /etc on Solaris - the third one did not even exist for me. Changing the other two files seems to have solved this problem for me.</p>\n</blockquote>\n\n<ul>\n<li>Random findings:</li>\n</ul>\n\n<blockquote>\n  <p>~ I was wondering how many resources my (mostly idle) new web server was using - I always thought Solaris was rather fat, but it still felt fast to me.</p>\n  \n  <p>Ah, right - we're in Unixland and we need to think outside of the box. This table was really helpful: although a number of things are different between OmniOS and SmartOS, I found out that the *stat tools do what top does. I could probably just install top from one of the package managers, but I failed to find a reason to do so. I had 99% idle CPU and RAM - that's all I wanted to know.</p>\n  \n  <p>~ Trying to set up twtxt informed me that Python 3.6 (from pkgin) expects LANG and LC_ALL to be set. Weird - did FreeBSD do that for me? It's been a while ... at least that was easy to fix.</p>\n  \n  <p>~ SMF - Solaris's version of init - confuses me. It has \"levels\" similar to Gentoo's OpenRC, but it mostly shuts up during the boot process. Stuff from pkgsrc, e.g. nginx, comes with a description how to set up the particular service, but I should probably read more about it. What if, one day, I install a package which is not made ready for OmniOS? I'll have to find out how to write SMF scripts. But that should not be my highest priority.</p>\n  \n  <p>~ The OmniOS documentation talks a lot about \"zones\" which, if I understand that correctly, mostly equal FreeBSD's \"jails\". This could be my chance to try to respect a better separation between my various services - if my lazyness won't take over again. (It probably will.)</p>\n  \n  <p>~ OmniOS's default shell - rather un-unixy - seems to be the bash. Update: I was informed about a mistake here: the default shell is ksh93, there are bogus .bashrc files lying around though.</p>\n  \n  <p>~ Somewhere in between, my sshd had a hiccup or, at least, logging into it took longer than usual. If that happens again, I should investigate.</p>\n</blockquote>\n\n<ul>\n<li>Conclusion:</li>\n</ul>\n\n<blockquote>\n  <p>By the time of me writing this, I have a basic web server with an awesome performance and a lot of applications ready to be configured only one click away. The more I play with it, the more I have the feeling that I have missed a lot while wasting my time with FreeBSD. For a system that is said to be \"dying\", OmniOS feels well-thought and, when equipped with a reasonable package management, comes with everything I need to reproduce my FreeBSD setup without losing functionality.</p>\n  \n  <p>I'm looking forward to what will happen with it.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong>\nhttp://do.co/bsdnow</p>\n\n<h3>[Open Source Hardware Camp 2018 — Sat 30/06 &amp; Sun 01/07, Lincoln, UK</h3>\n\n<p>(includes 'Open-source RISC-V core quickstart' and 'An introductory workshop to NetBSD on embedded platforms')](http://oshug.org/pipermail/oshug/2018-April/000635.html)</p>\n\n<p>```\nHi All,</p>\n\n<p>I'm pleased to announce that we have 10 talks and 7 workshops confirmed\nfor Open Source Hardware Camp 2018, with the possibility of one or two\nmore. Registration is now open!</p>\n\n<p>For the first time ever we will be hosting OSHCamp in Lincoln and a huge\nthanks to Sarah Markall for helping to make this happen.</p>\n\n<p>As in previous years, there will be a social event on the Saturday\nevening and we have a room booked at the Wig and Mitre. Food will be\navailable.</p>\n\n<p>There will likely be a few of us meeting up for pre-conference drinks on\nthe Friday evening also.</p>\n\n<p>Details of the programme can be found below and, as ever, we have an\nexcellent mix of topics being covered.</p>\n\n<p>Cheers,</p>\n\n<p>Andrew\n```</p>\n\n<ul>\n<li>Open Source Hardware Camp 2018</li>\n</ul>\n\n<blockquote>\n  <p>On the 30th June 2018, 09:00 Saturday morning - 16:00 on the Sunday\n  afternoon at The Blue Room, The Lawn, Union Rd, Lincoln, LN1 3BU.</p>\n</blockquote>\n\n<ul>\n<li>Registration: http://oshug.org/event/oshcamp2018</li>\n<li>Open Source Hardware Camp 2018 will be hosted in the historic county\ntown of Lincoln — home to, amongst others, noted engine builders Ruston\n&amp; Hornsby (now Siemens, via GEC and English Electric).</li>\n<li>Lincoln is well served by rail, reachable from Leeds and London within\n2-2.5 hours, and 4-5 hours from Edinburgh and Southampton.</li>\n<li>There will be a social at the Wig and Mitre on the Saturday evening.</li>\n<li>For travel and accommodation information information please see the\nevent page on oshug.org.</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://vermaden.wordpress.com/2018/04/04/nextcloud-13-on-freebsd/\">Nextcloud 13 on FreeBSD</a></h3>\n\n<blockquote>\n  <p>Today I would like to share a setup of Nextcloud 13 running on a FreeBSD system. To make things more interesting it would be running inside a FreeBSD Jail. I will not describe the Nextcloud setup itself here as its large enough for several blog posts.</p>\n  \n  <p>Official Nextcloud 13 documentation recommends following setup:</p>\n</blockquote>\n\n<ul>\n<li>MySQL/MariaDB</li>\n<li>PHP 7.0 (or newer)</li>\n<li>Apache 2.4 (with mod_php)</li>\n</ul>\n\n<blockquote>\n  <p>I prefer PostgreSQL database to MySQL/MariaDB and I prefer fast and lean Nginx web server to Apache, so my setup is based on these components:</p>\n</blockquote>\n\n<ul>\n<li>PostgreSQL 10.3</li>\n<li>PHP 7.2.4</li>\n<li>Nginx 1.12.2 (with php-fpm)</li>\n<li>Memcached 1.5.7</li>\n</ul>\n\n<blockquote>\n  <p>The Memcached subsystem is least important, it can be easily changed into something more modern like Redis for example. I prefer not to use any third party tools for FreeBSD Jails management. Not because they are bad or something like that. There are just many choices for good FreeBSD Jails management and I want to provide a GENERIC example for Nextcloud 13 in a Jail, not for a specific management tool.</p>\n</blockquote>\n\n<ul>\n<li>Host</li>\n</ul>\n\n<blockquote>\n  <p>Lets start with preparing the FreeBSD Host with needed settings. We need to allow using raw sockets in Jails. For the future optional upgrades of the Jail we will also allow using chflags(1) in Jails.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.romanzolotarev.com/setup.html\">OpenBSD on my fanless desktop computer</a></h3>\n\n<blockquote>\n  <p>You asked me about my setup. Here you go.</p>\n  \n  <p>I’ve been using OpenBSD on servers for years as a web developer, but never had a chance to dive in to system administration before. If you appreciate the simplicity of OpenBSD and you have to give it a try on your desktop.</p>\n  \n  <p>Bear in mind, this is a relatively cheap ergonomic setup, because all I need is xterm(1) with Vim and Firefox, I don’t care about CPU/GPU performance or mobility too much, but I want a large screen and a good keyboard.</p>\n</blockquote>\n\n<p><code>\nItem                                    Price, USD\nZotac CI527 NANO-BE                        $371\n16GB RAM Crucial DDR4-2133                    $127\n250GB SSD Samsung 850 EVO                    $104\nAsus VZ249HE 23.8\" IPS Full HD                    $129\nErgoDox EZ V3, Cherry MX Brown, blank DCS            $325\nKensington Orbit Trackball                        $33\nTotal                                    $1,107\n</code></p>\n\n<ul>\n<li>OpenBSD</li>\n</ul>\n\n<blockquote>\n  <p>I tried few times to install OpenBSD on my MacBooks—I heard some models are compatible with it,—but in my case it was a bit of a fiasco (thanks to Nvidia and Broadcom). That’s why I bought a new computer, just to be able to run this wonderful operating system.</p>\n  \n  <p>Now I run -stable on my desktop and servers. Servers are supposed to be reliable, that’s obvious, why not run -current on a desktop? Because -stable is shipped every six months and I that’s is often enough for me. I prefer slow fashion.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong>\niX Ad Spot <a href=\"https://www.ixsystems.com/blog/nab-2018-recap-2/\">NAB 2018 – Michael Dexter’s Recap</a></p>\n\n<h3><a href=\"https://vermaden.wordpress.com/2018/04/06/introduction-to-hardenedbsd-world/\">Introduction to HardenedBSD World</a></h3>\n\n<blockquote>\n  <p>HardenedBSD is a security enhanced fork of FreeBSD which happened in 2014. HardenedBSD is implementing many exploit mitigation and security technologies on top of FreeBSD which all started with implementation of Address Space Layout Randomization (ASLR). The fork has been created for ease of development.</p>\n  \n  <p>To cite the https://hardenedbsd.org/content/about page – “HardenedBSD aims to implement innovative exploit mitigation and security solutions for the FreeBSD community. (…) HardenedBSD takes a holistic approach to security by hardening the system and implementing exploit mitigation technologies.”</p>\n  \n  <p>Most FreeBSD enthusiasts know mfsBSD project by Martin Matuska – http://mfsbsd.vx.sk/ – FreeBSD system loaded completely into memory. The mfsBSD synonym for the HardenedBSD world is SoloBSD – http://www.solobsd.org/ – which is based on HardenedBSD sources.</p>\n  \n  <p>One may ask how HardenedBSD project compared to more well know for its security OpenBSD system and it is very important question. The OpenBSD developers try to write ‘good’ code without dirty hacks for performance or other reasons. Clean and secure code is most important in OpenBSD world. The OpenBSD project even made security audit of all OpenBSD code available, line by line. This was easier to achieve in FreeBSD or HardenedBSD because OpenBSD code base its about ten times smaller. This has also other implications, possibilities. While FreeBSD (and HardenedBSD) offer many new features like mature SMP subsystem even with some NUMA support, ZFS filesystem, GEOM storage framework, Bhyve virtualization, Virtualbox option and many other new modern features the OpenBSD remains classic UNIX system with UFS filesystem and with very ‘theoretical’ SMP support. The vmm project tried to implement new hypervisor in OpenBSD world, but because of lack of support for graphics its for OpenBSD, Illumos and Linux currently, You will not virtualize Windows or Mac OS X there. This is also only virtualization option for OpenBSD as there are no Jails on OpenBSD. Current Bhyve implementation allows one even to boot latest Windows 2019 Technology Preview.</p>\n  \n  <p>A HardenedBSD project is FreeBSD system code base with LOTS of security mechanisms and mitigations that are not available on FreeBSD system. For example entire lib32 tree has been disabled by default on HardenedBSD to make it more secure. Also LibreSSL is the default SSL library on HardenedBSD, same as OpenBSD while FreeBSD uses OpenSSL for compatibility reasons.</p>\n  \n  <p>Comparison between LibreSSL and OpenSSL vulnerabilities.</p>\n</blockquote>\n\n<ul>\n<li>https://en.wikipedia.org/wiki/LibreSSL#Security</li>\n<li>https://wiki.freebsd.org/LibreSSL#LibreSSL<em>.28and</em>OpenSSL.29<em>Security</em>Vulnerabilities</li>\n</ul>\n\n<blockquote>\n  <p>One may see HardenedBSD as FreeBSD being successfully pulled up to the OpenBSD level (at least that is the goal), but as FreeBSD has tons more code and features it will be harder and longer process to achieve the goal.</p>\n  \n  <p>As I do not have that much competence on the security field I will just repost the comparison from the HardenedBSD project versus other BSD systems. The comparison is also available here – https://hardenedbsd.org/content/easy-feature-comparison – on the HardenedBSD website.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.tomatkinson.uk/git.html\">Running my own git server</a></h3>\n\n<blockquote>\n  <p>Note: This article is predominantly based on work by Hiltjo Posthuma who you should read because I would have spent far too much time failing to set things up if it wasn’t for their post. Not only have they written lots of very interesting posts, they write some really brilliant programs</p>\n  \n  <p>Since I started university 3 years ago, I started using lots of services from lots of different companies. The “cloud” trend led me to believe that I wanted other people to look after my data for me. I was wrong. Since finding myself loving the ethos of OpenBSD, I found myself wanting to apply this ethos to the services I use as well. Not only is it important to me because of the security benefits, but also because I like the minimalist style OpenBSD portrays. This is the first in a mini-series documenting my move from bloated, hosted, sometimes proprietary services to minimal, well-written, free, self-hosted services.</p>\n</blockquote>\n\n<ul>\n<li>Tools &amp; applications</li>\n</ul>\n\n<blockquote>\n  <p>These are the programs I am going to be using to get my git server up and running:</p>\n</blockquote>\n\n<p><code>\nhttpd(8)\nacme-client(1)\ngit(1)\ncgit(1)\nslowcgi(8)\n</code></p>\n\n<ul>\n<li>Setting up httpd</li>\n</ul>\n\n<blockquote>\n  <p>Ensure you have the necessary flags enabled in your /etc/rc.conf.local:</p>\n</blockquote>\n\n<ul>\n<li>Configuring cgit</li>\n</ul>\n\n<blockquote>\n  <p>When using the OpenBSD httpd(8), it will serve it’s content in a chrooted environment,which defaults to the home directory of the user it runs as, which is www in this case. This means that the chroot is limited to the directory /var/www and it’s contents.</p>\n  \n  <p>In order to configure cgit, there must be a cgitrc file available to cgit. This is found at the location stored in $CGIT_CONFIG, which defaults to /conf/cgitrc. Because of the chroot, this file is actually stored at /var/www/conf/cgitrc.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://blather.michaelwlucas.com/archives/3173\">My Penguicon 2018 Schedule</a></li>\n<li><a href=\"https://rachelbythebay.com/w/2018/04/16/signal/\">sigaction: see who killed you (and more)</a></li>\n<li><a href=\"http://mail-index.netbsd.org/netbsd-announce/2018/04/20/msg000284.html\">Takeshi steps down from NetBSD core team after 13 years</a></li>\n<li><a href=\"https://www.phoronix.com/scan.php?page=news_item&amp;px=DragonFlyBSD-More-Perf-For-5.4\">DragonFlyBSD Kernel Gets Some SMP Improvements – Phoronix</a></li>\n<li><a href=\"https://m.youtube.com/watch?v=bT_k06Xg-BE\">Writing FreeBSD Malware</a></li>\n</ul>\n\n<p><strong>Tarsnap ad</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Troels - <a href=\"http://dpaste.com/35K0BD7#wrap\">Question regarding ZFS xattr</a></li>\n<li>Mike - <a href=\"http://dpaste.com/33X1K80#wrap\">Sharing your screen</a></li>\n<li>Wilyarti - <a href=\"http://dpaste.com/0D452Q0#wrap\">Adlocking on FreeBSD</a></li>\n<li>Brad - <a href=\"http://dpaste.com/08XAHNY#wrap\">Recommendations for snapshot strategy</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"Allan’s recap of the ZFS User conference, first impressions of OmniOS by a BSD user, Nextcloud 13 setup on FreeBSD, OpenBSD on a fanless desktop computer, an intro to HardenedBSD, and DragonFlyBSD getting some SMP improvements.","date_published":"2018-05-10T08:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b6503021-a9eb-471a-8089-2dc3647bc58c.mp3","mime_type":"audio/mp3","size_in_bytes":61107427,"duration_in_seconds":5077}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1868","title":"Episode 244: C is a Lie | BSD Now 244","url":"https://www.bsdnow.tv/244","content_text":"Arcan and OpenBSD, running OpenBSD 6.3 on RPI 3, why C is not a low-level language, HardenedBSD switching back to OpenSSL, how the Internet was almost broken, EuroBSDcon CfP is out, and the BSDCan 2018 schedule is available.\n\nHeadlines\n\nTowards Secure System Graphics: Arcan and OpenBSD\n\n\n  Let me preface this by saying that this is a (very) long and medium-rare technical article about the security considerations and minutiae of porting (most of) the Arcan ecosystem to work under OpenBSD. The main point of this article is not so much flirting with the OpenBSD crowd or adding further noise to software engineering topics, but to go through the special considerations that had to be taken, as notes to anyone else that decides to go down this overgrown and lonesome trail, or are curious about some less than obvious differences between how these things “work” on Linux vs. other parts of the world.\n  \n  A disclaimer is also that most of this have been discovered by experimentation and combining bits and pieces scattered in everything from Xorg code to man pages, there may be smarter ways to solve some of the problems mentioned – this is just the best I could find within the time allotted. I’d be happy to be corrected, in patch/pull request form that is 😉\n  \n  Each section will start with a short rant-like explanation of how it works in Linux, and what the translation to OpenBSD involved or, in the cases that are still partly or fully missing, will require. The topics that will be covered this time are:\n\n\n\nGraphics Device Access\nHotplug\nInput\nBacklight\nXorg\nPledging\nMissing\n\n\n\n\nInstalling OpenBSD 6.3 (snapshots) on Raspberry pi 3\n\n\nThe Easy way\n\n\n\n  Installing the OpenBSD on raspberry pi 3 is very easy and well documented which almost convinced me of not writing about it, but still I felt like it may help somebody new to the project (But again I really recommend reading the document if you are interested and have the time).\n  \n  Note: I'm always running snapshots and recommend anybody to do it as well. But the snapshots links will change to the next version every 6 month, so I changed the links to the 6.3 version to keep the blog post valid over times. If you're familiar to the OpenBSD flavors, feel free to use the snapshots links instead.\n\n\n\nRequirements\n\n\n\n  Due to the lack of driver, the OpenBSD can not boot directly from the SD Card yet, So we'll need an USB Stick for the installtion target aside the SD Card for the U-Boot and installer. Also, a Serial Console connection is required. I Used a PL2303 USB to Serial (TTL) adapter connected to my Laptop via USB port and connected to the Raspberry via TX, RX and GND pins.\n\n\n\n\niXsystems\nhttps://www.ixsystems.com/blog/truenas-m-series-veeam-pr-2018/\n\nWhy Didn’t Larrabee Fail?\n\n\n  Every month or so, someone will ask me what happened to Larrabee and why it failed so badly. And I then try to explain to them that not only didn't it fail, it was a pretty huge success. And they are understandably very puzzled by this, because in the public consciousness Larrabee was like the Itanic and the SPU rolled into one, wasn't it? Well, not quite. So rather than explain it in person a whole bunch more times, I thought I should write it down.\n  \n  This is not a history, and I'm going to skip a TON of details for brevity. One day I'll write the whole story down, because it's a pretty decent escapade with lots of fun characters. But not today. Today you just get the very start and the very end.\n  \n  When I say \"Larrabee\" I mean all of Knights, all of MIC, all of Xeon Phi, all of the \"Isle\" cards - they're all exactly the same chip and the same people and the same software effort. Marketing seemed to dream up a new codeword every week, but there was only ever three chips:\n\n\n\nKnights Ferry / Aubrey Isle / LRB1 - mostly a prototype, had some performance gotchas, but did work, and shipped to partners.\nKnights Corner / Xeon Phi / LRB2 - the thing we actually shipped in bulk.\nKnights Landing - the new version that is shipping any day now (mid 2016).\n\n\n\n  That's it. There were some other codenames I've forgotten over the years, but they're all of one of the above chips. Behind all the marketing smoke and mirrors there were only three chips ever made (so far), and only four planned in total (we had a thing called LRB3 planned between KNC and KNL for a while). All of them are \"Larrabee\", whether they do graphics or not.\n  \n  When Larrabee was originally conceived back in about 2005, it was called \"SMAC\", and its original goals were, from most to least important:\n\n\n\nMake the most powerful flops-per-watt machine for real-world workloads using a huge array of simple cores, on systems and boards that could be built into bazillo-core supercomputers.\nMake it from x86 cores. That means memory coherency, store ordering, memory protection, real OSes, no ugly scratchpads, it runs legacy code, and so on. No funky DSPs or windowed register files or wacky programming models allowed. Do not build another Itanium or SPU!\nMake it soon. That means keeping it simple.\nSupport the emerging GPGPU market with that same chip. Intel were absolutely not going to build a 150W PCIe card version of their embedded graphics chip (known as \"Gen\"), so we had to cover those programming models. As a bonus, run normal graphics well.\nAdd as little graphics-specific hardware as you can get away with.\n\n\n\n  That ordering is important - in terms of engineering and focus, Larrabee was never primarily a graphics card. If Intel had wanted a kick-ass graphics card, they already had a very good graphics team begging to be allowed to build a nice big fat hot discrete GPU - and the Gen architecture is such that they'd build a great one, too. But Intel management didn't want one, and still doesn't. But if we were going to build Larrabee anyway, they wanted us to cover that market as well.\n  \n  ... the design of Larrabee was of a CPU with a very wide SIMD unit, designed above all to be a real grown-up CPU - coherent caches, well-ordered memory rules, good memory protection, true multitasking, real threads, runs Linux/FreeBSD, etc. Larrabee, in the form of KNC, went on to become the fastest supercomputer in the world for a couple of years, and it's still making a ton of money for Intel in the HPC market that it was designed for, fighting very nicely against the GPUs and other custom architectures. Its successor, KNL, is just being released right now (mid 2016) and should do very nicely in that space too. Remember - KNC is literally the same chip as LRB2. It has texture samplers and a video out port sitting on the die. They don't test them or turn them on or expose them to software, but they're still there - it's still a graphics-capable part.\n  \n  But it's still actually running FreeBSD on that card, and under FreeBSD it's just running an x86 program called DirectXGfx (248 threads of it).\n\n\n\n\nNews Roundup\n\nC Is Not a Low-level Language : Your computer is not a fast PDP-11.\n\n\n  In the wake of the recent Meltdown and Spectre vulnerabilities, it's worth spending some time looking at root causes. Both of these vulnerabilities involved processors speculatively executing instructions past some kind of access check and allowing the attacker to observe the results via a side channel. The features that led to these vulnerabilities, along with several others, were added to let C programmers continue to believe they were programming in a low-level language, when this hasn't been the case for decades.\n  \n  Processor vendors are not alone in this. Those of us working on C/C++ compilers have also participated.\n\n\n\nWhat Is a Low-Level Language?\n\n\n\n  Computer science pioneer Alan Perlis defined low-level languages this way: \"A programming language is low level when its programs require attention to the irrelevant.\"\n  \n  While, yes, this definition applies to C, it does not capture what people desire in a low-level language. Various attributes cause people to regard a language as low-level. Think of programming languages as belonging on a continuum, with assembly at one end and the interface to the Starship Enterprise's computer at the other. Low-level languages are \"close to the metal,\" whereas high-level languages are closer to how humans think.\n  \n  For a language to be \"close to the metal,\" it must provide an abstract machine that maps easily to the abstractions exposed by the target platform. It's easy to argue that C was a low-level language for the PDP-11. They both described a model in which programs executed sequentially, in which memory was a flat space, and even the pre- and post-increment operators cleanly lined up with the PDP-11 addressing modes.\n\n\nFast PDP-11 Emulators\n\n\n  The root cause of the Spectre and Meltdown vulnerabilities was that processor architects were trying to build not just fast processors, but fast processors that expose the same abstract machine as a PDP-11. This is essential because it allows C programmers to continue in the belief that their language is close to the underlying hardware.\n  \n  C code provides a mostly serial abstract machine (until C11, an entirely serial machine if nonstandard vendor extensions were excluded). Creating a new thread is a library operation known to be expensive, so processors wishing to keep their execution units busy running C code rely on ILP (instruction-level parallelism). They inspect adjacent operations and issue independent ones in parallel. This adds a significant amount of complexity (and power consumption) to allow programmers to write mostly sequential code. In contrast, GPUs achieve very high performance without any of this logic, at the expense of requiring explicitly parallel programs.\n  \n  The quest for high ILP was the direct cause of Spectre and Meltdown. A modern Intel processor has up to 180 instructions in flight at a time (in stark contrast to a sequential C abstract machine, which expects each operation to complete before the next one begins). A typical heuristic for C code is that there is a branch, on average, every seven instructions. If you wish to keep such a pipeline full from a single thread, then you must guess the targets of the next 25 branches. This, again, adds complexity; it also means that an incorrect guess results in work being done and then discarded, which is not ideal for power consumption. This discarded work has visible side effects, which the Spectre and Meltdown attacks could exploit.\n  \n  On a modern high-end core, the register rename engine is one of the largest consumers of die area and power. To make matters worse, it cannot be turned off or power gated while any instructions are running, which makes it inconvenient in a dark silicon era when transistors are cheap but powered transistors are an expensive resource. This unit is conspicuously absent on GPUs, where parallelism again comes from multiple threads rather than trying to extract instruction-level parallelism from intrinsically scalar code. If instructions do not have dependencies that need to be reordered, then register renaming is not necessary.\n  \n  Consider another core part of the C abstract machine's memory model: flat memory. This hasn't been true for more than two decades. A modern processor often has three levels of cache in between registers and main memory, which attempt to hide latency.\n  \n  The cache is, as its name implies, hidden from the programmer and so is not visible to C. Efficient use of the cache is one of the most important ways of making code run quickly on a modern processor, yet this is completely hidden by the abstract machine, and programmers must rely on knowing implementation details of the cache (for example, two values that are 64-byte-aligned may end up in the same cache line) to write efficient code.\n\n\n\nBackup URL\nHacker News Commentary\n\n\n\n\nHardenedBSD Switching Back to OpenSSL\n\n\n  Over a year ago, HardenedBSD switched to LibreSSL as the default cryptographic library in base for 12-CURRENT. 11-STABLE followed suit later on. Bernard Spil has done an excellent job at keeping our users up-to-date with the latest security patches from LibreSSL.\n  \n  After recently updating 12-CURRENT to LibreSSL 2.7.2 from 2.6.4, it has become increasingly clear to us that performing major upgrades requires a team larger than a single person. Upgrading to 2.7.2 caused a lot of fallout in our ports tree. As of 28 Apr 2018, several ports we consider high priority are still broken. As it stands right now, it would take Bernard a significant amount of his spare personal time to fix these issues.\n  \n  Until we have a multi-person team dedicated to maintaining LibreSSL in base along with the patches required in ports, HardenedBSD will use OpenSSL going forward as the default cryptographic library in base. LibreSSL will co-exist with OpenSSL in the source tree, as it does now. However, MK_LIBRESSL will default to \"no\" instead of the current \"yes\". Bernard will continue maintaining LibreSSL in base along with addressing the various problematic ports entries.\n  \n  To provide our users with ample time to plan and perform updates, we will wait a period of two months prior to making the switch. The switch will occur on 01 Jul 2018 and will be performed simultaneously in 12-CURRENT and 11-STABLE. HardenedBSD will archive a copy of the LibreSSL-centric package repositories and binary updates for base for a period of six months after the switch (expiring the package repos on 01 Jan 2019). This essentially gives our users eight full months for an upgrade path.\n  \n  As part of the switch back to OpenSSL, the default NTP daemon in base will switch back from OpenNTPd to ISC NTP. Users who have localopenntpdenable=\"YES\" set in rc.conf will need to switch back to ntpd_enable=\"YES\".\n  \n  Users who build base from source will want to fully clean their object directories. Any and all packages that link with libcrypto or libssl will need to be rebuilt or reinstalled.\n  \n  With the community's help, we look forward to the day when we can make the switch back to LibreSSL. We at HardenedBSD believe that providing our users options to rid themselves of software monocultures can better increase security and manage risk.\n\n\n\n\nDigitalOcean\nhttp://do.co/bsdnow -- $100 credit for 60 days\n\nHow Dan Kaminsky Almost Broke the Internet\n\n\n  In the summer of 2008, security researcher Dan Kaminsky disclosed how he had found a huge flaw in the Internet that could let attackers redirect web traffic to alternate servers and disrupt normal operations. In this Hacker History video, Kaminsky describes the flaw and notes the issue remains unfixed.\n  \n  “We were really concerned about web pages and emails 'cause that’s what you get to compromise when you compromise DNS,” Kaminsky says. “You think you’re sending an email to IBM but it really goes to the bad guy.”\n  \n  As the phone book of the Internet, DNS translates easy-to-remember domain names into IP addresses so that users don’t have to remember strings of numbers to reach web applications and services. Authoritative nameservers publish the IP addresses of domain names. Recursive nameservers talk to authoritative servers to find addresses for those domain names and saves the information into its cache to speed up the response time the next time it is asked about that site. While anyone can set up a nameserver and configure an authoritative zone for any site, if recursive nameservers don’t point to it to ask questions, no one will get those wrong answers.\n  \n  We made the Internet less flammable.\n  \n  Kaminsky found a fundamental design flaw in DNS that made it possible to inject incorrect information into the nameserver's cache, or DNS cache poisoning. In this case, if an attacker crafted DNS queries looking for sibling names to existing domains, such as 1.example.com, 2.example.com, and 3.example.com, while claiming to be the official \"www\" server for example.com, the nameserver will save that server IP address for “www” in its cache.\n  \n  “The server will go, ‘You are the official. Go right ahead. Tell me what it’s supposed to be,’” Kaminsky says in the video.\n  \n  Since the issue affected nearly every DNS server on the planet, it required a coordinated response to address it. Kaminsky informed Paul Vixie, creator of several DNS protocol extensions and application, and Vixie called an emergency summit of major IT vendors at Microsoft’s headquarters to figure out what to do.\n  \n  The “fix” involved combining the 16-bit transaction identifier that DNS lookups used with UDP source ports to create 32-bit transaction identifiers. Instead of fixing the flaw so that it can’t be exploited, the resolution focused on making it take more than ten seconds, eliminating the instantaneous attack.\n  \n  “[It’s] not like we repaired DNS,” Kaminsky says. “We made the Internet less flammable.”\n  \n  DNSSEC (Domain Name System Security Extensions), is intended to secure DNS by adding a cryptographic layer to DNS information. The root zone of the internet was signed for DNSSEC in July 2010 and the .com Top Level Domain (TLD) was finally signed for DNSSEC in April 2011. Unfortunately, adoption has been slow, even ten years after Kaminsky first raised the alarm about DNS, as less than 15 percent of users pass their queries to DNSSEC validating resolvers.\n  \n  The Internet was never designed to be secure. The Internet was designed to move pictures of cats.\n  \n  No one expected the Internet to be used for commerce and critical communications. If people lose faith in DNS, then all the things that depend on it are at risk.\n  \n  “What are we going to do? Here is the answer. Some of us gotta go out fix it,” Kaminsky says.\n\n\n\n\nOpenIndiana Hipster 2018.04 is here\n\n\nWe have released a new OpenIndiana Hipster snapshot 2018.04. The noticeable changes:\n\nUserland software is rebuilt with GCC 6.\nKPTI was enabled to mitigate recent security issues in Intel CPUs.\nSupport of Gnome 2 desktop was removed.\nLinked images now support zoneproxy service.\nMate desktop applications are delivered as 64-bit-only.\nUpower support was integrated.\nIIIM was removed.\nMore information can be found in 2018.04 Release notes and new medias can be downloaded from http://dlc.openindiana.org.\n\n\n\n\nBeastie Bits\n\n\nEuroBSDCon - Call for Papers\nOpenSSH 7.7\npkgsrc-2018Q1 released\nBSDCan Schedule\nMichael Dexter's LFNW talk\n\n\n\n\n\n\nTarsnap ad\n\n\n\nFeedback/Questions\n\n\nBob - Help locating FreeBSD Help\nAlex - Convert directory to dataset\nAdam - FreeNAS Question\nFlorian - Three Questions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n\n\niX Ad spot: iXsystems TrueNAS M-Series Blows Away Veeam Backup Certification Tests","content_html":"<p>Arcan and OpenBSD, running OpenBSD 6.3 on RPI 3, why C is not a low-level language, HardenedBSD switching back to OpenSSL, how the Internet was almost broken, EuroBSDcon CfP is out, and the BSDCan 2018 schedule is available.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://arcan-fe.com/2018/04/25/towards-secure-system-graphics-arcan-and-openbsd/\">Towards Secure System Graphics: Arcan and OpenBSD</a></h3>\n\n<blockquote>\n  <p>Let me preface this by saying that this is a (very) long and medium-rare technical article about the security considerations and minutiae of porting (most of) the Arcan ecosystem to work under OpenBSD. The main point of this article is not so much flirting with the OpenBSD crowd or adding further noise to software engineering topics, but to go through the special considerations that had to be taken, as notes to anyone else that decides to go down this overgrown and lonesome trail, or are curious about some less than obvious differences between how these things “work” on Linux vs. other parts of the world.</p>\n  \n  <p>A disclaimer is also that most of this have been discovered by experimentation and combining bits and pieces scattered in everything from Xorg code to man pages, there may be smarter ways to solve some of the problems mentioned – this is just the best I could find within the time allotted. I’d be happy to be corrected, in patch/pull request form that is &#x1f609;</p>\n  \n  <p>Each section will start with a short rant-like explanation of how it works in Linux, and what the translation to OpenBSD involved or, in the cases that are still partly or fully missing, will require. The topics that will be covered this time are:</p>\n</blockquote>\n\n<ul>\n<li>Graphics Device Access</li>\n<li>Hotplug</li>\n<li>Input</li>\n<li>Backlight</li>\n<li>Xorg</li>\n<li>Pledging</li>\n<li>Missing</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://bijanebrahimi.github.io/blog/installing-openbsd-63-on-raspberry-pi-3.html\">Installing OpenBSD 6.3 (snapshots) on Raspberry pi 3</a></h3>\n\n<ul>\n<li>The Easy way</li>\n</ul>\n\n<blockquote>\n  <p>Installing the OpenBSD on raspberry pi 3 is very easy and well documented which almost convinced me of not writing about it, but still I felt like it may help somebody new to the project (But again I really recommend reading the document if you are interested and have the time).</p>\n  \n  <p>Note: I'm always running snapshots and recommend anybody to do it as well. But the snapshots links will change to the next version every 6 month, so I changed the links to the 6.3 version to keep the blog post valid over times. If you're familiar to the OpenBSD flavors, feel free to use the snapshots links instead.</p>\n</blockquote>\n\n<ul>\n<li>Requirements</li>\n</ul>\n\n<blockquote>\n  <p>Due to the lack of driver, the OpenBSD can not boot directly from the SD Card yet, So we'll need an USB Stick for the installtion target aside the SD Card for the U-Boot and installer. Also, a Serial Console connection is required. I Used a PL2303 USB to Serial (TTL) adapter connected to my Laptop via USB port and connected to the Raspberry via TX, RX and GND pins.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong>\nhttps://www.ixsystems.com/blog/truenas-m-series-veeam-pr-2018/</p>\n\n<h3><a href=\"http://tomforsyth1000.github.io/blog.wiki.html#%5B%5BWhydidn%27tLarrabeefail?%5D%5D\">Why Didn’t Larrabee Fail?</a></h3>\n\n<blockquote>\n  <p>Every month or so, someone will ask me what happened to Larrabee and why it failed so badly. And I then try to explain to them that not only didn't it fail, it was a pretty huge success. And they are understandably very puzzled by this, because in the public consciousness Larrabee was like the Itanic and the SPU rolled into one, wasn't it? Well, not quite. So rather than explain it in person a whole bunch more times, I thought I should write it down.</p>\n  \n  <p>This is not a history, and I'm going to skip a TON of details for brevity. One day I'll write the whole story down, because it's a pretty decent escapade with lots of fun characters. But not today. Today you just get the very start and the very end.</p>\n  \n  <p>When I say \"Larrabee\" I mean all of Knights, all of MIC, all of Xeon Phi, all of the \"Isle\" cards - they're all exactly the same chip and the same people and the same software effort. Marketing seemed to dream up a new codeword every week, but there was only ever three chips:</p>\n</blockquote>\n\n<ul>\n<li>Knights Ferry / Aubrey Isle / LRB1 - mostly a prototype, had some performance gotchas, but did work, and shipped to partners.</li>\n<li>Knights Corner / Xeon Phi / LRB2 - the thing we actually shipped in bulk.</li>\n<li>Knights Landing - the new version that is shipping any day now (mid 2016).</li>\n</ul>\n\n<blockquote>\n  <p>That's it. There were some other codenames I've forgotten over the years, but they're all of one of the above chips. Behind all the marketing smoke and mirrors there were only three chips ever made (so far), and only four planned in total (we had a thing called LRB3 planned between KNC and KNL for a while). All of them are \"Larrabee\", whether they do graphics or not.</p>\n  \n  <p>When Larrabee was originally conceived back in about 2005, it was called \"SMAC\", and its original goals were, from most to least important:</p>\n</blockquote>\n\n<ul>\n<li><ol><li>Make the most powerful flops-per-watt machine for real-world workloads using a huge array of simple cores, on systems and boards that could be built into bazillo-core supercomputers.</li></ol></li>\n<li><ol><li>Make it from x86 cores. That means memory coherency, store ordering, memory protection, real OSes, no ugly scratchpads, it runs legacy code, and so on. No funky DSPs or windowed register files or wacky programming models allowed. Do not build another Itanium or SPU!</li></ol></li>\n<li><ol><li>Make it soon. That means keeping it simple.</li></ol></li>\n<li><ol><li>Support the emerging GPGPU market with that same chip. Intel were absolutely not going to build a 150W PCIe card version of their embedded graphics chip (known as \"Gen\"), so we had to cover those programming models. As a bonus, run normal graphics well.</li></ol></li>\n<li><ol><li>Add as little graphics-specific hardware as you can get away with.</li></ol></li>\n</ul>\n\n<blockquote>\n  <p>That ordering is important - in terms of engineering and focus, Larrabee was never primarily a graphics card. If Intel had wanted a kick-ass graphics card, they already had a very good graphics team begging to be allowed to build a nice big fat hot discrete GPU - and the Gen architecture is such that they'd build a great one, too. But Intel management didn't want one, and still doesn't. But if we were going to build Larrabee anyway, they wanted us to cover that market as well.</p>\n  \n  <p>... the design of Larrabee was of a CPU with a very wide SIMD unit, designed above all to be a real grown-up CPU - coherent caches, well-ordered memory rules, good memory protection, true multitasking, real threads, runs Linux/FreeBSD, etc. Larrabee, in the form of KNC, went on to become the fastest supercomputer in the world for a couple of years, and it's still making a ton of money for Intel in the HPC market that it was designed for, fighting very nicely against the GPUs and other custom architectures. Its successor, KNL, is just being released right now (mid 2016) and should do very nicely in that space too. Remember - KNC is literally the same chip as LRB2. It has texture samplers and a video out port sitting on the die. They don't test them or turn them on or expose them to software, but they're still there - it's still a graphics-capable part.</p>\n  \n  <p>But it's still actually running FreeBSD on that card, and under FreeBSD it's just running an x86 program called DirectXGfx (248 threads of it).</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://queue.acm.org/detail.cfm?id=3212479\">C Is Not a Low-level Language : Your computer is not a fast PDP-11.</a></h3>\n\n<blockquote>\n  <p>In the wake of the recent Meltdown and Spectre vulnerabilities, it's worth spending some time looking at root causes. Both of these vulnerabilities involved processors speculatively executing instructions past some kind of access check and allowing the attacker to observe the results via a side channel. The features that led to these vulnerabilities, along with several others, were added to let C programmers continue to believe they were programming in a low-level language, when this hasn't been the case for decades.</p>\n  \n  <p>Processor vendors are not alone in this. Those of us working on C/C++ compilers have also participated.</p>\n</blockquote>\n\n<ul>\n<li>What Is a Low-Level Language?</li>\n</ul>\n\n<blockquote>\n  <p>Computer science pioneer Alan Perlis defined low-level languages this way: \"A programming language is low level when its programs require attention to the irrelevant.\"</p>\n  \n  <p>While, yes, this definition applies to C, it does not capture what people desire in a low-level language. Various attributes cause people to regard a language as low-level. Think of programming languages as belonging on a continuum, with assembly at one end and the interface to the Starship Enterprise's computer at the other. Low-level languages are \"close to the metal,\" whereas high-level languages are closer to how humans think.</p>\n  \n  <p>For a language to be \"close to the metal,\" it must provide an abstract machine that maps easily to the abstractions exposed by the target platform. It's easy to argue that C was a low-level language for the PDP-11. They both described a model in which programs executed sequentially, in which memory was a flat space, and even the pre- and post-increment operators cleanly lined up with the PDP-11 addressing modes.</p>\n</blockquote>\n\n<p>Fast PDP-11 Emulators</p>\n\n<blockquote>\n  <p>The root cause of the Spectre and Meltdown vulnerabilities was that processor architects were trying to build not just fast processors, but fast processors that expose the same abstract machine as a PDP-11. This is essential because it allows C programmers to continue in the belief that their language is close to the underlying hardware.</p>\n  \n  <p>C code provides a mostly serial abstract machine (until C11, an entirely serial machine if nonstandard vendor extensions were excluded). Creating a new thread is a library operation known to be expensive, so processors wishing to keep their execution units busy running C code rely on ILP (instruction-level parallelism). They inspect adjacent operations and issue independent ones in parallel. This adds a significant amount of complexity (and power consumption) to allow programmers to write mostly sequential code. In contrast, GPUs achieve very high performance without any of this logic, at the expense of requiring explicitly parallel programs.</p>\n  \n  <p>The quest for high ILP was the direct cause of Spectre and Meltdown. A modern Intel processor has up to 180 instructions in flight at a time (in stark contrast to a sequential C abstract machine, which expects each operation to complete before the next one begins). A typical heuristic for C code is that there is a branch, on average, every seven instructions. If you wish to keep such a pipeline full from a single thread, then you must guess the targets of the next 25 branches. This, again, adds complexity; it also means that an incorrect guess results in work being done and then discarded, which is not ideal for power consumption. This discarded work has visible side effects, which the Spectre and Meltdown attacks could exploit.</p>\n  \n  <p>On a modern high-end core, the register rename engine is one of the largest consumers of die area and power. To make matters worse, it cannot be turned off or power gated while any instructions are running, which makes it inconvenient in a dark silicon era when transistors are cheap but powered transistors are an expensive resource. This unit is conspicuously absent on GPUs, where parallelism again comes from multiple threads rather than trying to extract instruction-level parallelism from intrinsically scalar code. If instructions do not have dependencies that need to be reordered, then register renaming is not necessary.</p>\n  \n  <p>Consider another core part of the C abstract machine's memory model: flat memory. This hasn't been true for more than two decades. A modern processor often has three levels of cache in between registers and main memory, which attempt to hide latency.</p>\n  \n  <p>The cache is, as its name implies, hidden from the programmer and so is not visible to C. Efficient use of the cache is one of the most important ways of making code run quickly on a modern processor, yet this is completely hidden by the abstract machine, and programmers must rely on knowing implementation details of the cache (for example, two values that are 64-byte-aligned may end up in the same cache line) to write efficient code.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://web.archive.org/web/20180501170011/https://queue.acm.org/detail.cfm?id=3212479\">Backup URL</a></li>\n<li><a href=\"https://news.ycombinator.com/item?id=16967675\">Hacker News Commentary</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://hardenedbsd.org/article/shawn-webb/2018-04-30/hardenedbsd-switching-back-openssl\">HardenedBSD Switching Back to OpenSSL</a></h3>\n\n<blockquote>\n  <p>Over a year ago, HardenedBSD switched to LibreSSL as the default cryptographic library in base for 12-CURRENT. 11-STABLE followed suit later on. Bernard Spil has done an excellent job at keeping our users up-to-date with the latest security patches from LibreSSL.</p>\n  \n  <p>After recently updating 12-CURRENT to LibreSSL 2.7.2 from 2.6.4, it has become increasingly clear to us that performing major upgrades requires a team larger than a single person. Upgrading to 2.7.2 caused a lot of fallout in our ports tree. As of 28 Apr 2018, several ports we consider high priority are still broken. As it stands right now, it would take Bernard a significant amount of his spare personal time to fix these issues.</p>\n  \n  <p>Until we have a multi-person team dedicated to maintaining LibreSSL in base along with the patches required in ports, HardenedBSD will use OpenSSL going forward as the default cryptographic library in base. LibreSSL will co-exist with OpenSSL in the source tree, as it does now. However, MK_LIBRESSL will default to \"no\" instead of the current \"yes\". Bernard will continue maintaining LibreSSL in base along with addressing the various problematic ports entries.</p>\n  \n  <p>To provide our users with ample time to plan and perform updates, we will wait a period of two months prior to making the switch. The switch will occur on 01 Jul 2018 and will be performed simultaneously in 12-CURRENT and 11-STABLE. HardenedBSD will archive a copy of the LibreSSL-centric package repositories and binary updates for base for a period of six months after the switch (expiring the package repos on 01 Jan 2019). This essentially gives our users eight full months for an upgrade path.</p>\n  \n  <p>As part of the switch back to OpenSSL, the default NTP daemon in base will switch back from OpenNTPd to ISC NTP. Users who have local<em>openntpd</em>enable=\"YES\" set in rc.conf will need to switch back to ntpd_enable=\"YES\".</p>\n  \n  <p>Users who build base from source will want to fully clean their object directories. Any and all packages that link with libcrypto or libssl will need to be rebuilt or reinstalled.</p>\n  \n  <p>With the community's help, we look forward to the day when we can make the switch back to LibreSSL. We at HardenedBSD believe that providing our users options to rid themselves of software monocultures can better increase security and manage risk.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong>\nhttp://do.co/bsdnow -- $100 credit for 60 days</p>\n\n<h3><a href=\"https://duo.com/decipher/hacker-history-how-dan-kaminsky-almost-broke-the-internet\">How Dan Kaminsky Almost Broke the Internet</a></h3>\n\n<blockquote>\n  <p>In the summer of 2008, security researcher Dan Kaminsky disclosed how he had found a huge flaw in the Internet that could let attackers redirect web traffic to alternate servers and disrupt normal operations. In this Hacker History video, Kaminsky describes the flaw and notes the issue remains unfixed.</p>\n  \n  <p>“We were really concerned about web pages and emails 'cause that’s what you get to compromise when you compromise DNS,” Kaminsky says. “You think you’re sending an email to IBM but it really goes to the bad guy.”</p>\n  \n  <p>As the phone book of the Internet, DNS translates easy-to-remember domain names into IP addresses so that users don’t have to remember strings of numbers to reach web applications and services. Authoritative nameservers publish the IP addresses of domain names. Recursive nameservers talk to authoritative servers to find addresses for those domain names and saves the information into its cache to speed up the response time the next time it is asked about that site. While anyone can set up a nameserver and configure an authoritative zone for any site, if recursive nameservers don’t point to it to ask questions, no one will get those wrong answers.</p>\n  \n  <p>We made the Internet less flammable.</p>\n  \n  <p>Kaminsky found a fundamental design flaw in DNS that made it possible to inject incorrect information into the nameserver's cache, or DNS cache poisoning. In this case, if an attacker crafted DNS queries looking for sibling names to existing domains, such as 1.example.com, 2.example.com, and 3.example.com, while claiming to be the official \"www\" server for example.com, the nameserver will save that server IP address for “www” in its cache.</p>\n  \n  <p>“The server will go, ‘You are the official. Go right ahead. Tell me what it’s supposed to be,’” Kaminsky says in the video.</p>\n  \n  <p>Since the issue affected nearly every DNS server on the planet, it required a coordinated response to address it. Kaminsky informed Paul Vixie, creator of several DNS protocol extensions and application, and Vixie called an emergency summit of major IT vendors at Microsoft’s headquarters to figure out what to do.</p>\n  \n  <p>The “fix” involved combining the 16-bit transaction identifier that DNS lookups used with UDP source ports to create 32-bit transaction identifiers. Instead of fixing the flaw so that it can’t be exploited, the resolution focused on making it take more than ten seconds, eliminating the instantaneous attack.</p>\n  \n  <p>“[It’s] not like we repaired DNS,” Kaminsky says. “We made the Internet less flammable.”</p>\n  \n  <p>DNSSEC (Domain Name System Security Extensions), is intended to secure DNS by adding a cryptographic layer to DNS information. The root zone of the internet was signed for DNSSEC in July 2010 and the .com Top Level Domain (TLD) was finally signed for DNSSEC in April 2011. Unfortunately, adoption has been slow, even ten years after Kaminsky first raised the alarm about DNS, as less than 15 percent of users pass their queries to DNSSEC validating resolvers.</p>\n  \n  <p>The Internet was never designed to be secure. The Internet was designed to move pictures of cats.</p>\n  \n  <p>No one expected the Internet to be used for commerce and critical communications. If people lose faith in DNS, then all the things that depend on it are at risk.</p>\n  \n  <p>“What are we going to do? Here is the answer. Some of us gotta go out fix it,” Kaminsky says.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.openindiana.org/2018/04/28/openindiana-hipster-2018-04-is-here/\">OpenIndiana Hipster 2018.04 is here</a></h3>\n\n<ul>\n<li><p>We have released a new OpenIndiana Hipster snapshot 2018.04. The noticeable changes:</p>\n\n<ul><li>Userland software is rebuilt with GCC 6.</li>\n<li>KPTI was enabled to mitigate recent security issues in Intel CPUs.</li>\n<li>Support of Gnome 2 desktop was removed.</li>\n<li>Linked images now support zoneproxy service.</li>\n<li>Mate desktop applications are delivered as 64-bit-only.</li>\n<li>Upower support was integrated.</li>\n<li>IIIM was removed.</li></ul></li>\n<li><p>More information can be found in <a href=\"https://wiki.openindiana.org/oi/2018.04+Release+notes\">2018.04 Release notes</a> and new medias can be downloaded from <a href=\"http://dlc.openindiana.org/\">http://dlc.openindiana.org</a>.</p></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://2018.eurobsdcon.org/call-for-papers/\">EuroBSDCon - Call for Papers</a></li>\n<li><a href=\"https://www.openssh.com/txt/release-7.7\">OpenSSH 7.7</a></li>\n<li><a href=\"https://mail-index.netbsd.org/pkgsrc-users/2018/04/05/msg026461.html\">pkgsrc-2018Q1 released</a></li>\n<li><a href=\"https://www.bsdcan.org/2018/schedule/\">BSDCan Schedule</a></li>\n<li><a href=\"https://www.youtube.com/watch?v=CehSeSVgEUA&amp;feature=youtu.be\">Michael Dexter's LFNW talk</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><hr /></p>\n\n<p>Tarsnap ad</p>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Bob - <a href=\"http://dpaste.com/02T6P91#wrap\">Help locating FreeBSD Help</a></li>\n<li>Alex - <a href=\"http://dpaste.com/04RQ46X#wrap\">Convert directory to dataset</a></li>\n<li>Adam - <a href=\"http://dpaste.com/3GT988W#wrap\">FreeNAS Question</a></li>\n<li>Florian - <a href=\"http://dpaste.com/3RGQRVR#wrap\">Three Questions</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p>iX Ad spot: <a href=\"https://www.ixsystems.com/blog/truenas-m-series-veeam-pr-2018/\">iXsystems TrueNAS M-Series Blows Away Veeam Backup Certification Tests</a></p>","summary":"Arcan and OpenBSD, running OpenBSD 6.3 on RPI 3, why C is not a low-level language, HardenedBSD switching back to OpenSSL, how the Internet was almost broken, EuroBSDcon CfP is out, and the BSDCan 2018 schedule is available.","date_published":"2018-05-03T03:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/a46e2baa-82ee-4acb-9678-978f26dbd32c.mp3","mime_type":"audio/mp3","size_in_bytes":61656187,"duration_in_seconds":5132}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1826","title":"Episode 243: Understanding The Scheduler | BSD Now 243","url":"https://www.bsdnow.tv/243","content_text":"OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.\n\nHeadlines\n\nOpenBSD 6.3 released\n\n\nPunctual as ever, OpenBSD 6.3 has been releases with the following features/changes:\n\n\n\n  Improved HW support, including:\n  SMP support on OpenBSD/arm64 platforms\n  vmm/vmd improvements:\n  IEEE 802.11 wireless stack improvements\n  Generic network stack improvements\n  Installer improvements\n  Routing daemons and other userland network improvements\n  Security improvements\n  dhclient(8) improvements\n  Assorted improvements\n  OpenSMTPD 6.0.4\n  OpenSSH 7.7\n  LibreSSL 2.7.2\n  \n  \n\n\nDragonFlyBSD 5.2 released\n\n\n\n\n  Big-ticket items\n  Meltdown and Spectre mitigation support\n  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectremitigation and machdep.meltdownmitigation.\n  HAMMER2\n  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.\n  Clustered support is not yet available.\n  ipfw Updates\n  Implement state based \"redirect\", i.e. without using libalias.\n  ipfw now supports all possible ICMP types.\n  Fix ICMPMAXTYPE assumptions (now 40 as of this release).\n  Improved graphics support\n  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs\n  Add 24-bit pixel format support to the EFI frame buffer code.\n  Significantly improve fbio support for the \"scfb\" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.\n  Partly implement the FBIOBLANK ioctl for display powersaving.\n  Syscons waits for drm modesetting at appropriate places, avoiding races.\n  + For more details, check out the “All changes since DragonFly 5.0” section.\n\n\n\n\n\n\n\n\n\nZFS on Linux bug causes files to disappear\n\n\nA bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release\nThe bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows\nThe bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory\nZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory\nThe bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice.\nThe ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.\n\n\n\n  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed.\n  Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils.\n  On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit\n  Tools like rsync were unaffected, because they always sort the files before copying\n  If you did not see any ENOSPC errors, you were likely not impacted\n  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't.\n  Recommendations for Users from Ryan Yao:\n  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.\n  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.\n  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now.\n  Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk\n  \n  \n\n\nNews Roundup\n\n\n\ndes@’s thoughts on being a FreeBSD committer for 20 years\n\n\n\n\n  Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today.\n  \n  My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD.\n  \n  My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year.\n  \n  In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices.\n  \n  Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends.\n  \n  For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it.\n  \n  I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.\n\n\n\n\n\n\n\n\n\niXsystems unveils new TrueNAS M-Series Unified Storage Line\n\n\n\n\n  San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.\n\n\n\nDesigned for On-Premises &amp; Enterprise Cloud Environments\n\n\n\n  As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols.\n  \n  At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments.\n  \n  By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.\n\n\n\nFast\n\n\n\n  As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.\n\n\n\nAward-Winning TrueNAS Features\n\nEnterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;E, surveillance, and hosting virtual machines.\nUnified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application.\nEconomical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning.\nSafe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud.\nReliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime.\nFamiliar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software.\nCertified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure.\nOpen: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market.\nAvailability\n\n\n\n  The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.\n\n\n\nFor more information, visit www.ixsystems.com/TrueNAS \nTrueNAS M-Series What's New Video\n\n\n\n\nUnderstanding and tuning the FreeBSD Scheduler \n\n```\nOccasionally I noticed that the system would not quickly process the\ntasks i need done, but instead prefer other, longrunning tasks. I\nfigured it must be related to the scheduler, and decided it hates me.\n\nA closer look shows the behaviour as follows (single CPU):\n\nLets run an I/O-active task, e.g, postgres VACUUM that would\ncontinuously read from big files (while doing compute as well [1]):\n\n\n  pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0\n\n\nNow start an endless loop:\n\nwhile true; do :; done\n\nAnd the effect is:\n\n\n  pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G      9      0  76.8K      0\n\n\nThe VACUUM gets almost stuck! This figures with WCPU in \"top\":\n\n\n  PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND\n  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash\n  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres\n\n\nHacking on kern.sched.quantum makes it quite a bit better:\n\nsysctl kern.sched.quantum=1\n\nkern.sched.quantum: 94488 -&gt; 7874\n\n\n  pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G    395      0  3.12M      0\n  \n  PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND\n  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash\n  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres\n\n\nNow, as usual, the \"root-cause\" questions arise: What exactly does\nthis \"quantum\"? Is this solution a workaround, i.e. actually something\nelse is wrong, and has it tradeoff in other situations? Or otherwise,\nwhy is such a default value chosen, which appears to be ill-deceived?\n\nThe docs for the quantum parameter are a bit unsatisfying - they say\nits the max num of ticks a process gets - and what happens when\nthey're exhausted? If by default the endless loop is actually allowed\nto continue running for 94k ticks (or 94ms, more likely) uninterrupted,\nthen that explains the perceived behaviour - buts thats certainly not\nwhat a scheduler should do when other procs are ready to run.\n\n11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off does\nnot influence the matter. Starting the endless loop with \"nice\" does\nnot influence the matter.\n\n[1]\nA pure-I/O job without compute load, like \"dd\", does not show\nthis behaviour. Also, when other tasks are running, the unjust\nbehaviour is not so stongly pronounced.\n```\n\n\n\naarch64 support added\n\n\n  I have committed about adding initial support for aarch64.\n\n\n\nbooting log on RaspberryPI3:\n\n\n```\n    boot NetBSD/evbarm (aarch64)\n    Drop to EL1...OK\n    Creating VA=PA tables\n    Creating KSEG tables\n    Creating KVA=PA tables\n    Creating devmap tables\n    MMU Enable...OK\n    VSTART          = ffffffc000001ff4\n    FDT&lt;3ab46000&gt; devmap cpufunc bootstrap consinit ok\n    uboot: args 0x3ab46000, 0, 0, 0\n\nNetBSD/evbarm (fdt) booting ...\nFDT /memory [0] @ 0x0 size 0x3b000000\nMEM: add 0-3b000000\nMEM: res 0-1000\nMEM: res 3ab46000-3ab4a000\nUsable memory:\n  1000 - 3ab45fff\n  3ab4a000 - 3affffff\ninitarm: kernel phys start 1000000 end 17bd000\nMEM: res 1000000-17bd000\nbootargs: root=axe0\n  1000 - ffffff\n  17bd000 - 3ab45fff\n  3ab4a000 - 3affffff\n------------------------------------------\nkern_vtopdiff         = 0xffffffbfff000000\nphysical_start        = 0x0000000000001000\nkernel_start_phys     = 0x0000000001000000\nkernel_end_phys       = 0x00000000017bd000\nphysical_end          = 0x000000003ab45000\nVM_MIN_KERNEL_ADDRESS = 0xffffffc000000000\nkernel_start_l2       = 0xffffffc000000000\nkernel_start          = 0xffffffc000000000\nkernel_end            = 0xffffffc0007bd000\nkernel_end_l2         = 0xffffffc000800000\n(kernel va area)\n(devmap va area)\nVM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000\n------------------------------------------\nCopyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,\n    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,\n    2018 The NetBSD Foundation, Inc.  All rights reserved.\nCopyright (c) 1982, 1986, 1989, 1991, 1993\n    The Regents of the University of California.  All rights reserved.\n\nNetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018\n        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64\ntotal memory = 936 MB\navail memory = 877 MB\n\n\n…\n\nStarting local daemons:.\nUpdating motd.\nStarting sshd.\nStarting inetd.\nStarting cron.\nThe following components reported failures:\n    /etc/rc.d/swap2\nSee /var/run/rc.log for more information.\nFri Mar 30 12:35:31 JST 2018\n\nNetBSD/evbarm (rpi3) (console)\n\nlogin: root\nLast login: Fri Mar 30 12:30:24 2018 on console\n\nrpi3# uname -ap\nNetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64\nrpi3#\n\n\n```\n\n\n  Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues.\n  \n  sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP)\n  \n  My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64\n  toolchains and preliminary support for aarch64.\n\n\n\n\nBeastie Bits\n\n\n5 Reasons to Use FreeBSD in 2018\nRewriting Intel gigabit network driver in Rust\nRecruiting to make Elastic Search on FreeBSD better\nWindows Server 2019 Preview, in bhyve on FreeBSD\n“SSH Mastery, 2nd ed” in hardcover\n\n\n\n\nFeedback/Questions\n\n\nJason - ZFS Transfer option\nLuis - ZFS Pools\nClonOS \nMichael - Tech Conferences\nanonymous - BSD trash on removable drives\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.openbsd.org/63.html\">OpenBSD 6.3 released</a></h3>\n\n<ul>\n<li>Punctual as ever, OpenBSD 6.3 has been releases with the following features/changes:\n\n\n<blockquote>\n  Improved HW support, including:\n  SMP support on OpenBSD/arm64 platforms\n  vmm/vmd improvements:\n  IEEE 802.11 wireless stack improvements\n  Generic network stack improvements\n  Installer improvements\n  Routing daemons and other userland network improvements\n  Security improvements\n  dhclient(8) improvements\n  Assorted improvements\n  OpenSMTPD 6.0.4\n  OpenSSH 7.7\n  LibreSSL 2.7.2</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h3><a href=\"https://www.dragonflybsd.org/release52/\">DragonFlyBSD 5.2 released</a></h3>\n\n\n\n<blockquote>\n  <p>Big-ticket items\n  Meltdown and Spectre mitigation support\n  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectre<em>mitigation and machdep.meltdown</em>mitigation.\n  HAMMER2\n  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.\n  Clustered support is not yet available.\n  ipfw Updates\n  Implement state based \"redirect\", i.e. without using libalias.\n  ipfw now supports all possible ICMP types.\n  Fix ICMP<em>MAXTYPE assumptions (now 40 as of this release).\n  Improved graphics support\n  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs\n  Add 24-bit pixel format support to the EFI frame buffer code.\n  Significantly improve fbio support for the \"scfb\" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.\n  Partly implement the FBIO</em>BLANK ioctl for display powersaving.\n  Syscons waits for drm modesetting at appropriate places, avoiding races.\n  + For more details, check out the “All changes since DragonFly 5.0” section.</p>\n</blockquote>\n\n<hr />\n\n\n\n\n\n\n<h3><a href=\"https://github.com/zfsonlinux/zfs/issues/7401\">ZFS on Linux bug causes files to disappear</a></h3>\n\n<ul>\n<li>A bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release</li>\n<li>The bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows</li>\n<li>The bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory</li>\n<li>ZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory</li>\n<li>The bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice.</li>\n<li>The ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.\n\n\n<blockquote>\n  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed.</li>\n  <li>Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils.</li>\n  <li>On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit</li>\n  <li>Tools like rsync were unaffected, because they always sort the files before copying</li>\n  <li>If you did not see any ENOSPC errors, you were likely not impacted\n  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't.</li>\n  <li>Recommendations for Users from Ryan Yao:\n  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.\n  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.\n  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now.</li>\n  <li>Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h2>News Roundup</h2>\n\n\n\n<h3><a href=\"https://blog.des.no/2018/04/twenty-years/\">des@’s thoughts on being a FreeBSD committer for 20 years</a></h3>\n\n\n\n<blockquote>\n  <p>Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today.</p>\n  \n  <p>My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD.</p>\n  \n  <p>My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year.</p>\n  \n  <p>In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices.</p>\n  \n  <p>Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends.</p>\n  \n  <p>For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it.</p>\n  \n  <p>I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.</p>\n</blockquote>\n\n<hr />\n\n\n\n\n\n\n<h3><a href=\"https://www.ixsystems.com/blog/truenas-m-series/?utm_source=twitter.com&amp;utm_medium=bsdnow&amp;utm_campaign=truenas+m+series\">iXsystems unveils new TrueNAS M-Series Unified Storage Line</a></h3>\n\n\n\n<blockquote>\n  <p>San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.</p>\n</blockquote>\n\n<ul>\n<li>Designed for On-Premises &amp; Enterprise Cloud Environments</li>\n</ul>\n\n<blockquote>\n  <p>As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols.</p>\n  \n  <p>At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments.</p>\n  \n  <p>By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.</p>\n</blockquote>\n\n<ul>\n<li>Fast</li>\n</ul>\n\n<blockquote>\n  <p>As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.</p>\n</blockquote>\n\n<ul>\n<li><p>Award-Winning TrueNAS Features</p>\n\n<ul><li>Enterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;E, surveillance, and hosting virtual machines.</li>\n<li>Unified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application.</li>\n<li>Economical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning.</li>\n<li>Safe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud.</li>\n<li>Reliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime.</li>\n<li>Familiar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software.</li>\n<li>Certified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure.</li>\n<li>Open: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market.</li></ul></li>\n<li><p>Availability</p></li>\n</ul>\n\n<blockquote>\n  <p>The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.</p>\n</blockquote>\n\n<ul>\n<li>For more information, visit www.ixsystems.com/TrueNAS </li>\n<li><a href=\"TrueNAS M-Series What's New\">TrueNAS M-Series What's New Video</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/freebsd-stable/2018-April/088678.html\">Understanding and tuning the FreeBSD Scheduler </a></h3>\n\n<p>```\nOccasionally I noticed that the system would not quickly process the\ntasks i need done, but instead prefer other, longrunning tasks. I\nfigured it must be related to the scheduler, and decided it hates me.</p>\n\n<p>A closer look shows the behaviour as follows (single CPU):</p>\n\n<p>Lets run an I/O-active task, e.g, postgres VACUUM that would\ncontinuously read from big files (while doing compute as well [1]):</p>\n\n<blockquote>\n  <p>pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0</p>\n</blockquote>\n\n<p>Now start an endless loop:</p>\n\n<h1>while true; do :; done</h1>\n\n<p>And the effect is:</p>\n\n<blockquote>\n  <p>pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G      9      0  76.8K      0</p>\n</blockquote>\n\n<p>The VACUUM gets almost stuck! This figures with WCPU in \"top\":</p>\n\n<blockquote>\n  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND\n  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash\n  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres</p>\n</blockquote>\n\n<p>Hacking on kern.sched.quantum makes it quite a bit better:</p>\n\n<h1>sysctl kern.sched.quantum=1</h1>\n\n<p>kern.sched.quantum: 94488 -> 7874</p>\n\n<blockquote>\n  <p>pool        alloc   free   read  write   read  write\n  cache           -      -      -      -      -      -\n   ada1s4    7.08G  10.9G    395      0  3.12M      0</p>\n  \n  <p>PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND\n  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash\n  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres</p>\n</blockquote>\n\n<p>Now, as usual, the \"root-cause\" questions arise: What exactly does\nthis \"quantum\"? Is this solution a workaround, i.e. actually something\nelse is wrong, and has it tradeoff in other situations? Or otherwise,\nwhy is such a default value chosen, which appears to be ill-deceived?</p>\n\n<p>The docs for the quantum parameter are a bit unsatisfying - they say\nits the max num of ticks a process gets - and what happens when\nthey're exhausted? If by default the endless loop is actually allowed\nto continue running for 94k ticks (or 94ms, more likely) uninterrupted,\nthen that explains the perceived behaviour - buts thats certainly not\nwhat a scheduler should do when other procs are ready to run.</p>\n\n<p>11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off does\nnot influence the matter. Starting the endless loop with \"nice\" does\nnot influence the matter.</p>\n\n<p>[1]\nA pure-I/O job without compute load, like \"dd\", does not show\nthis behaviour. Also, when other tasks are running, the unjust\nbehaviour is not so stongly pronounced.\n```</p>\n\n<p><hr /></p>\n\n<h3><a href=\"https://mail-index.netbsd.org/port-arm/2018/04/01/msg004702.html\">aarch64 support added</a></h3>\n\n<blockquote>\n  <p>I have committed about adding initial support for aarch64.</p>\n</blockquote>\n\n<ul>\n<li>booting log on RaspberryPI3:</li>\n</ul>\n\n<p>```\n    boot NetBSD/evbarm (aarch64)\n    Drop to EL1...OK\n    Creating VA=PA tables\n    Creating KSEG tables\n    Creating KVA=PA tables\n    Creating devmap tables\n    MMU Enable...OK\n    VSTART          = ffffffc000001ff4\n    FDT&lt;3ab46000> devmap cpufunc bootstrap consinit ok\n    uboot: args 0x3ab46000, 0, 0, 0</p>\n\n<pre><code>NetBSD/evbarm (fdt) booting ...\nFDT /memory [0] @ 0x0 size 0x3b000000\nMEM: add 0-3b000000\nMEM: res 0-1000\nMEM: res 3ab46000-3ab4a000\nUsable memory:\n  1000 - 3ab45fff\n  3ab4a000 - 3affffff\ninitarm: kernel phys start 1000000 end 17bd000\nMEM: res 1000000-17bd000\nbootargs: root=axe0\n  1000 - ffffff\n  17bd000 - 3ab45fff\n  3ab4a000 - 3affffff\n------------------------------------------\nkern_vtopdiff         = 0xffffffbfff000000\nphysical_start        = 0x0000000000001000\nkernel_start_phys     = 0x0000000001000000\nkernel_end_phys       = 0x00000000017bd000\nphysical_end          = 0x000000003ab45000\nVM_MIN_KERNEL_ADDRESS = 0xffffffc000000000\nkernel_start_l2       = 0xffffffc000000000\nkernel_start          = 0xffffffc000000000\nkernel_end            = 0xffffffc0007bd000\nkernel_end_l2         = 0xffffffc000800000\n(kernel va area)\n(devmap va area)\nVM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000\n------------------------------------------\nCopyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,\n    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,\n    2018 The NetBSD Foundation, Inc.  All rights reserved.\nCopyright (c) 1982, 1986, 1989, 1991, 1993\n    The Regents of the University of California.  All rights reserved.\n\nNetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018\n        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64\ntotal memory = 936 MB\navail memory = 877 MB\n</code></pre>\n\n<p>…</p>\n\n<pre><code>Starting local daemons:.\nUpdating motd.\nStarting sshd.\nStarting inetd.\nStarting cron.\nThe following components reported failures:\n    /etc/rc.d/swap2\nSee /var/run/rc.log for more information.\nFri Mar 30 12:35:31 JST 2018\n\nNetBSD/evbarm (rpi3) (console)\n\nlogin: root\nLast login: Fri Mar 30 12:30:24 2018 on console\n\nrpi3# uname -ap\nNetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64\nrpi3#\n</code></pre>\n\n<p>```</p>\n\n<blockquote>\n  <p>Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues.</p>\n  \n  <p>sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP)</p>\n  \n  <p>My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64\n  toolchains and preliminary support for aarch64.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/watch?v=hvuWI5hzD5U\">5 Reasons to Use FreeBSD in 2018</a></li>\n<li><a href=\"https://twitter.com/johalun/status/983645780509712384\">Rewriting Intel gigabit network driver in Rust</a></li>\n<li><a href=\"https://twitter.com/DLangille/status/983360090240684034\">Recruiting to make Elastic Search on FreeBSD better</a></li>\n<li><a href=\"https://twitter.com/Tubsta/status/981058685219688448\">Windows Server 2019 Preview, in bhyve on FreeBSD</a></li>\n<li><a href=\"https://blather.michaelwlucas.com/archives/3126\">“SSH Mastery, 2nd ed” in hardcover</a></li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Jason - <a href=\"http://dpaste.com/0JN4V1K#wrap\">ZFS Transfer option</a></li>\n<li>Luis - <a href=\"http://dpaste.com/3MH4QRF#wrap\">ZFS Pools</a></li>\n<li><a href=\"https://clonos.tekroutine.com/\">ClonOS </a></li>\n<li>Michael - <a href=\"http://dpaste.com/3MN5F74#wrap\">Tech Conferences</a></li>\n<li>anonymous - <a href=\"http://dpaste.com/18J24QJ#wrap\">BSD trash on removable drives</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018.","date_published":"2018-04-25T16:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/bc8d0c60-eef3-488f-9d07-65122019420b.mp3","mime_type":"audio/mp3","size_in_bytes":61676635,"duration_in_seconds":5124}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1788","title":"Episode 242: Linux Takes The Fastpath | BSD Now 242","url":"https://www.bsdnow.tv/242","content_text":"TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.\n\nHeadlines\n\nTrueOS STABLE 18.03 Release\n\n\n  The TrueOS team is pleased to announce the availability of a new STABLE release of the TrueOS project (version 18.03). This is a special release due to the security issues impacting the computing world since the beginning of 2018. In particular, mitigating the “Meltdown” and “Spectre” system exploits make it necessary to update the entire package ecosystem for TrueOS. This release does not replace the scheduled June STABLE update, but provides the necessary and expected security updates for the STABLE release branch of TrueOS, even though this is part-way through our normal release cycle.\n\n\n\nImportant changes between version 17.12 and 18.03\n\n“Meltdown” security fixes: This release contains all the fixes to FreeBSD which mitigate the security issues for systems that utilize Intel-based processors when running virtual machines such as FreeBSD jails. Please note that virtual machines or jails must also be updated to a version of FreeBSD or TrueOS which contains these security fixes.\n“Spectre” security mitigations: This release contains all current mitigations from FreeBSD HEAD for the Spectre memory-isolation attacks (Variant 2). All 3rd-party packages for this release are also compiled with LLVM/Clang 6 (the “retpoline” mitigation strategy). This fixes many memory allocation issues and enforces stricter requirements for code completeness and memory usage within applications. Unfortunately, some 3rd-party applications became unavailable as pre-compiled packages due to non-compliance with these updated standards. These applications are currently being fixed either by the upstream authors or the FreeBSD port maintainers. If there are any concerns about the availability of a critical application for a specific workflow, please search through the changelog of packages between TrueOS 17.12 and 18.03 to verify the status of the application.\n\n\n\n  Most systems will need microcode updates for additional Spectre mitigations. The microcode updates are not enabled by default. This work is considered experimental because it is in active development by the upstream vendors. If desired, the microcode updates are available with the new devcpu-data package, which is available in the Appcafe. Install this package and enable the new microcode_update service to apply the latest runtime code when booting the system.\n\n\n\nImportant security-based package updates\n\nLibreSSL is updated from version 2.6.3 -&gt; 2.6.4\nReminder: LibreSSL is used on TrueOS to build any package which does not explicitly require OpenSSL. All applications that utilize the SSL transport layer are now running with the latest security updates.\nBrowser updates: (Keep in mind that many browsers have also implemented their own security mitigations in the aftermath of the Spectre exploit.)\nFirefox: 57.0.1 -&gt; 58.0.2\nChromium: 61.0.3163.100 -&gt; 63.0.3239.132\nQt5 Webengine (QupZilla, Falkon, many others): 5.7.1 -&gt; 5.9.4\nAll pre-compiled packages for this release are built with the latest versions of LLVM/Clang, unless the package explicitly requires GCC. These packages also utilize the latest compile-time mitigations for memory-access security concerns.\n\n\n\n\nF-Stack\n\n\n  F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API. http://www.f-stack.org\n\n\n\nIntroduction\nWith the rapid development of NIC, the poor performance of data packets processing with Linux kernel has become the bottleneck. However, the rapid development of the Internet needs high performance of network processing, kernel bypass has caught more and more attentions. There are various similar technologies appear, such as DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow, all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls and interrupts. Furthermore, kernel bypass can achieve higher performance with multi optimizing methods. Within various techniques, DPDK has been widely used because of its more thorough isolation from kernel scheduling and active community support.\nF-Stack is an open source network framework with high performance based on DPDK. With following characteristics\n\nUltra high network performance which can achieve network card under full load, 10 million concurrent connections, 5 million RPS, 1 million CPS.\nTransplant FreeBSD 11.01 user space stack, provides a complete stack function, cut a great amount of irrelevant features. Therefore greatly enhance the performance.\nSupport Nginx, Redis and other mature applications, service can easily use F-Stack\nWith Multi-process architecture, easy to extend\nProvide micro thread interface. Various applications with stateful app can easily use F-Stack to get high performance without processing complex asynchronous logic.\nProvide Epoll/Kqueue interface that allow many kinds of applications easily use F-Stack\nHistory\n\n\n\n  In order to deal with the increasingly severe DDoS attacks, authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options, one is to continue to use the original model another is to use kernel bypass technology. After several rounds of investigation, we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC in the future.\n  \n  After several months of development and testing, DKDNS, high-performance DNS server based on DPDK officially released in October 2013. It's capable of achieving up to 11 million QPS with a single 10GE port and 18.2 million QPS with two 10GE ports. And then we developed a user-space TCP/IP stack called F-Stack that can process 0.6 million RPS with a single 10GE port.\n  \n  With the fast growth of Tencent Cloud, more and more services need higher network access performance. Meanwhile, F-Stack was continuous improving driven by the business growth, and ultimately developed into a general network access framework. But this TCP/IP stack couldn't meet the needs of these services while continue to develop and maintain a complete network stack will cost high, we've tried several plans and finally determined to port FreeBSD(11.0 stable) TCP/IP stack into F-Stack. Thus, we can reduce the cost of maintenance and follow up the improvement from community quickly.Thanks to libplebnet and libuinet, this work becomes a lot easier.\n  \n  With the rapid development of all kinds of application, in order to help different APPs quick and easily use F-Stack, F-Stack has integrated Nginx, Redis and other commonly used APPs, and a micro thread framework, and provides a standard Epoll/Kqueue interface.\n  \n  Currently, besides authorized DNS server of DNSPod, there are various products in Tencent Cloud has used the F-Stack, such as HttpDNS (D+), COS access module, CDN access module, etc..\n\n\n\n\niXsystems\n\nLeadership Is The Secret To An Open Source Business Model\n\n\nA Forbes article by Mike Lauth, CEO of iXsystems\n\n\n\n  There is a good chance you’ve never heard of open source software and an even greater one that you’re using it every day without even realizing it. Open source software is computer software that is available under a variety of licenses that all encourage the sharing of the software and its underlying source code. Open source has powered the internet from day one and today powers the cloud and just about everything connected to it from your mobile phone to virtually every internet of things device.\n  FreeNAS is one of two open source operating systems that my company, iXsystems, develops and distributes free of charge and is at the heart of our line of TrueNAS enterprise storage products. While some of our competitors sell storage software similar to FreeNAS, we not only give it away but also do so with truly no strings attached -- competitors can and do take FreeNAS and build products based on it with zero obligation to share their changes. The freedom to do so is the fundamental tenet of permissively licensed open source software, and while it sounds self-defeating to be this generous, we’ve proven that leadership, not licensing, is the true secret to a successful open source business model.\n  We each have our own personal definition of what is fair when it comes to open source. At iXsystems, we made a conscious decision to base FreeNAS and TrueOS on the FreeBSD operating system developed by the FreeBSD project. We stand on the shoulders of giants by using FreeBSD and we consider it quite reasonable to give back on the same generous terms that the FreeBSD project offers us. We could be selective in what we provide free of charge, but we believe that doing so would be short-sighted. In the long game we’re playing, the leadership we provide over the open source projects we produce is infinitely more important than any restrictions provided by the licenses of those and other open source projects.\n  Twenty years in, we have no reason to change our free-software-on-great-hardware business model and giving away the software has brought an unexpected side-benefit: the largest Q/A department in the world, staffed by our passionate users who volunteer to let us know every thought they have about our software. We wouldn’t change a thing, and I encourage you to find exactly what win-win goodwill you and your company can provide to your constituents to make them not just a customer base but a community.\n  Drive The Conversation\n  It took a leap of faith for us to give away the heart of our products in exchange for a passionate community, but doing so changes your customer's relationship with your brand from priced to priceless. This kind of relationship leverages a social contract instead of a legal one. Taking this approach empowers your users in ways they will not experience with other companies and it is your responsibility to lead, rather than control them with a project like FreeNAS\n  Relieve Customer Pain Points With Every New Release\n  Responsiveness to the needs of your constituents is what distinguishes project leadership from project dictatorship. Be sure to balance your vision for your products and projects with the “real world” needs of your users. While our competition can use the software we develop, they will at best wow users with specific features rather than project-wide ones. Never underestimate how grateful a user will be when you make their job easier.\n  Accept That A Patent Is Not A Business Model\n  Patents are considered the ultimate control mechanism in the technology industry, but they only provide a business model if you have a monopoly and monopolies are illegal. Resist getting hung up on the control you can establish over your customers and spend your time acquiring and empowering them. The moment you both realize that your success is mutual, you have a relationship that will last longer than any single sale. You’ll be pleasantly surprised how the relationships you build will transcend the specific companies that friends you make work for.\n  Distinguish Leadership From Management\n  Every company has various levels of management, but leadership is the magic that creates markets where they did not exist and aligns paying customers with value that you can deliver in a profitable manner. Leadership and vision are ultimately the most proprietary aspects of a technology business, over every patentable piece of hardware or licensable piece of software. Whether you create a new market or bring efficiency to an existing one, your leadership is your secret weapon -- not your level of control.\n  \n  \n\n\nNews Roundup\n\n\n\nIntroduction to Jails and Jail Networking on FreeBSD\n\n\n\n\n  Jails basically partition a FreeBSD system into various isolated sub-systems called jails. The syscall and userspace tools first appeared in FreeBSD 4.0 (~ March 2000) with subsequent releases expanding functionality and improving existing features as well as usability.\n  + For Linux users, jails are similar to LXC, used for resource/process isolation. Unlike LXC however, jails are a first-class concept and are well integrated into the base system. Essentially however, both offer a chroot-with-extra-separation feeling.\n  Setting up a jail is a fairly simple process, which can essentially be split into three steps:\n    + Place the stuff you want to run and the stuff it needs to run somewhere on your filesystem.\n    + Add some basic configuration for the jail in jail.conf.\n    + Fire up the jail.\n  To confirm that the jail started successfully we can use the jls utility:\n  We can now enter the jailed environment by using jexec, which will by default execute a root shell inside the named jail\n  A jail can only see and use addresses that have been passed down to it by the parent system. This creates a slight problem with the loopback address: The host would probably like to keep that address to itself and not share it with any jail.\n  Because of this, the loopback-address inside a jail is emulated by the system:\n    + 127.0.0.1 is an alias for the first IPv4-address assigned to the jail.\n    + ::1 is an alias for the first IPv6-address assigned to the jail.\n  While this looks simple enough and usually works just fine[tm], it is also a source of many problems. Just imagine if your jail has only one single global IPv4 assigned to it. A daemon binding its (possibly unsecured) control port to the loopback-address would then unwillingly be exposed to the rest of the internet, which is hardly ever a good idea.\n  + So, create an extra loopback adapter, and make the first IP in each jail a private loopback address\n  + The tutorial goes on to cover making multiple jails share a single public IP address using NAT\n  + It also covers more advanced concepts like ‘thin’ jails, to save some disk space if you are going to create a large number of jails, and how to upgrade them after the fact\n  + Finally, it covers the integration with a lot of common tools, like identifying and filter jailed processes using top and ps, or using the package managers support for jails to install packages in a jail from the outside.\n\n\n\n\n\n\n**DigitalOcean**\n\n\n\nSmartOS release-20180315\n\n```\n\nHello All,\n\nThe latest bi-weekly \"release\" branch build of SmartOS is up:\n\n\ncurl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.iso\ncurl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest-USB.img.bz2\ncurl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.vmwarevm.tar.bz2\n\n\nA generated changelog is here:\n\nhttps://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos.html#20180329T002644Z\n\n\nThe full build bits directory, for those interested, is here in Manta:\n\n/Joyent_Dev/public/SmartOS/20180329T002644Z\n\n\nHighlights\n\nFirewall rules created with fwadm(1M) can now use the PRIORITY keyword to\nspecify a higher precedence for a rule.\n\nThis release has includes mitigation of the Intel Meltdown vulnerability in the\nform of kpti (kernel page table isolation) with PCID (process context\nidentifier) support\n\nThis release also includes experimental support for bhyve branded zones.\n\n\n\n\nGeneral Info\n\nEvery second Thursday we roll a \"release-YYYYMMDD\" release branch and\nbuilds for SmartOS (and Triton DataCenter and Manta, as well).\n\nCheers,\nJosh Wilsdon, on behalf of the SmartOS developers\nhttps://smartos.org\n``` \n\n\nHere's a screencap from q5sys' machine showing the output of sysinfo: https://i.imgur.com/MFkNi76.jpg\n\n\n\n\nFreeBSD Foundation March 2018 Update\n\n\n&gt; Syzkaller update: Syzkaller is a coverage-guided system call fuzzer. It invokes syscalls with arbitrary and changing inputs, and is intended to use code coverage data to guide changes to system call inputs in order to access larger and larger portions of the kernel in the search for bugs.\n&gt; Last term’s student focused largely on scripts to deploy and configure Syzkaller on Packet.net’s hosting infrastructure, but did not get to the code coverage integration required for Syzkaller to be effective. This term co-op student Mitchell Horne has been adding code coverage support in FreeBSD for Syzkaller.\n&gt; The Linux code coverage support for Syzkaller is known as kcov and was submitted by Dmitry Vyukov, Syzkaller’s author. Kcov is purposebuilt for Syzkaller:\n&gt; kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system.\n&gt; kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disabled (e.g. scheduler, locking).\n&gt; Mitchell implemented equivalent functionality for FreeBSD - a distinct implementation, but modelled on the one in Linux. These patches are currently in review, as are minor changes to Syzkaller to use the new interface on FreeBSD.\n&gt; We still have some additional work to fully integrate Syzkaller and run it on a consistent basis, but the brief testing that has been completed suggests this work will provide a very valuable improvement in test coverage and opportunities for system hardening: we tested Syzkaller with Mitchell's code coverage patch over a weekend. It provoked kernel crashes hundreds of times faster than without his work.\n&gt; I want to say thank you to NetApp for becoming an Iridium Partner again this\nyear! (Donations between $100,000 - $249,999) It’s companies like NetApp, who recognize the importance of supporting our efforts, that allow us to continue to provide software improvements, advocate for FreeBSD, and help lead the release engineering and security efforts.\n&gt; Conference Recap: FOSSASIA 2018\nFoundation Director Philip Paeps went to FOSSASIA, which is possibly the largest open source event in Asia. The FreeBSD Foundation sponsored the conference.\nOur booth had a constant stream of traffic over the weekend and we handed out hundreds of FreeBSD stickers, pens and flyers. Many attendees of FOSSASIA had never heard of FreeBSD before and are now keen to start exploring and perhaps even contributing. By the end of the conference, there were FreeBSD stickers everywhere!\n&gt; One particular hallway-track conversation led to an invitation to present FreeBSD at a \"Women Who Code\" evening in Kuala Lumpur later this week (Thursday 29th March). I spent the days after the conference meeting companies who use (or want to use) FreeBSD in Singapore.\n&gt; SCaLE 16x: The Foundation sponsored a FreeBSD table in the expo hall that was\nstaffed by Dru Lavigne, Warren Block, and Deb Goodkin. Our purpose was to promote FreeBSD, and attract more users and contributors to the Project. We had a steady flow of people stopping by our table, asking inquisitive questions, and picking up some cool swag and FreeBSD handouts.\nDeb Goodkin took some tutorials/trainings there and talked to a lot of other open source projects.\n\n  Next year, we have the opportunity to have a BSD track, similar to the BSD Devroom at FOSDEM. We are looking for some volunteers in Southern California who can help organize this one or two-day event and help us educate more people about the BSDs. Let us know if you\n  would like to help with this effort.\n\n\n  Roll Call: #WhoUsesFreeBSD\n\n\n  Many of you probably saw our post on social media asking Who Uses FreeBSD. Please help us answer this question to assist us in determining FreeBSD market share data, promote how companies are successfully using FreeBSD to encourage more companies to embrace\n  FreeBSD, and to update the list of users on our website. Knowing who uses FreeBSD helps our contributors know where to look for jobs; knowing what universities teach with FreeBSD, helps companies know where to recruit, and knowing what products use FreeBSD helps us determine what features and technologies to support.\n\n\n  New Hosting Partner: Oregon State University Open Source Lab\n\n&gt; We are pleased to announce that the Oregon State University (OSU) Open Source Lab (OSL), which hosts infrastructure for over 160 different open source projects, has agreed to host some of our servers for FreeBSD development.  The first server, which should be arriving shortly, is an HP Enterprise Proliant DL360 Gen10 configured with NVDIMM memory which will be initially used for further development and testing of permanent memory support in the kernel.\nStay tuned for more news from the FreeBSD Foundation in May (next newsletter).\n\n\n\n\nBeastie Bits\n\n\ncURL is 20 today\nA Note on SYSVIPC and Jails on FreeBSD\nOpenBSD Errata: March 20th, 2018 (ipsec)\nFreeBSD Security Advisories for IPSEC and vt \n23 Useful PKG Command Examples to Manage Packages in FreeBSD\n\n\n\n\nTarsnap\n\nFeedback/Questions\n\n\nCasey - Cool Editor\nNelson - New article on FreeBSD vs MacOS\nDamian - Mysterious Reverse Proxy 504\nNelson - FreeBSD, rsync, nasty bug, now fixed\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://trueos.org/blog/trueos-stable-18-03-release/\">TrueOS STABLE 18.03 Release</a></h3>\n\n<blockquote>\n  <p>The TrueOS team is pleased to announce the availability of a new STABLE release of the TrueOS project (version 18.03). This is a special release due to the security issues impacting the computing world since the beginning of 2018. In particular, mitigating the “Meltdown” and “Spectre” system exploits make it necessary to update the entire package ecosystem for TrueOS. This release does not replace the scheduled June STABLE update, but provides the necessary and expected security updates for the STABLE release branch of TrueOS, even though this is part-way through our normal release cycle.</p>\n</blockquote>\n\n<ul>\n<li><p>Important changes between version 17.12 and 18.03</p>\n\n<ul><li>“Meltdown” security fixes: This release contains all the fixes to FreeBSD which mitigate the security issues for systems that utilize Intel-based processors when running virtual machines such as FreeBSD jails. Please note that virtual machines or jails must also be updated to a version of FreeBSD or TrueOS which contains these security fixes.</li>\n<li>“Spectre” security mitigations: This release contains all current mitigations from FreeBSD HEAD for the Spectre memory-isolation attacks (Variant 2). All 3rd-party packages for this release are also compiled with LLVM/Clang 6 (the “retpoline” mitigation strategy). This fixes many memory allocation issues and enforces stricter requirements for code completeness and memory usage within applications. Unfortunately, some 3rd-party applications became unavailable as pre-compiled packages due to non-compliance with these updated standards. These applications are currently being fixed either by the upstream authors or the FreeBSD port maintainers. If there are any concerns about the availability of a critical application for a specific workflow, please search through the changelog of packages between TrueOS 17.12 and 18.03 to verify the status of the application.</li></ul></li>\n</ul>\n\n<blockquote>\n  <p>Most systems will need microcode updates for additional Spectre mitigations. The microcode updates are not enabled by default. This work is considered experimental because it is in active development by the upstream vendors. If desired, the microcode updates are available with the new devcpu-data package, which is available in the Appcafe. Install this package and enable the new microcode_update service to apply the latest runtime code when booting the system.</p>\n</blockquote>\n\n<ul>\n<li><p>Important security-based package updates</p>\n\n<ul><li>LibreSSL is updated from version 2.6.3 -> 2.6.4</li>\n<li>Reminder: LibreSSL is used on TrueOS to build any package which does not explicitly require OpenSSL. All applications that utilize the SSL transport layer are now running with the latest security updates.</li>\n<li>Browser updates: (Keep in mind that many browsers have also implemented their own security mitigations in the aftermath of the Spectre exploit.)</li>\n<li>Firefox: 57.0.1 -> 58.0.2</li>\n<li>Chromium: 61.0.3163.100 -> 63.0.3239.132</li>\n<li>Qt5 Webengine (QupZilla, Falkon, many others): 5.7.1 -> 5.9.4</li></ul></li>\n<li><p>All pre-compiled packages for this release are built with the latest versions of LLVM/Clang, unless the package explicitly requires GCC. These packages also utilize the latest compile-time mitigations for memory-access security concerns.</p></li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://github.com/F-Stack/f-stack\">F-Stack</a></h3>\n\n<blockquote>\n  <p>F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API. http://www.f-stack.org</p>\n</blockquote>\n\n<ul>\n<li><p>Introduction\nWith the rapid development of NIC, the poor performance of data packets processing with Linux kernel has become the bottleneck. However, the rapid development of the Internet needs high performance of network processing, kernel bypass has caught more and more attentions. There are various similar technologies appear, such as DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow, all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls and interrupts. Furthermore, kernel bypass can achieve higher performance with multi optimizing methods. Within various techniques, DPDK has been widely used because of its more thorough isolation from kernel scheduling and active community support.</p></li>\n<li><p>F-Stack is an open source network framework with high performance based on DPDK. With following characteristics</p>\n\n<ul><li>Ultra high network performance which can achieve network card under full load, 10 million concurrent connections, 5 million RPS, 1 million CPS.</li>\n<li>Transplant FreeBSD 11.01 user space stack, provides a complete stack function, cut a great amount of irrelevant features. Therefore greatly enhance the performance.</li>\n<li>Support Nginx, Redis and other mature applications, service can easily use F-Stack</li>\n<li>With Multi-process architecture, easy to extend</li>\n<li>Provide micro thread interface. Various applications with stateful app can easily use F-Stack to get high performance without processing complex asynchronous logic.</li>\n<li>Provide Epoll/Kqueue interface that allow many kinds of applications easily use F-Stack</li></ul></li>\n<li><p>History</p></li>\n</ul>\n\n<blockquote>\n  <p>In order to deal with the increasingly severe DDoS attacks, authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options, one is to continue to use the original model another is to use kernel bypass technology. After several rounds of investigation, we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC in the future.</p>\n  \n  <p>After several months of development and testing, DKDNS, high-performance DNS server based on DPDK officially released in October 2013. It's capable of achieving up to 11 million QPS with a single 10GE port and 18.2 million QPS with two 10GE ports. And then we developed a user-space TCP/IP stack called F-Stack that can process 0.6 million RPS with a single 10GE port.</p>\n  \n  <p>With the fast growth of Tencent Cloud, more and more services need higher network access performance. Meanwhile, F-Stack was continuous improving driven by the business growth, and ultimately developed into a general network access framework. But this TCP/IP stack couldn't meet the needs of these services while continue to develop and maintain a complete network stack will cost high, we've tried several plans and finally determined to port FreeBSD(11.0 stable) TCP/IP stack into F-Stack. Thus, we can reduce the cost of maintenance and follow up the improvement from community quickly.Thanks to libplebnet and libuinet, this work becomes a lot easier.</p>\n  \n  <p>With the rapid development of all kinds of application, in order to help different APPs quick and easily use F-Stack, F-Stack has integrated Nginx, Redis and other commonly used APPs, and a micro thread framework, and provides a standard Epoll/Kqueue interface.</p>\n  \n  <p>Currently, besides authorized DNS server of DNSPod, there are various products in Tencent Cloud has used the F-Stack, such as HttpDNS (D+), COS access module, CDN access module, etc..</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong></p>\n\n<h3><a href=\"https://www.forbes.com/sites/forbestechcouncil/2018/04/02/leadership-is-the-secret-to-an-open-source-business-model/#a2beca765c78\">Leadership Is The Secret To An Open Source Business Model</a></h3>\n\n<ul>\n<li>A Forbes article by Mike Lauth, CEO of iXsystems\n\n\n<blockquote>\n  There is a good chance you’ve never heard of open source software and an even greater one that you’re using it every day without even realizing it. Open source software is computer software that is available under a variety of licenses that all encourage the sharing of the software and its underlying source code. Open source has powered the internet from day one and today powers the cloud and just about everything connected to it from your mobile phone to virtually every internet of things device.\n  FreeNAS is one of two open source operating systems that my company, iXsystems, develops and distributes free of charge and is at the heart of our line of TrueNAS enterprise storage products. While some of our competitors sell storage software similar to FreeNAS, we not only give it away but also do so with truly no strings attached -- competitors can and do take FreeNAS and build products based on it with zero obligation to share their changes. The freedom to do so is the fundamental tenet of permissively licensed open source software, and while it sounds self-defeating to be this generous, we’ve proven that leadership, not licensing, is the true secret to a successful open source business model.\n  We each have our own personal definition of what is fair when it comes to open source. At iXsystems, we made a conscious decision to base FreeNAS and TrueOS on the FreeBSD operating system developed by the FreeBSD project. We stand on the shoulders of giants by using FreeBSD and we consider it quite reasonable to give back on the same generous terms that the FreeBSD project offers us. We could be selective in what we provide free of charge, but we believe that doing so would be short-sighted. In the long game we’re playing, the leadership we provide over the open source projects we produce is infinitely more important than any restrictions provided by the licenses of those and other open source projects.\n  Twenty years in, we have no reason to change our free-software-on-great-hardware business model and giving away the software has brought an unexpected side-benefit: the largest Q/A department in the world, staffed by our passionate users who volunteer to let us know every thought they have about our software. We wouldn’t change a thing, and I encourage you to find exactly what win-win goodwill you and your company can provide to your constituents to make them not just a customer base but a community.</li>\n  <li>Drive The Conversation\n  It took a leap of faith for us to give away the heart of our products in exchange for a passionate community, but doing so changes your customer's relationship with your brand from priced to priceless. This kind of relationship leverages a social contract instead of a legal one. Taking this approach empowers your users in ways they will not experience with other companies and it is your responsibility to lead, rather than control them with a project like FreeNAS</li>\n  <li>Relieve Customer Pain Points With Every New Release\n  Responsiveness to the needs of your constituents is what distinguishes project leadership from project dictatorship. Be sure to balance your vision for your products and projects with the “real world” needs of your users. While our competition can use the software we develop, they will at best wow users with specific features rather than project-wide ones. Never underestimate how grateful a user will be when you make their job easier.</li>\n  <li>Accept That A Patent Is Not A Business Model\n  Patents are considered the ultimate control mechanism in the technology industry, but they only provide a business model if you have a monopoly and monopolies are illegal. Resist getting hung up on the control you can establish over your customers and spend your time acquiring and empowering them. The moment you both realize that your success is mutual, you have a relationship that will last longer than any single sale. You’ll be pleasantly surprised how the relationships you build will transcend the specific companies that friends you make work for.</li>\n  <li>Distinguish Leadership From Management\n  Every company has various levels of management, but leadership is the magic that creates markets where they did not exist and aligns paying customers with value that you can deliver in a profitable manner. Leadership and vision are ultimately the most proprietary aspects of a technology business, over every patentable piece of hardware or licensable piece of software. Whether you create a new market or bring efficiency to an existing one, your leadership is your secret weapon -- not your level of control.</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h2>News Roundup</h2>\n\n\n\n<h3><a href=\"https://www.skyforge.at/posts/an-introduction-to-jails-and-jail-networking/\">Introduction to Jails and Jail Networking on FreeBSD</a></h3>\n\n\n\n<blockquote>\n  <p>Jails basically partition a FreeBSD system into various isolated sub-systems called jails. The syscall and userspace tools first appeared in FreeBSD 4.0 (~ March 2000) with subsequent releases expanding functionality and improving existing features as well as usability.\n  + For Linux users, jails are similar to LXC, used for resource/process isolation. Unlike LXC however, jails are a first-class concept and are well integrated into the base system. Essentially however, both offer a chroot-with-extra-separation feeling.\n  Setting up a jail is a fairly simple process, which can essentially be split into three steps:\n    + Place the stuff you want to run and the stuff it needs to run somewhere on your filesystem.\n    + Add some basic configuration for the jail in jail.conf.\n    + Fire up the jail.\n  To confirm that the jail started successfully we can use the jls utility:\n  We can now enter the jailed environment by using jexec, which will by default execute a root shell inside the named jail\n  A jail can only see and use addresses that have been passed down to it by the parent system. This creates a slight problem with the loopback address: The host would probably like to keep that address to itself and not share it with any jail.\n  Because of this, the loopback-address inside a jail is emulated by the system:\n    + 127.0.0.1 is an alias for the first IPv4-address assigned to the jail.\n    + ::1 is an alias for the first IPv6-address assigned to the jail.\n  While this looks simple enough and usually works just fine[tm], it is also a source of many problems. Just imagine if your jail has only one single global IPv4 assigned to it. A daemon binding its (possibly unsecured) control port to the loopback-address would then unwillingly be exposed to the rest of the internet, which is hardly ever a good idea.\n  + So, create an extra loopback adapter, and make the first IP in each jail a private loopback address\n  + The tutorial goes on to cover making multiple jails share a single public IP address using NAT\n  + It also covers more advanced concepts like ‘thin’ jails, to save some disk space if you are going to create a large number of jails, and how to upgrade them after the fact\n  + Finally, it covers the integration with a lot of common tools, like identifying and filter jailed processes using top and ps, or using the package managers support for jails to install packages in a jail from the outside.</p>\n</blockquote>\n\n<hr />\n\n\n\n**DigitalOcean**\n\n\n\n<h3>SmartOS release-20180315</h3>\n\n```\n\nHello All,\n\nThe latest bi-weekly \"release\" branch build of SmartOS is up:\n\n\n<pre><code>curl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.iso\ncurl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest-USB.img.bz2\ncurl -C - -O https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos-latest.vmwarevm.tar.bz2\n</code></pre>\n\nA generated changelog is here:\n\n<pre><code>https://us-east.manta.joyent.com/Joyent_Dev/public/SmartOS/smartos.html#20180329T002644Z\n</code></pre>\n\nThe full build bits directory, for those interested, is here in Manta:\n\n<pre><code>/Joyent_Dev/public/SmartOS/20180329T002644Z\n</code></pre>\n\n<h1>Highlights</h1>\n\nFirewall rules created with fwadm(1M) can now use the PRIORITY keyword to\nspecify a higher precedence for a rule.\n\nThis release has includes mitigation of the Intel Meltdown vulnerability in the\nform of kpti (kernel page table isolation) with PCID (process context\nidentifier) support\n\nThis release also includes experimental support for bhyve branded zones.\n\n\n\n\n<h1>General Info</h1>\n\nEvery second Thursday we roll a \"release-YYYYMMDD\" release branch and\nbuilds for SmartOS (and Triton DataCenter and Manta, as well).\n\nCheers,\nJosh Wilsdon, on behalf of the SmartOS developers\nhttps://smartos.org\n``` \n\n<ul>\n<li>Here's a screencap from q5sys' machine showing the output of sysinfo: https://i.imgur.com/MFkNi76.jpg</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://www.freebsdfoundation.org/wp-content/uploads/2018/03/FreeBSD-Foundation-March-2018-Update-1.pdf\">FreeBSD Foundation March 2018 Update</a></h3>\n\n<ul>\n<li>> Syzkaller update: Syzkaller is a coverage-guided system call fuzzer. It invokes syscalls with arbitrary and changing inputs, and is intended to use code coverage data to guide changes to system call inputs in order to access larger and larger portions of the kernel in the search for bugs.</li>\n<li>> Last term’s student focused largely on scripts to deploy and configure Syzkaller on Packet.net’s hosting infrastructure, but did not get to the code coverage integration required for Syzkaller to be effective. This term co-op student Mitchell Horne has been adding code coverage support in FreeBSD for Syzkaller.</li>\n<li>> The Linux code coverage support for Syzkaller is known as kcov and was submitted by Dmitry Vyukov, Syzkaller’s author. Kcov is purposebuilt for Syzkaller:\n<ul><li>> kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system.</li>\n<li>> kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disabled (e.g. scheduler, locking).</li></ul></li>\n<li>> Mitchell implemented equivalent functionality for FreeBSD - a distinct implementation, but modelled on the one in Linux. These patches are currently in review, as are minor changes to Syzkaller to use the new interface on FreeBSD.</li>\n<li>> We still have some additional work to fully integrate Syzkaller and run it on a consistent basis, but the brief testing that has been completed suggests this work will provide a very valuable improvement in test coverage and opportunities for system hardening: we tested Syzkaller with Mitchell's code coverage patch over a weekend. It provoked kernel crashes hundreds of times faster than without his work.</li>\n<li>> I want to say thank you to NetApp for becoming an Iridium Partner again this\nyear! (Donations between $100,000 - $249,999) It’s companies like NetApp, who recognize the importance of supporting our efforts, that allow us to continue to provide software improvements, advocate for FreeBSD, and help lead the release engineering and security efforts.</li>\n<li>> Conference Recap: FOSSASIA 2018</li>\n<li>Foundation Director Philip Paeps went to FOSSASIA, which is possibly the largest open source event in Asia. The FreeBSD Foundation sponsored the conference.</li>\n<li>Our booth had a constant stream of traffic over the weekend and we handed out hundreds of FreeBSD stickers, pens and flyers. Many attendees of FOSSASIA had never heard of FreeBSD before and are now keen to start exploring and perhaps even contributing. By the end of the conference, there were FreeBSD stickers everywhere!</li>\n<li>> One particular hallway-track conversation led to an invitation to present FreeBSD at a \"Women Who Code\" evening in Kuala Lumpur later this week (Thursday 29th March). I spent the days after the conference meeting companies who use (or want to use) FreeBSD in Singapore.</li>\n<li>> SCaLE 16x: The Foundation sponsored a FreeBSD table in the expo hall that was\nstaffed by Dru Lavigne, Warren Block, and Deb Goodkin. Our purpose was to promote FreeBSD, and attract more users and contributors to the Project. We had a steady flow of people stopping by our table, asking inquisitive questions, and picking up some cool swag and FreeBSD handouts.</li>\n<li>Deb Goodkin took some tutorials/trainings there and talked to a lot of other open source projects.</li>\n<li><blockquote>\n  <p>Next year, we have the opportunity to have a BSD track, similar to the BSD Devroom at FOSDEM. We are looking for some volunteers in Southern California who can help organize this one or two-day event and help us educate more people about the BSDs. Let us know if you\n  would like to help with this effort.</p>\n</blockquote></li>\n<li><blockquote>\n  <p>Roll Call: #WhoUsesFreeBSD</p>\n</blockquote></li>\n<li><blockquote>\n  <p>Many of you probably saw our post on social media asking Who Uses FreeBSD. Please help us answer this question to assist us in determining FreeBSD market share data, promote how companies are successfully using FreeBSD to encourage more companies to embrace\n  FreeBSD, and to update the list of users on our website. Knowing who uses FreeBSD helps our contributors know where to look for jobs; knowing what universities teach with FreeBSD, helps companies know where to recruit, and knowing what products use FreeBSD helps us determine what features and technologies to support.</p>\n</blockquote></li>\n<li><blockquote>\n  <p>New Hosting Partner: Oregon State University Open Source Lab</p>\n</blockquote></li>\n<li>> We are pleased to announce that the Oregon State University (OSU) Open Source Lab (OSL), which hosts infrastructure for over 160 different open source projects, has agreed to host some of our servers for FreeBSD development.  The first server, which should be arriving shortly, is an HP Enterprise Proliant DL360 Gen10 configured with NVDIMM memory which will be initially used for further development and testing of permanent memory support in the kernel.</li>\n<li>Stay tuned for more news from the FreeBSD Foundation in May (next newsletter).</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://daniel.haxx.se/blog/2018/03/20/twenty-years-1998-2018/\">cURL is 20 today</a></li>\n<li><a href=\"https://www.skyforge.at/posts/a-note-in-sysvipc-and-jails-on-freebsd/\">A Note on SYSVIPC and Jails on FreeBSD</a></li>\n<li><a href=\"https://marc.info/?l=openbsd-announce&amp;m=152149507725894&amp;w=2\">OpenBSD Errata: March 20th, 2018 (ipsec)</a></li>\n<li><a href=\"https://www.freebsd.org/security/advisories.html\">FreeBSD Security Advisories for IPSEC and vt </a></li>\n<li><a href=\"https://www.tecmint.com/pkg-command-examples-to-manage-packages-in-freebsd/\">23 Useful PKG Command Examples to Manage Packages in FreeBSD</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Casey - <a href=\"http://dpaste.com/2VMH555#wrap\">Cool Editor</a></li>\n<li>Nelson - <a href=\"http://dpaste.com/2NTE4SD#wrap\">New article on FreeBSD vs MacOS</a></li>\n<li>Damian - <a href=\"http://dpaste.com/0FYWVHD#wrap\">Mysterious Reverse Proxy 504</a></li>\n<li>Nelson - <a href=\"http://dpaste.com/0BTGTVP#wrap\">FreeBSD, rsync, nasty bug, now fixed</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"TrueOS Stable 18.03 released, a look at F-stack, the secret to an open source business model, intro to jails and jail networking, FreeBSD Foundation March update, and the ipsec Errata.","date_published":"2018-04-18T14:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/729a44d2-5a5b-4879-8700-d519931d67f0.mp3","mime_type":"audio/mp3","size_in_bytes":60077262,"duration_in_seconds":5000}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1749","title":"Episode 241: Bowling in the LimeLight | BSD Now 241","url":"https://www.bsdnow.tv/241","content_text":"Second round of ZFS improvements in FreeBSD, Postgres finds that non-FreeBSD/non-Illumos systems are corrupting data, interview with Kevin Bowling, BSDCan list of talks, and cryptographic right answers.\n\nHeadlines\n\n[Other big ZFS improvements you might have missed]\n\n\n9075 Improve ZFS pool import/load process and corrupted pool recovery\n\n\n\n  One of the first tasks during the pool load process is to parse a config provided from userland that describes what devices the pool is composed of. A vdev tree is generated from that config, and then all the vdevs are opened.\n  The Meta Object Set (MOS) of the pool is accessed, and several metadata objects that are necessary to load the pool are read. The exact configuration of the pool is also stored inside the MOS. Since the configuration provided from userland is external and might not accurately describe the vdev tree of the pool at the txg that is being loaded, it cannot be relied upon to safely operate the pool. For that reason, the configuration in the MOS is read early on. In the past, the two configurations were compared together and if there was a mismatch then the load process was aborted and an error was returned.\n  The latter was a good way to ensure a pool does not get corrupted, however it made the pool load process needlessly fragile in cases where the vdev configuration changed or the userland configuration was outdated. Since the MOS is stored in 3 copies, the configuration provided by userland doesn't have to be perfect in order to read its contents. Hence, a new approach has been adopted: The pool is first opened with the untrusted userland configuration just so that the real configuration can be read from the MOS. The trusted MOS configuration is then used to generate a new vdev tree and the pool is re-opened.\n  When the pool is opened with an untrusted configuration, writes are disabled to avoid accidentally damaging it. During reads, some sanity checks are performed on block pointers to see if each DVA points to a known vdev; when the configuration is untrusted, instead of panicking the system if those checks fail we simply avoid issuing reads to the invalid DVAs.\n  This new two-step pool load process now allows rewinding pools across vdev tree changes such as device replacement, addition, etc. Loading a pool from an external config file in a clustering environment also becomes much safer now since the pool will import even if the config is outdated and didn't, for instance, register a recent device addition.\n  With this code in place, it became relatively easy to implement a long-sought-after feature: the ability to import a pool with missing top level (i.e. non-redundant) devices. Note that since this almost guarantees some loss Of data, this feature is for now restricted to a read-only import.\n  \n  \n  7614 zfs device evacuation/removal\n  This project allows top-level vdevs to be removed from the storage pool with “zpool remove”, reducing the total amount of storage in the pool. This operation copies all allocated regions of the device to be removed onto other devices, recording the mapping from old to new location. After the removal is complete, read and free operations to the removed (now “indirect”) vdev must be remapped and performed at the new location on disk. The indirect mapping table is kept in memory whenever the pool is loaded, so there is minimal performance overhead when doing operations on the indirect vdev.\n  The size of the in-memory mapping table will be reduced when its entries become “obsolete” because they are no longer used by any block pointers in the pool. An entry becomes obsolete when all the blocks that use it are freed. An entry can also become obsolete when all the snapshots that reference it are deleted, and the block pointers that reference it have been “remapped” in all filesystems/zvols (and clones). Whenever an indirect block is written, all the block pointers in it will be “remapped” to their new (concrete) locations if possible. This process can be accelerated by using the “zfs remap” command to proactively rewrite all indirect blocks that reference indirect (removed) vdevs.\n  Note that when a device is removed, we do not verify the checksum of the data that is copied. This makes the process much faster, but if it were used on redundant vdevs (i.e. mirror or raidz vdevs), it would be possible to copy the wrong data, when we have the correct data on e.g. the other side of the mirror. Therefore, mirror and raidz devices can not be removed.\n  You can use ‘zpool detach’ to downgrade a mirror to a single top-level device, so that you can then remove it\n  \n  7446 zpool create should support efi system partition\n  This one was not actually merged into FreeBSD, as it doesn’t apply currently, but I would like to switch the way FreeBSD deals with full disks to be closer to IllumOS to make automatic spare replacement a hands-off operation.\n  Since we support whole-disk configuration for boot pool, we also will need whole disk support with UEFI boot and for this, zpool create should create efi-system partition. I have borrowed the idea from oracle solaris, and introducing zpool create -B switch to provide an way to specify that boot partition should be created. However, there is still an question, how big should the system partition be. For time being, I have set default size 256MB (thats minimum size for FAT32 with 4k blocks). To support custom size, the set on creation \"bootsize\" property is created and so the custom size can be set as: zpool create -B -o bootsize=34MB rpool c0t0d0. After the pool is created, the \"bootsize\" property is read only. When -B switch is not used, the bootsize defaults to 0 and is shown in zpool get output with no value. Older zfs/zpool implementations can ignore this property.\n  \n  \n  \n\n\n**Digital Ocean**\n\n\n\nPostgreSQL developers find that every operating system other than FreeBSD and IllumOS might corrupt your data\n\n\n\n\n  Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error.\n  TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux. When fsync() returns success it means \"all writes since the last fsync have hit disk\" but we assume it means \"all writes since the last SUCCESSFUL fsync have hit disk\".\n  Pg wrote some blocks, which went to OS dirty buffers for writeback. Writeback failed due to an underlying storage error. The block I/O layer and XFS marked the writeback page as failed (ASEIO), but had no way to tell the app about the failure. When Pg called fsync() on the FD during the next checkpoint, fsync() returned EIO because of the flagged page, to tell Pg that a previous async write failed. Pg treated the checkpoint as failed and didn't advance the redo start position in the control file.\n  + All good so far.\n  But then we retried the checkpoint, which retried the fsync(). The retry succeeded, because the prior fsync() *cleared the ASEIO bad page flag*.\n  The write never made it to disk, but we completed the checkpoint, and merrily carried on our way. Whoops, data loss.\n  The clear-error-and-continue behaviour of fsync is not documented as far as I can tell. Nor is fsync() returning EIO unless you have a very new linux man-pages with the patch I wrote to add it. But from what I can see in the POSIX standard we are not given any guarantees about what happens on fsync() failure at all, so we're probably wrong to assume that retrying fsync() is safe.\n  We already PANIC on fsync() failure for WAL segments. We just need to do the same for data forks at least for EIO. This isn't as bad as it seems because AFAICS fsync only returns EIO in cases where we should be stopping the world anyway, and many FSes will do that for us.\n  + Upon further looking, it turns out it is not just Linux brain damage:\n  Apparently I was too optimistic.  I had looked only at FreeBSD, which keeps the page around and dirties it so we can retry, but the other BSDs apparently don't (FreeBSD changed that in 1999).\n  From what I can tell from the sources below, we have: Linux, OpenBSD, NetBSD: retrying fsync() after EIO lies\n  FreeBSD, Illumos: retrying fsync() after EIO tells the truth\n  + NetBSD PR to solve the issues \n    + I/O errors are not reported back to fsync at all.\n    + Write errors during genfs_putpages that fail for any reason other than ENOMEM cause the data to be semi-silently discarded.\n    + It appears that UVM pages are marked clean when they're selected to be written out, not after the write succeeds; so there are a bunch of potential races when writes fail.\n    + It appears that write errors for buffercache buffers are semi-silently discarded as well.\n\n\n\n\n\n\n\n\nInterview - Kevin Bowling: Senior Manager Engineering of LimeLight Networks - kbowling@llnw.com / @kevinbowling1\n\n\nBR: How did you first get introduced to UNIX and BSD?\nAJ: What got you started contributing to an open source project?\nBR: What sorts of things have you worked on it the past?\nAJ: Tell us a bit about LimeLight and how they use FreeBSD.\nBR: What are the biggest advantages of FreeBSD for LimeLight?\nAJ: What could FreeBSD do better that would benefit LimeLight?\nBR: What has LimeLight given back to FreeBSD?\nAJ: What have you been working on more recently?\nBR: What do you find to be the most valuable part of open source?\nAJ: Where do you think the most improvement in open source is needed?\nBR: Tell us a bit about your computing history collection. What are your three favourite pieces?\nAJ: How do you keep motivated to work on Open Source?\nBR: What do you do for fun?\nAJ: Anything else you want to mention?\n\n\n\n\nNews Roundup\n\nBSDCan 2018 Selected Talks\n\n\nThe schedule for BSDCan is up\nLots of interesting content, we are looking forward to it\nWe hope to see lots of you there. Make sure you come introduce yourselves to us. Don’t be shy.\nRemember, if this is your first BSDCan, checkout the newbie session on Thursday night. It’ll help you get to know a few people so you have someone you can ask for guidance.\nAlso, check out the hallway track, the tables, and come to the hacker lounge.\n\n\n\n\niXsystems\n\nCryptographic Right Answers\n\n\nCrypto can be confusing. We all know we shouldn’t roll our own, but what should we use?\nWell, some developers have tried to answer that question over the years, keeping an updated list of “Right Answers”\n2009: Colin Percival of FreeBSD\n2015: Thomas H. Ptacek\n2018: Latacora A consultancy that provides “Retained security teams for startups”, where Thomas Ptacek works.\n\n\n\n  We’re less interested in empowering developers and a lot more pessimistic about the prospects of getting this stuff right.\n  \n  There are, in the literature and in the most sophisticated modern systems, “better” answers for many of these items. If you’re building for low-footprint embedded systems, you can use STROBE and a sound, modern, authenticated encryption stack entirely out of a single SHA-3-like sponge constructions. You can use NOISE to build a secure transport protocol with its own AKE. Speaking of AKEs, there are, like, 30 different password AKEs you could choose from.\n  \n  But if you’re a developer and not a cryptography engineer, you shouldn’t do any of that. You should keep things simple and conventional and easy to analyze; “boring”, as the Google TLS people would say.\n\n\n\nCryptographic Right Answers\nEncrypting Data\n\n\n\n  Percival, 2009: AES-CTR with HMAC.\n  Ptacek, 2015: (1) NaCl/libsodium’s default, (2) ChaCha20-Poly1305, or (3) AES-GCM.\n  Latacora, 2018: KMS or XSalsa20+Poly1305\n\n\n\nSymmetric key length\n\n\n\n  Percival, 2009: Use 256-bit keys.\n  Ptacek, 2015: Use 256-bit keys.\n  Latacora, 2018: Go ahead and use 256 bit keys.\n\n\n\nSymmetric “Signatures”\n\n\n\n  Percival, 2009: Use HMAC.\n  Ptacek, 2015: Yep, use HMAC.\n  Latacora, 2018: Still HMAC.\n\n\n\nHashing algorithm\n\n\n\n  Percival, 2009: Use SHA256 (SHA-2).\n  Ptacek, 2015: Use SHA-2.\n  Latacora, 2018: Still SHA-2.\n\n\n\nRandom IDs\n\n\n\n  Percival, 2009: Use 256-bit random numbers.\n  Ptacek, 2015: Use 256-bit random numbers.\n  Latacora, 2018: Use 256-bit random numbers.\n\n\n\nPassword handling\n\n\n\n  Percival, 2009: scrypt or PBKDF2.\n  Ptacek, 2015: In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.\n  Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.\n\n\n\nAsymmetric encryption\n\n\n\n  Percival, 2009: Use RSAES-OAEP with SHA256 and MGF1+SHA256 bzzrt pop ffssssssst exponent 65537.\n  Ptacek, 2015: Use NaCl/libsodium (box / cryptobox).\n  Latacora, 2018: Use Nacl/libsodium (box / cryptobox).\n\n\n\nAsymmetric signatures\n\n\n\n  Percival, 2009: Use RSASSA-PSS with SHA256 then MGF1+SHA256 in tricolor systemic silicate orientation.\n  Ptacek, 2015: Use Nacl, Ed25519, or RFC6979.\n  Latacora, 2018: Use Nacl or Ed25519.\n\n\n\nDiffie-Hellman\n\n\n\n  Percival, 2009: Operate over the 2048-bit Group #14 with a generator of 2.\n  Ptacek, 2015: Probably still DH-2048, or Nacl.\n  Latacora, 2018: Probably nothing. Or use Curve25519.\n\n\n\nWebsite security\n\n\n\n  Percival, 2009: Use OpenSSL.\n  Ptacek, 2015: Remains: OpenSSL, or BoringSSL if you can. Or just use AWS ELBs\n  Latacora, 2018: Use AWS ALB/ELB or OpenSSL, with LetsEncrypt\n\n\n\nClient-server application security\n\n\n\n  Percival, 2009: Distribute the server’s public RSA key with the client code, and do not use SSL.\n  Ptacek, 2015: Use OpenSSL, or BoringSSL if you can. Or just use AWS ELBs\n  Latacora, 2018: Use AWS ALB/ELB or OpenSSL, with LetsEncrypt\n\n\n\nOnline backups\n\n\n\n  Percival, 2009: Use Tarsnap.\n  Ptacek, 2015: Use Tarsnap.\n  Latacora, 2018: Store PMAC-SIV-encrypted arc files to S3 and save fingerprints of your backups to an ERC20-compatible blockchain. Just kidding. You should still use Tarsnap.\n\n\n\nSeriously though, use Tarsnap.\n\n\n\n\nAdding IPv6 to an existing server\n\n\n  I am adding IPv6 addresses to each of my servers. This post assumes the server is up and running FreeBSD 11.1 and you already have an IPv6 address block. This does not cover the creation of an IPv6 tunnel, such as that provided by HE.net. This assumes native IPv6.\n  \n  In this post, I am using the IPv6 addresses from the IPv6 Address Prefix Reserved for Documentation (i.e. 2001:DB8::/32). You should use your own addresses.\n  \n  The IPv6 block I have been assigned is 2001:DB8:1001:8d00/64.\n  \n  I added this to /etc/rc.conf:\n\n\n\nipv6_activate_all_interfaces=\"YES\"\nipv6_defaultrouter=\"2001:DB8:1001:8d00::1\"\nifconfig_em1_ipv6=\"inet6 2001:DB8:1001:8d00:d389:119c:9b57:396b prefixlen 64 accept_rtadv\" # ns1\n\n\n\n  The IPv6 address I have assigned to this host is completely random (with the given block). I found a random IPv6 address generator and used it to select d389:119c:9b57:396b as the address for this service within my address block.\n  \n  I don’t have the reference, but I did read that randomly selecting addresses within your block is a better approach.\n  \n  In order to invoke these changes without rebooting, I issued these commands:\n\n\n```\n[dan@tallboy:~] $ sudo ifconfig em1 inet6 2001:DB8:1001:8d00:d389:119c:9b57:396b prefixlen 64 accept_rtadv\n[dan@tallboy:~] $ \n\n[dan@tallboy:~] $ sudo route add -inet6 default 2001:DB8:1001:8d00::1\nadd net default: gateway 2001:DB8:1001:8d00::1\n```\n\n\n  If you do the route add first, you will get this error:\n\n\n\n[dan@tallboy:~] $ sudo route add -inet6 default 2001:DB8:1001:8d00::1\nroute: writing to routing socket: Network is unreachable\nadd net default: gateway 2001:DB8:1001:8d00::1 fib 0: Network is unreachable\n\n\n\n\nBeastie Bits\n\n\nGhost in the Shell – Part 1\nEnabling compression on ZFS - a practical example\nModern and secure DevOps on FreeBSD (Goran Mekić)\nLibreSSL 2.7.0 Released\nzrepl version 0.0.3 is out!\n[ZFS User Conference](http://zfs.datto.com/]\n\n\n\n\nTarsnap\n\nFeedback/Questions\n\n\nBenjamin - BSD Personal Mailserver\nWarren - ZFS volume size limit (show #233)\nLars - AFRINIC\nBrad - OpenZFS vs OracleZFS\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n","content_html":"<p>Second round of ZFS improvements in FreeBSD, Postgres finds that non-FreeBSD/non-Illumos systems are corrupting data, interview with Kevin Bowling, BSDCan list of talks, and cryptographic right answers.</p>\n\n<h2>Headlines</h2>\n\n<h3>[Other big ZFS improvements you might have missed]</h3>\n\n<ul>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=329798\">9075 Improve ZFS pool import/load process and corrupted pool recovery</a>\n\n\n<blockquote>\n  <p>One of the first tasks during the pool load process is to parse a config provided from userland that describes what devices the pool is composed of. A vdev tree is generated from that config, and then all the vdevs are opened.\n  The Meta Object Set (MOS) of the pool is accessed, and several metadata objects that are necessary to load the pool are read. The exact configuration of the pool is also stored inside the MOS. Since the configuration provided from userland is external and might not accurately describe the vdev tree of the pool at the txg that is being loaded, it cannot be relied upon to safely operate the pool. For that reason, the configuration in the MOS is read early on. In the past, the two configurations were compared together and if there was a mismatch then the load process was aborted and an error was returned.\n  The latter was a good way to ensure a pool does not get corrupted, however it made the pool load process needlessly fragile in cases where the vdev configuration changed or the userland configuration was outdated. Since the MOS is stored in 3 copies, the configuration provided by userland doesn't have to be perfect in order to read its contents. Hence, a new approach has been adopted: The pool is first opened with the untrusted userland configuration just so that the real configuration can be read from the MOS. The trusted MOS configuration is then used to generate a new vdev tree and the pool is re-opened.\n  When the pool is opened with an untrusted configuration, writes are disabled to avoid accidentally damaging it. During reads, some sanity checks are performed on block pointers to see if each DVA points to a known vdev; when the configuration is untrusted, instead of panicking the system if those checks fail we simply avoid issuing reads to the invalid DVAs.\n  This new two-step pool load process now allows rewinding pools across vdev tree changes such as device replacement, addition, etc. Loading a pool from an external config file in a clustering environment also becomes much safer now since the pool will import even if the config is outdated and didn't, for instance, register a recent device addition.\n  With this code in place, it became relatively easy to implement a long-sought-after feature: the ability to import a pool with missing top level (i.e. non-redundant) devices. Note that since this almost guarantees some loss Of data, this feature is for now restricted to a read-only import.</li>\n  <li></p>\n  \n  <ul><li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=329732\">7614 zfs device evacuation/removal</a>\n  This project allows top-level vdevs to be removed from the storage pool with “zpool remove”, reducing the total amount of storage in the pool. This operation copies all allocated regions of the device to be removed onto other devices, recording the mapping from old to new location. After the removal is complete, read and free operations to the removed (now “indirect”) vdev must be remapped and performed at the new location on disk. The indirect mapping table is kept in memory whenever the pool is loaded, so there is minimal performance overhead when doing operations on the indirect vdev.\n  The size of the in-memory mapping table will be reduced when its entries become “obsolete” because they are no longer used by any block pointers in the pool. An entry becomes obsolete when all the blocks that use it are freed. An entry can also become obsolete when all the snapshots that reference it are deleted, and the block pointers that reference it have been “remapped” in all filesystems/zvols (and clones). Whenever an indirect block is written, all the block pointers in it will be “remapped” to their new (concrete) locations if possible. This process can be accelerated by using the “zfs remap” command to proactively rewrite all indirect blocks that reference indirect (removed) vdevs.\n  Note that when a device is removed, we do not verify the checksum of the data that is copied. This makes the process much faster, but if it were used on redundant vdevs (i.e. mirror or raidz vdevs), it would be possible to copy the wrong data, when we have the correct data on e.g. the other side of the mirror. Therefore, mirror and raidz devices can not be removed.</li></ul></li>\n  <li>You can use ‘zpool detach’ to downgrade a mirror to a single top-level device, so that you can then remove it</li>\n  <li>\n  <ul><li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=329681\">7446 zpool create should support efi system partition</a></li></ul></li>\n  <li>This one was not actually merged into FreeBSD, as it doesn’t apply currently, but I would like to switch the way FreeBSD deals with full disks to be closer to IllumOS to make automatic spare replacement a hands-off operation.\n  Since we support whole-disk configuration for boot pool, we also will need whole disk support with UEFI boot and for this, zpool create should create efi-system partition. I have borrowed the idea from oracle solaris, and introducing zpool create -B switch to provide an way to specify that boot partition should be created. However, there is still an question, how big should the system partition be. For time being, I have set default size 256MB (thats minimum size for FAT32 with 4k blocks). To support custom size, the set on creation \"bootsize\" property is created and so the custom size can be set as: zpool create -B -o bootsize=34MB rpool c0t0d0. After the pool is created, the \"bootsize\" property is read only. When -B switch is not used, the bootsize defaults to 0 and is shown in zpool get output with no value. Older zfs/zpool implementations can ignore this property.</li>\n  </ul>\n  \n  <hr />\n</blockquote>\n\n**Digital Ocean**\n\n\n\n<h3><a href=\"https://www.postgresql.org/message-id/flat/CAEepm%3D0B9f0O7jLE3ipUTqC3V6NO2LNbwE9Hp%3D3BxGbZPqEyQg%40mail.gmail.com#CAEepm=0B9f0O7jLE3ipUTqC3V6NO2LNbwE9Hp=3BxGbZPqEyQg@mail.gmail.com\">PostgreSQL developers find that every operating system other than FreeBSD and IllumOS might corrupt your data</a></h3>\n\n\n\n<blockquote>\n  <p>Some time ago I ran into an issue where a user encountered data corruption after a storage error. PostgreSQL played a part in that corruption by allowing checkpoint what should've been a fatal error.\n  TL;DR: Pg should PANIC on fsync() EIO return. Retrying fsync() is not OK at least on Linux. When fsync() returns success it means \"all writes since the last fsync have hit disk\" but we assume it means \"all writes since the last SUCCESSFUL fsync have hit disk\".\n  Pg wrote some blocks, which went to OS dirty buffers for writeback. Writeback failed due to an underlying storage error. The block I/O layer and XFS marked the writeback page as failed (AS<em>EIO), but had no way to tell the app about the failure. When Pg called fsync() on the FD during the next checkpoint, fsync() returned EIO because of the flagged page, to tell Pg that a previous async write failed. Pg treated the checkpoint as failed and didn't advance the redo start position in the control file.\n  + All good so far.\n  But then we retried the checkpoint, which retried the fsync(). The retry succeeded, because the prior fsync() *cleared the AS</em>EIO bad page flag*.\n  The write never made it to disk, but we completed the checkpoint, and merrily carried on our way. Whoops, data loss.\n  The clear-error-and-continue behaviour of fsync is not documented as far as I can tell. Nor is fsync() returning EIO unless you have a very new linux man-pages with the patch I wrote to add it. But from what I can see in the POSIX standard we are not given any guarantees about what happens on fsync() failure at all, so we're probably wrong to assume that retrying fsync() is safe.\n  We already PANIC on fsync() failure for WAL segments. We just need to do the same for data forks at least for EIO. This isn't as bad as it seems because AFAICS fsync only returns EIO in cases where we should be stopping the world anyway, and many FSes will do that for us.\n  + Upon further looking, it turns out it is not just Linux brain damage:\n  Apparently I was too optimistic.  I had looked only at FreeBSD, which keeps the page around and dirties it so we can retry, but the other BSDs apparently don't (<a href=\"https://github.com/freebsd/freebsd/commit/e4e8fec98ae986357cdc208b04557dba55a59266\">FreeBSD changed that in 1999</a>).\n  From what I can tell from the sources below, we have: Linux, OpenBSD, NetBSD: retrying fsync() after EIO lies\n  FreeBSD, Illumos: retrying fsync() after EIO tells the truth\n  + <a href=\"http://gnats.netbsd.org/53152\">NetBSD PR to solve the issues </a>\n    + I/O errors are not reported back to fsync at all.\n    + Write errors during genfs_putpages that fail for any reason other than ENOMEM cause the data to be semi-silently discarded.\n    + It appears that UVM pages are marked clean when they're selected to be written out, not after the write succeeds; so there are a bunch of potential races when writes fail.\n    + It appears that write errors for buffercache buffers are semi-silently discarded as well.</p>\n</blockquote>\n\n<hr />\n\n\n\n\n\n<h2>Interview - Kevin Bowling: Senior Manager Engineering of LimeLight Networks - <a href=\"mailto:kbowling@llnw.com\">kbowling@llnw.com</a> / <a href=\"https://twitter.com/kevinbowling1\">@kevinbowling1</a></h2>\n\n<ul>\n<li>BR: How did you first get introduced to UNIX and BSD?</li>\n<li>AJ: What got you started contributing to an open source project?</li>\n<li>BR: What sorts of things have you worked on it the past?</li>\n<li>AJ: Tell us a bit about LimeLight and how they use FreeBSD.</li>\n<li>BR: What are the biggest advantages of FreeBSD for LimeLight?</li>\n<li>AJ: What could FreeBSD do better that would benefit LimeLight?</li>\n<li>BR: What has LimeLight given back to FreeBSD?</li>\n<li>AJ: What have you been working on more recently?</li>\n<li>BR: What do you find to be the most valuable part of open source?</li>\n<li>AJ: Where do you think the most improvement in open source is needed?</li>\n<li>BR: Tell us a bit about your computing history collection. What are your three favourite pieces?</li>\n<li>AJ: How do you keep motivated to work on Open Source?</li>\n<li>BR: What do you do for fun?</li>\n<li>AJ: Anything else you want to mention?</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"http://www.bsdcan.org/2018/schedule/\">BSDCan 2018 Selected Talks</a></h3>\n\n<ul>\n<li>The schedule for BSDCan is up</li>\n<li>Lots of interesting content, we are looking forward to it</li>\n<li>We hope to see lots of you there. Make sure you come introduce yourselves to us. Don’t be shy.</li>\n<li>Remember, if this is your first BSDCan, checkout the newbie session on Thursday night. It’ll help you get to know a few people so you have someone you can ask for guidance.</li>\n<li>Also, check out the hallway track, the tables, and come to the hacker lounge.</li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong></p>\n\n<h3><a href=\"http://latacora.singles/2018/04/03/cryptographic-right-answers.html\">Cryptographic Right Answers</a></h3>\n\n<ul>\n<li>Crypto can be confusing. We all know we shouldn’t roll our own, but what should we use?</li>\n<li>Well, some developers have tried to answer that question over the years, keeping an updated list of “Right Answers”</li>\n<li>2009: <a href=\"https://twitter.com/cperciva\">Colin Percival</a> of FreeBSD</li>\n<li>2015: <a href=\"https://twitter.com/tqbf\">Thomas H. Ptacek</a></li>\n<li>2018: <a href=\"https://twitter.com/latacora_team\">Latacora</a> A consultancy that provides “Retained security teams for startups”, where Thomas Ptacek works.\n\n\n<blockquote>\n  <p>We’re less interested in empowering developers and a lot more pessimistic about the prospects of getting this stuff right.</li>\n  </ul>\n  There are, in the literature and in the most sophisticated modern systems, “better” answers for many of these items. If you’re building for low-footprint embedded systems, you can use STROBE and a sound, modern, authenticated encryption stack entirely out of a single SHA-3-like sponge constructions. You can use NOISE to build a secure transport protocol with its own AKE. Speaking of AKEs, there are, like, 30 different password AKEs you could choose from.</p>\n  \n  <p>But if you’re a developer and not a cryptography engineer, you shouldn’t do any of that. You should keep things simple and conventional and easy to analyze; “boring”, as the Google TLS people would say.</p>\n</blockquote>\n\n<ul>\n<li><p>Cryptographic Right Answers</p></li>\n<li><p>Encrypting Data</p></li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: AES-CTR with HMAC.\n  Ptacek, 2015: (1) NaCl/libsodium’s default, (2) ChaCha20-Poly1305, or (3) AES-GCM.\n  Latacora, 2018: KMS or XSalsa20+Poly1305</p>\n</blockquote>\n\n<ul>\n<li>Symmetric key length</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use 256-bit keys.\n  Ptacek, 2015: Use 256-bit keys.\n  Latacora, 2018: Go ahead and use 256 bit keys.</p>\n</blockquote>\n\n<ul>\n<li>Symmetric “Signatures”</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use HMAC.\n  Ptacek, 2015: Yep, use HMAC.\n  Latacora, 2018: Still HMAC.</p>\n</blockquote>\n\n<ul>\n<li>Hashing algorithm</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use SHA256 (SHA-2).\n  Ptacek, 2015: Use SHA-2.\n  Latacora, 2018: Still SHA-2.</p>\n</blockquote>\n\n<ul>\n<li>Random IDs</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use 256-bit random numbers.\n  Ptacek, 2015: Use 256-bit random numbers.\n  Latacora, 2018: Use 256-bit random numbers.</p>\n</blockquote>\n\n<ul>\n<li>Password handling</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: scrypt or PBKDF2.\n  Ptacek, 2015: In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.\n  Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.</p>\n</blockquote>\n\n<ul>\n<li>Asymmetric encryption</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use RSAES-OAEP with SHA256 and MGF1+SHA256 bzzrt pop ffssssssst exponent 65537.\n  Ptacek, 2015: Use NaCl/libsodium (box / crypto<em>box).\n  Latacora, 2018: Use Nacl/libsodium (box / crypto</em>box).</p>\n</blockquote>\n\n<ul>\n<li>Asymmetric signatures</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use RSASSA-PSS with SHA256 then MGF1+SHA256 in tricolor systemic silicate orientation.\n  Ptacek, 2015: Use Nacl, Ed25519, or RFC6979.\n  Latacora, 2018: Use Nacl or Ed25519.</p>\n</blockquote>\n\n<ul>\n<li>Diffie-Hellman</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Operate over the 2048-bit Group #14 with a generator of 2.\n  Ptacek, 2015: Probably still DH-2048, or Nacl.\n  Latacora, 2018: Probably nothing. Or use Curve25519.</p>\n</blockquote>\n\n<ul>\n<li>Website security</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use OpenSSL.\n  Ptacek, 2015: Remains: OpenSSL, or BoringSSL if you can. Or just use AWS ELBs\n  Latacora, 2018: Use AWS ALB/ELB or OpenSSL, with LetsEncrypt</p>\n</blockquote>\n\n<ul>\n<li>Client-server application security</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Distribute the server’s public RSA key with the client code, and do not use SSL.\n  Ptacek, 2015: Use OpenSSL, or BoringSSL if you can. Or just use AWS ELBs\n  Latacora, 2018: Use AWS ALB/ELB or OpenSSL, with LetsEncrypt</p>\n</blockquote>\n\n<ul>\n<li>Online backups</li>\n</ul>\n\n<blockquote>\n  <p>Percival, 2009: Use Tarsnap.\n  Ptacek, 2015: Use Tarsnap.\n  Latacora, 2018: Store PMAC-SIV-encrypted arc files to S3 and save fingerprints of your backups to an ERC20-compatible blockchain. Just kidding. You should still use Tarsnap.</p>\n</blockquote>\n\n<ul>\n<li>Seriously though, use Tarsnap.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://dan.langille.org/2018/03/19/adding-ipv6-to-an-existing-server/\">Adding IPv6 to an existing server</a></h3>\n\n<blockquote>\n  <p>I am adding IPv6 addresses to each of my servers. This post assumes the server is up and running FreeBSD 11.1 and you already have an IPv6 address block. This does not cover the creation of an IPv6 tunnel, such as that provided by HE.net. This assumes native IPv6.</p>\n  \n  <p>In this post, I am using the IPv6 addresses from the IPv6 Address Prefix Reserved for Documentation (i.e. 2001:DB8::/32). You should use your own addresses.</p>\n  \n  <p>The IPv6 block I have been assigned is 2001:DB8:1001:8d00/64.</p>\n  \n  <p>I added this to /etc/rc.conf:</p>\n</blockquote>\n\n<p><code>\nipv6_activate_all_interfaces=\"YES\"\nipv6_defaultrouter=\"2001:DB8:1001:8d00::1\"\nifconfig_em1_ipv6=\"inet6 2001:DB8:1001:8d00:d389:119c:9b57:396b prefixlen 64 accept_rtadv\" # ns1\n</code></p>\n\n<blockquote>\n  <p>The IPv6 address I have assigned to this host is completely random (with the given block). I found a random IPv6 address generator and used it to select d389:119c:9b57:396b as the address for this service within my address block.</p>\n  \n  <p>I don’t have the reference, but I did read that randomly selecting addresses within your block is a better approach.</p>\n  \n  <p>In order to invoke these changes without rebooting, I issued these commands:</p>\n</blockquote>\n\n<p>```\n[dan@tallboy:~] $ sudo ifconfig em1 inet6 2001:DB8:1001:8d00:d389:119c:9b57:396b prefixlen 64 accept_rtadv\n[dan@tallboy:~] $ </p>\n\n<p>[dan@tallboy:~] $ sudo route add -inet6 default 2001:DB8:1001:8d00::1\nadd net default: gateway 2001:DB8:1001:8d00::1\n```</p>\n\n<blockquote>\n  <p>If you do the route add first, you will get this error:</p>\n</blockquote>\n\n<p><code>\n[dan@tallboy:~] $ sudo route add -inet6 default 2001:DB8:1001:8d00::1\nroute: writing to routing socket: Network is unreachable\nadd net default: gateway 2001:DB8:1001:8d00::1 fib 0: Network is unreachable\n</code></p>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://vermaden.wordpress.com/2018/03/15/ghost-in-the-shell-part-1/\">Ghost in the Shell – Part 1</a></li>\n<li><a href=\"https://gist.github.com/dlangille/bcf918b22aaf9b3fd17408b39c97e8ce\">Enabling compression on ZFS - a practical example</a></li>\n<li><a href=\"https://0x7e2.bsidesljubljana.si/modern-secure-devops-freebsd-goran-mekic/\">Modern and secure DevOps on FreeBSD (Goran Mekić)</a></li>\n<li><a href=\"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.0-relnotes.txt\">LibreSSL 2.7.0 Released</a></li>\n<li><a href=\"https://zrepl.github.io/changelog.html\">zrepl version 0.0.3 is out!</a></li>\n<li>[ZFS User Conference](http://zfs.datto.com/]</li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Benjamin - <a href=\"http://dpaste.com/1SXE1B9#wrap\">BSD Personal Mailserver</a></li>\n<li>Warren - <a href=\"http://dpaste.com/0RN0S8X#wrap\">ZFS volume size limit (show #233)</a></li>\n<li>Lars - <a href=\"http://dpaste.com/3RAM4Z7#wrap\">AFRINIC</a></li>\n<li>Brad - <a href=\"http://dpaste.com/0M7XD71#wrap\">OpenZFS vs OracleZFS</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>","summary":"Second round of ZFS improvements in FreeBSD, Postgres finds that non-FreeBSD/non-Illumos systems are corrupting data, interview with Kevin Bowling, BSDCan list of talks, and cryptographic right answers.","date_published":"2018-04-12T09:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b2801252-e063-4376-b49f-82b61742290d.mp3","mime_type":"audio/mp3","size_in_bytes":87193008,"duration_in_seconds":7260}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1717","title":"Episode 240: TCP Blackbox Recording | BSD Now 240","url":"https://www.bsdnow.tv/240","content_text":"New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.\n\nHeadlines\n\n[A number of Upstream ZFS features landed in FreeBSD this week]\n\n\n9188 increase size of dbuf cache to reduce indirect block decompression\n\n\n  With compressed ARC (6950) we use up to 25% of our CPU to decompress indirect blocks, under a workload of random cached reads. To reduce this decompression cost, we would like to increase the size of the dbuf cache so that more indirect blocks can be stored uncompressed.\n  If we are caching entire large files of recordsize=8K, the indirect blocks use 1/64th as much memory as the data blocks (assuming they have the same compression ratio). We suggest making the dbuf cache be 1/32nd of all memory, so that in this scenario we should be able to keep all the indirect blocks decompressed in the dbuf cache. (We want it to be more than the 1/64th that the indirect blocks would use because we need to cache other stuff in the dbuf cache as well.)\n  In real world workloads, this won't help as dramatically as the example above, but we think it's still worth it because the risk of decreasing performance is low. The potential negative performance impact is that we will be slightly reducing the size of the ARC (by ~3%).\n\n9166 zfs storage pool checkpoint\n\n\n  The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that.  It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data).  It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it.  Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure.  She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state.  Otherwise, she discards it.  With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.\n\nMore information\n8484 Implement aggregate sum and use for arc counters\n\n\n  In pursuit of improving performance on multi-core systems, we should implements fanned out counters and use them to improve the performance of some of the arc statistics. These stats are updated extremely frequently, and can consume a significant amount of CPU time.\n\nAnd a small bug fix authored by me:\n9321 arcloancompressedbuf() can increment arcloanedbytes by the wrong value\n\n\n\n  arcloancompressedbuf() increments arcloanedbytes by psize unconditionally In the case of zfscompressedarcenabled=0, when the buf is returned via arcreturnbuf(), if ARCBUFCOMPRESSED(buf) is false, then arcloanedbytes is decremented by lsize, not psize.\n  Switch to using arcbufsize(buf), instead of psize, which will return psize or lsize, depending on the result of ARCBUF_COMPRESSED(buf).\n  \n  \n\n\nMAP_STACK for OpenBSD\n\n\n\n\n  Almost 2 decades ago we started work on W^X.  The concept was simple. Pages that are writable, should not be executable.  We applied this concept object by object, trying to seperate objects with different qualities to different pages. The first one we handled was the signal trampoline at the top of the stack.  We just kept making changes in the same vein.  Eventually W^X came to some of our kernel address spaces also.\n  The fundamental concept is that an object should only have the\n  permissions necessary, and any other operation should fault.  The only permission separations we have are kernel vs userland, and then read, write, and execute.\n  How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.\n  the permission is MAPSTACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled in clever ways.\n  When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.\n  Since page-permissions are generally done on page boundaries, there is caveat that thread and altstacks must now be page-sized and page-aligned, so that we can enforce the MAPSTACK attribute correctly.  It is possible that a few ports need some massaging to satisfy this condition, but we haven't found any which break yet.  A syslog_r has been added so that we can identify these failure cases. Also, the faulting cases are quite verbose for now, to help identify the programs we need to repair.\n\n\n\n\n\n\n**iXsystems**\n\n\n\nWriting Safer C with the Clang Address Sanitizer\n\n\n\n\n  We wanted to improve our password strength algorithm, and decided to go for the industry-standard zxcvbn, from the people at Dropbox. Our web front-end would use the default Javascript library, and for mobile and desktop, we chose to use the C implementation as it was the lowest common denominator for all platforms.\n  Bootstrapping all of this together was done pretty fast. I had toyed around with a few sample passwords so I decided to run it through the test suite we had for the previous password strength evaluator. The test generates a large number of random passwords according to different rules and expects the strength to be in a given range. But the test runner kept crashing with segmentation faults.\n  It turns out the library has a lot of buffer overflow cases that are usually \"harmless\", but eventually crash your program when you run the evaluator function too much. I started fixing the cases I could see, but reading someone else's algorithms to track down tiny memory errors got old pretty fast. I needed a tool to help me.\n  That's when I thought of Clang's Address Sanitizer.\n  AddressSanitizer is a fast memory error detector. It consists of a compiler instrumentation module and a run-time library\n  Let's try the sanitizer on a simple program. We'll allocate a buffer on the heap, copy each character of a string into it, and print it to standard output.\n  + The site walks through a simple example which contains an error, it writes past the end of a buffer\n  + The code works as expected, and nothing bad happens. It must be fine…\n  + Then they compile it again with the address sanitizer actived\n  So what can we gather from that pile of hex? Let's go through it line by line.\n  AddressSanitizer found a heap buffer overflow at 0x60200000ef3d, a seemingly valid address (not NULL or any other clearly faulty value).\n  + ASAN points directly to the line of code that is causing the problem\n  We're writing outside of the heap in this instruction. And AddressSanitizer isn't having it.\n  This is definitely one of my favorite indications. In addition to telling which line in the code failed and where in the memory the failure happened, you get a complete description of the closest allocated region in memory (which is probably the region you were trying to access).\n  + They then walk through combining this with lldb, the Clang debugger, to actually interactively inspect the state of the problem when an invalid memory access happens\n  Back to my practical case, how did I put the address sanitizer to good use? I simply ran the test suite, compiled with the sanitizer, with lldb. Sure enough, it stopped on every line that could cause a crash. It turns out there were many cases where zxcvbn-c wrote past the end of allocated buffers, on the heap and on the stack. I fixed those cases in the C library and ran the tests again. Not a segfault in sight!\n  I've used memory tools in the past, but they were usually unwieldy, or put such a toll on performance that they were useless in any real-life case. Clang's address sanitizer turned out to be detailed, reliable, and surprisingly easy to use. I've heard of the miracles of Valgrind but macOS hardly supports it, making it a pain to use on my MacBook Pro.\n  Coupled with Clang's static analyzer, AddressSanitizer is going to become a mandatory stop for evaluating code quality. It's also going to be the first tool I grab when facing confusing memory issues. There are many more case where I could use early failure and memory history to debug my code. For example, if a program crashes when accessing member of a deallocated object, we could easily trace the event that caused the deallocation, saving hours of adding and reading logs to retrace just what happened.\n\n\n\n\n\n\n\n\n\n\nNews Roundup\n\n\n\nOn sponsor gifts\n\n\n\n\n  Note the little stack of customs forms off to the side. It’s like I’ve learned a lesson from standing at the post office counter filling out those stupid forms. Sponsors should get their books soon.\n  \n  This seems like an apropos moment to talk about what I do for print sponsors. I say I send them “a gift,” but what does that really mean? The obvious thing to ship them is a copy of the book I’ve written. Flat-out selling print books online has tax implications, though.\n  \n  Sponsors might have guessed that they’d get a copy of the book. But I shipped them the hardcover, which isn’t my usual practice.\n  \n  That’s because I send sponsors a gift. As it’s a gift, I get to choose what I send. I want to send them something nice, to encourage them to sponsor another book. It makes no sense for me to send a sponsor a Singing Wedgie-O-Gram. (Well, maybe a couple sponsors. You know who you are.)\n  \n  The poor bastards who bought into my scam–er, sponsored my untitled book–have no idea what’s coming. As of right now, their sensible guesses are woefully incomplete.\n  \n  Future books? They might get a copy of the book. They might get book plus something. They might just get the something. Folks who sponsor the jails book might get a cake with a file in it. Who knows?\n  \n  It’s a gift. It’s my job to make that gift worthwhile.\n  \n  And to amuse myself. Because otherwise, what’s the point?\n\n\n\n\n\n\n\n\nTCP Blackbox Recorder\n\n```\nAdd the \"TCP Blackbox Recorder\" which we discussed at the developer\nsummits at BSDCan and BSDCam in 2017.\n\nThe TCP Blackbox Recorder allows you to capture events on a TCP connection\nin a ring buffer. It stores metadata with the event. It optionally stores\nthe TCP header associated with an event (if the event is associated with a\npacket) and also optionally stores information on the sockets.\n\nIt supports setting a log ID on a TCP connection and using this to correlate\nmultiple connections that share a common log ID.\n\nYou can log connections in different modes. If you are doing a coordinated\ntest with a particular connection, you may tell the system to put it in\nmode 4 (continuous dump). Or, if you just want to monitor for errors, you\ncan put it in mode 1 (ring buffer) and dump all the ring buffers associated\nwith the connection ID when we receive an error signal for that connection\nID. You can set a default mode that will be applied to a particular ratio\nof incoming connections. You can also manually set a mode using a socket\noption.\n\nThis commit includes only basic probes. rrs@ has added quite an abundance\nof probes in his TCP development work. He plans to commit those soon.\n\nThere are user-space programs which we plan to commit as ports. These read\nthe data from the log device and output pcapng files, and then let you\nanalyze the data (and metadata) in the pcapng files.\n\nReviewed by:    gnn (previous version)\nObtained from:    Netflix, Inc.\nRelnotes:    yes\nDifferential Revision:    https://reviews.freebsd.org/D11085\n```\n\n\n\n\n\n\n\n**Digital Ocean**\n\n\n\nOutta the way, KDE4\n\n\n\n\n  KDE4 has been rudely moved aside on FreeBSD. It still installs (use x11/kde4) and should update without a problem, but this is another step towards adding modern KDE (Plasma 5 and Applications) to the official FreeBSD Ports tree.\n  This has taken a long time mostly for administrative reasons, getting all the bits lined up so that people sticking with KDE4 (which, right now, would be everyone using KDE from official ports and packages on FreeBSD) don’t end up with a broken desktop. We don’t want that. But now that everything Qt4 and kdelibs4-based has been moved aside by suffixing it with -kde4, we have the unsuffixed names free to indicate the latest-and-greatest from upstream.\n  \n  KDE4 users will see a lot of packages moving around and being renamed, but no functional changes. Curiously, the KDE4 desktop depends on Qt5 and KDE Frameworks 5 — and it has for quite some time already, because the Oxygen icons are shared with KDE Frameworks, but primarily because FileLight was updated to the modern KDE Applications version some time ago (the KDE4 version had some serious bugs, although I can not remember what they were). Now that the names are cleaned up, we could consider giving KDE4 users the buggy version back.\n  \n  From here on, we’ve got the following things lined up:\n\n\n\nQt 5.10 is being worked on, except for WebEngine (it would slow down an update way too much), because Plasma is going to want Qt 5.10 soon.\nCMake 3.11 is in the -rc stage, so that is being lined up.\nThe kde5-import branch in KDE-FreeBSD’s copy of the FreeBSD ports tree (e.g. Area51) is being prepped and polished for a few big SVN commits that will add all the new bits.\n\n\n\n  So we’ve been saying Real Soon Now ™ for years, but things are Realer Sooner Nower ™ now.\n\n\n\n\nDell FS12-NV7 and other 2U server (e.g. C6100) disk system hacking\n\n\n  A while back I reviewed the Dell FS12-NV7 – a 2U rack server being sold cheap by all and sundry. It’s a powerful box, even by modern standards, but one of its big drawbacks is the disk system it comes with. But it needn’t be.\n  \n  There are two viable solutions, depending on what you want to do. You can make use of the SAS backplane, using SAS and/or SATA drives, or you can go for fewer SATA drives and free up one or more PCIe slots as Plan B. You probably have an FS12 because it looks good for building a drive array (or even FreeNAS) so I’ll deal with Plan A first.\n  \n  Like most Dell servers, this comes with a Dell PERC RAID SAS controller – a PERC6/i to be precise. This ‘I’ means it has internal connectors; the /E is the same but its sockets are external.\n  \n  The PERC connects to a twelve-slot backplane forming a drive array at the front of the box. More on the backplane later; it’s the PERCs you need to worry about.\n  \n  The PERC6 is actually an LSI Megaraid 1078 card, which is just the thing you need if you’re running an operating system like Windows that doesn’t support a volume manager, striping and other grown-up stuff. Or if your OS does have these features, but you just don’t trust it. If you are running such an OS you may as well stick to the PERC6, and good luck to you. If you’re using BSD (including FreeNAS), Solaris or a Linux distribution that handles disk arrays, read on. The PERC6 is a solution to a problem you probably don’t have, but in all other respects its a turkey. You really want a straightforward HBA (Host Bus Adapter) that allows your clever operating system to talk directly with the drives.\n  \n  Any SAS card based on the 1078 (such as the PERC6) is likely to have problems with drives larger than 2Tb. I’m not completely sure why, but I suspect it only applies to SATA. Unfortunately I don’t have any very large SAS drives to test this theory. A 2Tb limit isn’t really such a problem when you’re talking about a high performance array, as lots of small drives are a better option anyway. But it does matter if you’re building a very large datastore and don’t mind slower access and very significant resilvering times when you replace a drive. And for large datastores, very large SATA drives save you a whole lot of cash. The best capacity/cost ratio is for 5Gb SATA drives\n  \n  Some Dell PERCs can be re-flashed with LSI firmware and used as a normal HBA. Unfortunately the PERC6 isn’t one of them. I believe the PERC6/R can be, but those I’ve seen in a FS12 are just a bit too old. So the first thing you’ll need to do is dump them in the recycling or try and sell them on eBay.\n  \n  There are actually two PERC6 cards in most machine, and they each support eight SAS channels through two SFF-8484 connectors on each card. Given there are twelve drives slots, one of the PERCs is only half used. Sometimes they have a cable going off to a battery located near the fans. This is used in a desperate attempt to keep the data in the card’s cache safe in order to avoid write holes corrupting NTFS during a power failure, although the data on the on-drive caches won’t be so lucky. If you’re using a file system like that, make sure you have a UPS for the whole lot.\n  \n  But we’re going to put the PERCs out of our misery and replace them with some nice new LSI HBAs that will do our operating system’s bidding and let it talk to the drives as it knows best. But which to pick? First we need to know what we’re connecting.\n  \n  Moving to the front of the case there are twelve metal drive slots with a backplane behind. Dell makes machines with either backplanes or expanders. A backplane has a 1:1 SAS channel to drive connection; an expander takes one SAS channel and multiplexes it to (usually) four drives. You could always swap the blackplane with an expander, but I like the 1:1 nature of a backplane. It’s faster, especially if you’re configured as an array. And besides, we don’t want to spend more money than we need to, otherwise we wouldn’t be hot-rodding a cheap 2U server in the first place – expanders are expensive. Bizarrely, HBAs are cheap in comparison. So we need twelve channels of SAS that will connect to the sockets on the backplane.\n  \n  The HBA you will probably want to go with is an LSI, as these have great OS support. Other cards are available, but check that the drivers are also available. The obvious choice for SAS aficionados is the LSI 9211-8i, which has eight internal channels. This is based on an LSI 2000 series chip, the 2008, which is the de-facto standard. There’s also four-channel -4i version, so you could get your twelve channels using one of each – but the price difference is small these days, so you might as well go for two -8i cards. If you want cheaper there are 1068-based equivalent cards, and these work just fine at about half the price. They probably won’t work with larger disks, only operate at 3Gb and the original SAS standard. However, the 2000 series is only about £25 extra and gives you more options for the future. A good investment. Conversely, the latest 3000 series cards can do some extra stuff (particularly to do with active cables) but I can’t see any great advantage in paying megabucks for one unless you’re going really high-end – in which case the NV12 isn’t the box for you anyway. And you’d need some very fast drives and a faster backplane to see any speed advantage. And probably a new motherboard….\n  \n  Whether the 6Gb SAS2 of the 9211-8i is any use on the backplane, which was designed for 3Gb, I don’t know. If it matters that much to you you probably need to spend a lot more money. A drive array with a direct 3Gb to each drive is going to shift fast enough for most purposes.\n  \n  Once you have removed the PERCs and plugged in your modern-ish 9211 HBAs, your next problem is going to be the cable. Both the PERCs and the backplane have SFF-8484 multi-lane connectors, which you might not recognise. SAS is a point-to-point system, the same as SATA, and a multi-lane cable is simply four single cables in a bundle with one plug. (Newer versions of SAS have more). SFF-8484 multi-lane connectors are somewhat rare, (but unfortunately this doesn’t make them valuable if you were hoping to flog them on eBay). The world switched quickly to the SFF-8087 for multi-lane SAS. The signals are electrically the same, but the connector is not.\n  \n  Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post\n  So there are two snags with this backplane. Firstly it’s designed to work with PERC controllers; secondly it has the old SFF-8484 connectors on the back, and any SAS cables you find are likely to have SFF-8087.\n  \n  First things first – there is actually a jumper on the backplane to tell it whether it’s talking to a PERC or a standard LSI HBA. All you need to do is find it and change it. Fortunately there are very few jumpers to choose from (i.e. two), and you know the link is already in the wrong place. So try them one at a time until it works. The one you want may be labelled J15, but I wouldn’t like to say this was the same on every variant.\n  \n  Second problem: the cable. You can get cables with an SFF-8087 on one end and an SFF-8484 on the other. These should work. But they’re usually rather expensive. If you want to make your own, it’s a PITA but at least you have the connectors already (assuming you didn’t bin the ones on the PERC cables).\n  \n  I don’t know what committee designed SAS cable connectors, but ease of construction wasn’t foremost in their collective minds. You’re basically soldering twisted pair to a tiny PCB. This is mechanically rubbish, of course, as the slightest force on the cable will lift the track. Therefore its usual to cover the whole joint in solidified gunk (technical term) to protect it. Rewiring SAS connectors is definitely not easy.\n  \n  I’ve tried various ways of soldering to them, none of which were satisfactory or rewarding. One method is to clip the all bare wires you wish to solder using something like a bulldog clip so they’re at lined up horizontally and then press then adjust the clamp so they’re gently pressed to the tracks on the board, making final adjustments with a strong magnifying glass and a fine tweezers. You can then either solder them with a fine temperature-controlled iron, or have pre-coated the pads with solder paste and flash across it with an SMD rework station. I’d love to know how they’re actually manufactured – using a precision jig I assume.\n  \n  The “easy” way is to avoid soldering the connectors at all; simply cut existing cables in half and join one to the other. I’ve used prototyping matrix board for this. Strip and twist the conductors, push them through a hole and solder. This keeps things compact but manageable. We’re dealing with twisted pair here, so maintain the twists as close as possible to the board – it actually works quite well.\n  \n  However, I’ve now found a reasonably-priced source of the appropriate cable so I don’t do this any more. Contact me if you need some in the UK.\n  \n  So all that remains is to plug your HBAs to the backplane, shove in some drives and you’re away. If you’re at this stage, it “just works”. The access lights for all the drives do their thing as they should. The only mystery is how you can get the ident LED to come on; this may be controlled by the PERC when it detects a failure using the so-called sideband channel, or it may be operated by the electronics on the backplane. It’s workings are, I’m afraid, something of a mystery still – it’s got too much electronics on board to be a completely passive backplane.\n  \n  Plan B: SATA\n  \n  If you plan to use only SATA drives, especially if you don’t intend using more than six, it makes little sense to bother with SAS at all. The Gigabyte motherboard comes with half a dozen perfectly good 3Gb SATA channels, and if you need more you can always put another controller in a PCIe slot, or even USB. The advantages are lower cost and you get to free up two PCIe slots for more interesting things.\n  \n  The down-side is that you can’t use the SAS backplane, but you can still use the mounting bays.\n  \n  Removing the backplane looks tricky, but it really isn’t when you look a bit closer. Take out the fans first (held in place by rubber blocks), undo a couple of screws and it just lifts and slides out. You can then slot and lock in the drives and connect the SATA connectors directly to the back of the drives. You could even slide them out again without opening the case, as long as the cable was long enough and you manually detached the cable it when it was withdrawn. And let’s face it – drives are likely to last for years so even with half a dozen it’s not that great a hardship to open the case occasionally.\n  \n  Next comes power. The PSU has a special connector for the backplane and two standard SATA power plugs. You could split these three ways using an adapter, but if you have a lot of drives you might want to re-wire the cables going to the backplane plug. It can definitely power twelve drives.\n  \n  And that’s almost all there is to it. Unfortunately the main fans are connected to the backplane, which you’ve just removed. You can power them from an adapter on the drive power cables, but there are unused fan connectors on the motherboard. I’m doing a bit more research on cooling options, but this approach has promising possibilities for noise reduction.\n\n\n\n\nBeastie Bits\n\n\nAdriaan de Groot’s post FOSDEM blog post\nMy First FreeNAS\nsmart(8) Call for Testing by Michael Dexter\nBSDCan 2018 Travel Grant Application Now Open\nBSD Developer Kristaps Dzonsons interviews Linus Torvalds, about diving\nTwitter vote - The secret to a faster FreeBSD default build world...\ntmate - Instant terminal sharing\n\n\n\n\nTarsnap\n\nFeedback/Questions\n\n\nVikash - Getting a port added\nChris Wells - Quarterly Ports Branch\nFreeBSD-CI configs on Github\nJenkins on the FreeBSD Wiki\nGordon - Centralised storage suggestions\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.</p>\n\n<h2>Headlines</h2>\n\n<h3>[A number of Upstream ZFS features landed in FreeBSD this week]</h3>\n\n<ul>\n<li><p><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331711\">9188 increase size of dbuf cache to reduce indirect block decompression</a></p>\n\n<blockquote>\n  <p>With compressed ARC (6950) we use up to 25% of our CPU to decompress indirect blocks, under a workload of random cached reads. To reduce this decompression cost, we would like to increase the size of the dbuf cache so that more indirect blocks can be stored uncompressed.\n  If we are caching entire large files of recordsize=8K, the indirect blocks use 1/64th as much memory as the data blocks (assuming they have the same compression ratio). We suggest making the dbuf cache be 1/32nd of all memory, so that in this scenario we should be able to keep all the indirect blocks decompressed in the dbuf cache. (We want it to be more than the 1/64th that the indirect blocks would use because we need to cache other stuff in the dbuf cache as well.)\n  In real world workloads, this won't help as dramatically as the example above, but we think it's still worth it because the risk of decreasing performance is low. The potential negative performance impact is that we will be slightly reducing the size of the ARC (by ~3%).</p>\n</blockquote></li>\n<li><p><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331701\">9166 zfs storage pool checkpoint</a></p>\n\n<blockquote>\n  <p>The idea of Storage Pool Checkpoint (aka zpool checkpoint) deals with exactly that.  It can be thought of as a “pool-wide snapshot” (or a variation of extreme rewind that doesn’t corrupt your data).  It remembers the entire state of the pool at the point that it was taken and the user can revert back to it later or discard it.  Its generic use case is an administrator that is about to perform a set of destructive actions to ZFS as part of a critical procedure.  She takes a checkpoint of the pool before performing the actions, then rewinds back to it if one of them fails or puts the pool into an unexpected state.  Otherwise, she discards it.  With the assumption that no one else is making modifications to ZFS, she basically wraps all these actions into a “high-level transaction”.</p>\n</blockquote></li>\n<li><p><a href=\"https://sdimitro.github.io/post/zpool-checkpoint/\">More information</a></p></li>\n<li><p><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331404\">8484 Implement aggregate sum and use for arc counters</a></p>\n\n<blockquote>\n  <p>In pursuit of improving performance on multi-core systems, we should implements fanned out counters and use them to improve the performance of some of the arc statistics. These stats are updated extremely frequently, and can consume a significant amount of CPU time.</p>\n</blockquote></li>\n<li><p>And a small bug fix authored by me:</p></li>\n<li><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331709\">9321 arc<em>loan</em>compressed<em>buf() can increment arc</em>loaned<em>bytes by the wrong value</a>\n\n\n<blockquote>\n  arc</em>loan<em>compressed</em>buf() increments arc<em>loaned</em>bytes by psize unconditionally In the case of zfs<em>compressed</em>arc<em>enabled=0, when the buf is returned via arc</em>return<em>buf(), if ARC</em>BUF<em>COMPRESSED(buf) is false, then arc</em>loaned<em>bytes is decremented by lsize, not psize.\n  Switch to using arc</em>buf<em>size(buf), instead of psize, which will return psize or lsize, depending on the result of ARC</em>BUF_COMPRESSED(buf).</li>\n  </ul>\n  <hr />\n</blockquote>\n\n<h3><a href=\"https://marc.info/?l=openbsd-tech&amp;m=152035796722258&amp;w=2\">MAP_STACK for OpenBSD</a></h3>\n\n\n\n<blockquote>\n  <p>Almost 2 decades ago we started work on W^X.  The concept was simple. Pages that are writable, should not be executable.  We applied this concept object by object, trying to seperate objects with different qualities to different pages. The first one we handled was the signal trampoline at the top of the stack.  We just kept making changes in the same vein.  Eventually W^X came to some of our kernel address spaces also.\n  The fundamental concept is that an object should only have the\n  permissions necessary, and any other operation should fault.  The only permission separations we have are kernel vs userland, and then read, write, and execute.\n  How about we add another new permission!  This is not a hardware permission, but a software permission.  It is opportunistically enforced by the kernel.\n  the permission is MAP<em>STACK.  If you want to use memory as a stack, you must mmap it with that flag bit.  The kernel does so automatically for the stack region of a process's stack.  Two other types of stack occur: thread stacks, and alternate signal stacks.  Those are handled in clever ways.\n  When a system call happens, we check if the stack-pointer register points to such a page.  If it doesn't, the program is killed.  We have tightened the ABI.  You may no longer point your stack register at non-stack memory.  You'll be killed.  This checking code is MI, so it works for all platforms.\n  Since page-permissions are generally done on page boundaries, there is caveat that thread and altstacks must now be page-sized and page-aligned, so that we can enforce the MAP</em>STACK attribute correctly.  It is possible that a few ports need some massaging to satisfy this condition, but we haven't found any which break yet.  A syslog_r has been added so that we can identify these failure cases. Also, the faulting cases are quite verbose for now, to help identify the programs we need to repair.</p>\n</blockquote>\n\n<hr />\n\n\n\n**iXsystems**\n\n\n\n<h3><a href=\"https://dev.to/loderunner/writing-safer-c-with-clang-address-sanitizer\">Writing Safer C with the Clang Address Sanitizer</a></h3>\n\n\n\n<blockquote>\n  <p>We wanted to improve our password strength algorithm, and decided to go for the industry-standard zxcvbn, from the people at Dropbox. Our web front-end would use the default Javascript library, and for mobile and desktop, we chose to use the C implementation as it was the lowest common denominator for all platforms.\n  Bootstrapping all of this together was done pretty fast. I had toyed around with a few sample passwords so I decided to run it through the test suite we had for the previous password strength evaluator. The test generates a large number of random passwords according to different rules and expects the strength to be in a given range. But the test runner kept crashing with segmentation faults.\n  It turns out the library has a lot of buffer overflow cases that are usually \"harmless\", but eventually crash your program when you run the evaluator function too much. I started fixing the cases I could see, but reading someone else's algorithms to track down tiny memory errors got old pretty fast. I needed a tool to help me.\n  That's when I thought of Clang's Address Sanitizer.\n  AddressSanitizer is a fast memory error detector. It consists of a compiler instrumentation module and a run-time library\n  Let's try the sanitizer on a simple program. We'll allocate a buffer on the heap, copy each character of a string into it, and print it to standard output.\n  + The site walks through a simple example which contains an error, it writes past the end of a buffer\n  + The code works as expected, and nothing bad happens. It must be fine…\n  + Then they compile it again with the address sanitizer actived\n  So what can we gather from that pile of hex? Let's go through it line by line.\n  AddressSanitizer found a heap buffer overflow at 0x60200000ef3d, a seemingly valid address (not NULL or any other clearly faulty value).\n  + ASAN points directly to the line of code that is causing the problem\n  We're writing outside of the heap in this instruction. And AddressSanitizer isn't having it.\n  This is definitely one of my favorite indications. In addition to telling which line in the code failed and where in the memory the failure happened, you get a complete description of the closest allocated region in memory (which is probably the region you were trying to access).\n  + They then walk through combining this with lldb, the Clang debugger, to actually interactively inspect the state of the problem when an invalid memory access happens\n  Back to my practical case, how did I put the address sanitizer to good use? I simply ran the test suite, compiled with the sanitizer, with lldb. Sure enough, it stopped on every line that could cause a crash. It turns out there were many cases where zxcvbn-c wrote past the end of allocated buffers, on the heap and on the stack. I fixed those cases in the C library and ran the tests again. Not a segfault in sight!\n  I've used memory tools in the past, but they were usually unwieldy, or put such a toll on performance that they were useless in any real-life case. Clang's address sanitizer turned out to be detailed, reliable, and surprisingly easy to use. I've heard of the miracles of Valgrind but macOS hardly supports it, making it a pain to use on my MacBook Pro.\n  Coupled with Clang's static analyzer, AddressSanitizer is going to become a mandatory stop for evaluating code quality. It's also going to be the first tool I grab when facing confusing memory issues. There are many more case where I could use early failure and memory history to debug my code. For example, if a program crashes when accessing member of a deallocated object, we could easily trace the event that caused the deallocation, saving hours of adding and reading logs to retrace just what happened.</p>\n</blockquote>\n\n<hr />\n\n\n\n\n\n\n\n<h2>News Roundup</h2>\n\n\n\n<h3><a href=\"https://blather.michaelwlucas.com/archives/3131\">On sponsor gifts</a></h3>\n\n\n\n<blockquote>\n  <p>Note the little stack of customs forms off to the side. It’s like I’ve learned a lesson from standing at the post office counter filling out those stupid forms. Sponsors should get their books soon.</p>\n  \n  <p>This seems like an apropos moment to talk about what I do for print sponsors. I say I send them “a gift,” but what does that really mean? The obvious thing to ship them is a copy of the book I’ve written. Flat-out selling print books online has tax implications, though.</p>\n  \n  <p>Sponsors might have guessed that they’d get a copy of the book. But I shipped them the hardcover, which isn’t my usual practice.</p>\n  \n  <p>That’s because I send sponsors a gift. As it’s a gift, I get to choose what I send. I want to send them something nice, to encourage them to sponsor another book. It makes no sense for me to send a sponsor a Singing Wedgie-O-Gram. (Well, maybe a couple sponsors. You know who you are.)</p>\n  \n  <p>The poor bastards who bought into my scam–er, sponsored my untitled book–have no idea what’s coming. As of right now, their sensible guesses are woefully incomplete.</p>\n  \n  <p>Future books? They might get a copy of the book. They might get book plus something. They might just get the something. Folks who sponsor the jails book might get a cake with a file in it. Who knows?</p>\n  \n  <p>It’s a gift. It’s my job to make that gift worthwhile.</p>\n  \n  <p>And to amuse myself. Because otherwise, what’s the point?</p>\n</blockquote>\n\n<hr />\n\n\n\n\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331347\">TCP Blackbox Recorder</a></h3>\n\n```\nAdd the \"TCP Blackbox Recorder\" which we discussed at the developer\nsummits at BSDCan and BSDCam in 2017.\n\nThe TCP Blackbox Recorder allows you to capture events on a TCP connection\nin a ring buffer. It stores metadata with the event. It optionally stores\nthe TCP header associated with an event (if the event is associated with a\npacket) and also optionally stores information on the sockets.\n\nIt supports setting a log ID on a TCP connection and using this to correlate\nmultiple connections that share a common log ID.\n\nYou can log connections in different modes. If you are doing a coordinated\ntest with a particular connection, you may tell the system to put it in\nmode 4 (continuous dump). Or, if you just want to monitor for errors, you\ncan put it in mode 1 (ring buffer) and dump all the ring buffers associated\nwith the connection ID when we receive an error signal for that connection\nID. You can set a default mode that will be applied to a particular ratio\nof incoming connections. You can also manually set a mode using a socket\noption.\n\nThis commit includes only basic probes. rrs@ has added quite an abundance\nof probes in his TCP development work. He plans to commit those soon.\n\nThere are user-space programs which we plan to commit as ports. These read\nthe data from the log device and output pcapng files, and then let you\nanalyze the data (and metadata) in the pcapng files.\n\nReviewed by:    gnn (previous version)\nObtained from:    Netflix, Inc.\nRelnotes:    yes\nDifferential Revision:    https://reviews.freebsd.org/D11085\n```\n\n\n\n<hr />\n\n\n\n**Digital Ocean**\n\n\n\n<h3><a href=\"https://euroquis.nl/bobulate/?p=1812\">Outta the way, KDE4</a></h3>\n\n\n\n<blockquote>\n  <p>KDE4 has been rudely moved aside on FreeBSD. It still installs (use x11/kde4) and should update without a problem, but this is another step towards adding modern KDE (Plasma 5 and Applications) to the official FreeBSD Ports tree.\n  This has taken a long time mostly for administrative reasons, getting all the bits lined up so that people sticking with KDE4 (which, right now, would be everyone using KDE from official ports and packages on FreeBSD) don’t end up with a broken desktop. We don’t want that. But now that everything Qt4 and kdelibs4-based has been moved aside by suffixing it with -kde4, we have the unsuffixed names free to indicate the latest-and-greatest from upstream.</p>\n  \n  <p>KDE4 users will see a lot of packages moving around and being renamed, but no functional changes. Curiously, the KDE4 desktop depends on Qt5 and KDE Frameworks 5 — and it has for quite some time already, because the Oxygen icons are shared with KDE Frameworks, but primarily because FileLight was updated to the modern KDE Applications version some time ago (the KDE4 version had some serious bugs, although I can not remember what they were). Now that the names are cleaned up, we could consider giving KDE4 users the buggy version back.</p>\n  \n  <p>From here on, we’ve got the following things lined up:</p>\n</blockquote>\n\n<ul>\n<li>Qt 5.10 is being worked on, except for WebEngine (it would slow down an update way too much), because Plasma is going to want Qt 5.10 soon.</li>\n<li>CMake 3.11 is in the -rc stage, so that is being lined up.</li>\n<li>The kde5-import branch in KDE-FreeBSD’s copy of the FreeBSD ports tree (e.g. Area51) is being prepped and polished for a few big SVN commits that will add all the new bits.</li>\n</ul>\n\n<blockquote>\n  <p>So we’ve been saying Real Soon Now ™ for years, but things are Realer Sooner Nower ™ now.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h3><a href=\"http://blog.frankleonhardt.com/2017/del-fs12-nv7-and-other-2u-server-e-g-c6100-disk-system-hacking/\">Dell FS12-NV7 and other 2U server (e.g. C6100) disk system hacking</a></h3>\n\n<blockquote>\n  <p>A while back I reviewed the Dell FS12-NV7 – a 2U rack server being sold cheap by all and sundry. It’s a powerful box, even by modern standards, but one of its big drawbacks is the disk system it comes with. But it needn’t be.</p>\n  \n  <p>There are two viable solutions, depending on what you want to do. You can make use of the SAS backplane, using SAS and/or SATA drives, or you can go for fewer SATA drives and free up one or more PCIe slots as Plan B. You probably have an FS12 because it looks good for building a drive array (or even FreeNAS) so I’ll deal with Plan A first.</p>\n  \n  <p>Like most Dell servers, this comes with a Dell PERC RAID SAS controller – a PERC6/i to be precise. This ‘I’ means it has internal connectors; the /E is the same but its sockets are external.</p>\n  \n  <p>The PERC connects to a twelve-slot backplane forming a drive array at the front of the box. More on the backplane later; it’s the PERCs you need to worry about.</p>\n  \n  <p>The PERC6 is actually an LSI Megaraid 1078 card, which is just the thing you need if you’re running an operating system like Windows that doesn’t support a volume manager, striping and other grown-up stuff. Or if your OS does have these features, but you just don’t trust it. If you are running such an OS you may as well stick to the PERC6, and good luck to you. If you’re using BSD (including FreeNAS), Solaris or a Linux distribution that handles disk arrays, read on. The PERC6 is a solution to a problem you probably don’t have, but in all other respects its a turkey. You really want a straightforward HBA (Host Bus Adapter) that allows your clever operating system to talk directly with the drives.</p>\n  \n  <p>Any SAS card based on the 1078 (such as the PERC6) is likely to have problems with drives larger than 2Tb. I’m not completely sure why, but I suspect it only applies to SATA. Unfortunately I don’t have any very large SAS drives to test this theory. A 2Tb limit isn’t really such a problem when you’re talking about a high performance array, as lots of small drives are a better option anyway. But it does matter if you’re building a very large datastore and don’t mind slower access and very significant resilvering times when you replace a drive. And for large datastores, very large SATA drives save you a whole lot of cash. The best capacity/cost ratio is for 5Gb SATA drives</p>\n  \n  <p>Some Dell PERCs can be re-flashed with LSI firmware and used as a normal HBA. Unfortunately the PERC6 isn’t one of them. I believe the PERC6/R can be, but those I’ve seen in a FS12 are just a bit too old. So the first thing you’ll need to do is dump them in the recycling or try and sell them on eBay.</p>\n  \n  <p>There are actually two PERC6 cards in most machine, and they each support eight SAS channels through two SFF-8484 connectors on each card. Given there are twelve drives slots, one of the PERCs is only half used. Sometimes they have a cable going off to a battery located near the fans. This is used in a desperate attempt to keep the data in the card’s cache safe in order to avoid write holes corrupting NTFS during a power failure, although the data on the on-drive caches won’t be so lucky. If you’re using a file system like that, make sure you have a UPS for the whole lot.</p>\n  \n  <p>But we’re going to put the PERCs out of our misery and replace them with some nice new LSI HBAs that will do our operating system’s bidding and let it talk to the drives as it knows best. But which to pick? First we need to know what we’re connecting.</p>\n  \n  <p>Moving to the front of the case there are twelve metal drive slots with a backplane behind. Dell makes machines with either backplanes or expanders. A backplane has a 1:1 SAS channel to drive connection; an expander takes one SAS channel and multiplexes it to (usually) four drives. You could always swap the blackplane with an expander, but I like the 1:1 nature of a backplane. It’s faster, especially if you’re configured as an array. And besides, we don’t want to spend more money than we need to, otherwise we wouldn’t be hot-rodding a cheap 2U server in the first place – expanders are expensive. Bizarrely, HBAs are cheap in comparison. So we need twelve channels of SAS that will connect to the sockets on the backplane.</p>\n  \n  <p>The HBA you will probably want to go with is an LSI, as these have great OS support. Other cards are available, but check that the drivers are also available. The obvious choice for SAS aficionados is the LSI 9211-8i, which has eight internal channels. This is based on an LSI 2000 series chip, the 2008, which is the de-facto standard. There’s also four-channel -4i version, so you could get your twelve channels using one of each – but the price difference is small these days, so you might as well go for two -8i cards. If you want cheaper there are 1068-based equivalent cards, and these work just fine at about half the price. They probably won’t work with larger disks, only operate at 3Gb and the original SAS standard. However, the 2000 series is only about £25 extra and gives you more options for the future. A good investment. Conversely, the latest 3000 series cards can do some extra stuff (particularly to do with active cables) but I can’t see any great advantage in paying megabucks for one unless you’re going really high-end – in which case the NV12 isn’t the box for you anyway. And you’d need some very fast drives and a faster backplane to see any speed advantage. And probably a new motherboard….</p>\n  \n  <p>Whether the 6Gb SAS2 of the 9211-8i is any use on the backplane, which was designed for 3Gb, I don’t know. If it matters that much to you you probably need to spend a lot more money. A drive array with a direct 3Gb to each drive is going to shift fast enough for most purposes.</p>\n  \n  <p>Once you have removed the PERCs and plugged in your modern-ish 9211 HBAs, your next problem is going to be the cable. Both the PERCs and the backplane have SFF-8484 multi-lane connectors, which you might not recognise. SAS is a point-to-point system, the same as SATA, and a multi-lane cable is simply four single cables in a bundle with one plug. (Newer versions of SAS have more). SFF-8484 multi-lane connectors are somewhat rare, (but unfortunately this doesn’t make them valuable if you were hoping to flog them on eBay). The world switched quickly to the SFF-8087 for multi-lane SAS. The signals are electrically the same, but the connector is not.</p>\n  \n  <p>Please generate and paste your ad code here. If left empty, the ad location will be highlighted on your blog pages with a reminder to enter your code. Mid-Post\n  So there are two snags with this backplane. Firstly it’s designed to work with PERC controllers; secondly it has the old SFF-8484 connectors on the back, and any SAS cables you find are likely to have SFF-8087.</p>\n  \n  <p>First things first – there is actually a jumper on the backplane to tell it whether it’s talking to a PERC or a standard LSI HBA. All you need to do is find it and change it. Fortunately there are very few jumpers to choose from (i.e. two), and you know the link is already in the wrong place. So try them one at a time until it works. The one you want may be labelled J15, but I wouldn’t like to say this was the same on every variant.</p>\n  \n  <p>Second problem: the cable. You can get cables with an SFF-8087 on one end and an SFF-8484 on the other. These should work. But they’re usually rather expensive. If you want to make your own, it’s a PITA but at least you have the connectors already (assuming you didn’t bin the ones on the PERC cables).</p>\n  \n  <p>I don’t know what committee designed SAS cable connectors, but ease of construction wasn’t foremost in their collective minds. You’re basically soldering twisted pair to a tiny PCB. This is mechanically rubbish, of course, as the slightest force on the cable will lift the track. Therefore its usual to cover the whole joint in solidified gunk (technical term) to protect it. Rewiring SAS connectors is definitely not easy.</p>\n  \n  <p>I’ve tried various ways of soldering to them, none of which were satisfactory or rewarding. One method is to clip the all bare wires you wish to solder using something like a bulldog clip so they’re at lined up horizontally and then press then adjust the clamp so they’re gently pressed to the tracks on the board, making final adjustments with a strong magnifying glass and a fine tweezers. You can then either solder them with a fine temperature-controlled iron, or have pre-coated the pads with solder paste and flash across it with an SMD rework station. I’d love to know how they’re actually manufactured – using a precision jig I assume.</p>\n  \n  <p>The “easy” way is to avoid soldering the connectors at all; simply cut existing cables in half and join one to the other. I’ve used prototyping matrix board for this. Strip and twist the conductors, push them through a hole and solder. This keeps things compact but manageable. We’re dealing with twisted pair here, so maintain the twists as close as possible to the board – it actually works quite well.</p>\n  \n  <p>However, I’ve now found a reasonably-priced source of the appropriate cable so I don’t do this any more. Contact me if you need some in the UK.</p>\n  \n  <p>So all that remains is to plug your HBAs to the backplane, shove in some drives and you’re away. If you’re at this stage, it “just works”. The access lights for all the drives do their thing as they should. The only mystery is how you can get the ident LED to come on; this may be controlled by the PERC when it detects a failure using the so-called sideband channel, or it may be operated by the electronics on the backplane. It’s workings are, I’m afraid, something of a mystery still – it’s got too much electronics on board to be a completely passive backplane.</p>\n  \n  <p>Plan B: SATA</p>\n  \n  <p>If you plan to use only SATA drives, especially if you don’t intend using more than six, it makes little sense to bother with SAS at all. The Gigabyte motherboard comes with half a dozen perfectly good 3Gb SATA channels, and if you need more you can always put another controller in a PCIe slot, or even USB. The advantages are lower cost and you get to free up two PCIe slots for more interesting things.</p>\n  \n  <p>The down-side is that you can’t use the SAS backplane, but you can still use the mounting bays.</p>\n  \n  <p>Removing the backplane looks tricky, but it really isn’t when you look a bit closer. Take out the fans first (held in place by rubber blocks), undo a couple of screws and it just lifts and slides out. You can then slot and lock in the drives and connect the SATA connectors directly to the back of the drives. You could even slide them out again without opening the case, as long as the cable was long enough and you manually detached the cable it when it was withdrawn. And let’s face it – drives are likely to last for years so even with half a dozen it’s not that great a hardship to open the case occasionally.</p>\n  \n  <p>Next comes power. The PSU has a special connector for the backplane and two standard SATA power plugs. You could split these three ways using an adapter, but if you have a lot of drives you might want to re-wire the cables going to the backplane plug. It can definitely power twelve drives.</p>\n  \n  <p>And that’s almost all there is to it. Unfortunately the main fans are connected to the backplane, which you’ve just removed. You can power them from an adapter on the drive power cables, but there are unused fan connectors on the motherboard. I’m doing a bit more research on cooling options, but this approach has promising possibilities for noise reduction.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://euroquis.nl/bobulate/?p=1787\">Adriaan de Groot’s post FOSDEM blog post</a></li>\n<li><a href=\"https://www.manios.ca/blog/2018/01/my-first-freenas/\">My First FreeNAS</a></li>\n<li><a href=\"https://lists.freebsd.org/pipermail/freebsd-fs/2018-March/025997.html\">smart(8) Call for Testing by Michael Dexter</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/blog/bsdcan-2018-travel-grant-application-now-open/\">BSDCan 2018 Travel Grant Application Now Open</a></li>\n<li><a href=\"https://divelog.blue/linus_torvalds.html\">BSD Developer Kristaps Dzonsons interviews Linus Torvalds, about diving</a></li>\n<li><a href=\"https://twitter.com/michaeldexter/status/979236774667939840\">Twitter vote - The secret to a faster FreeBSD default build world...</a></li>\n<li><a href=\"https://tmate.io/\">tmate - Instant terminal sharing</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>Tarsnap</strong></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Vikash - <a href=\"http://dpaste.com/05X35B1#wrap\">Getting a port added</a></li>\n<li>Chris Wells - <a href=\"http://dpaste.com/05S7A6V#wrap\">Quarterly Ports Branch</a></li>\n<li><a href=\"https://github.com/freebsd/freebsd-ci\">FreeBSD-CI configs on Github</a></li>\n<li><a href=\"https://wiki.freebsd.org/Jenkins\">Jenkins on the FreeBSD Wiki</a></li>\n<li>Gordon - <a href=\"http://dpaste.com/0HSVFE7#wrap\">Centralised storage suggestions</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"New ZFS features landing in FreeBSD, MAP_STACK for OpenBSD, how to write safer C code with Clang’s address sanitizer, Michael W. Lucas on sponsor gifts, TCP blackbox recorder, and Dell disk system hacking.","date_published":"2018-04-07T15:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/b3126658-f33d-4d1b-9298-94929ae3e52e.mp3","mime_type":"audio/mp3","size_in_bytes":47822501,"duration_in_seconds":5958}]},{"id":"http://feed.jupiter.zone/bsdnow#entry-1668","title":"Episode 239: The Return To ptrace | BSD Now 239","url":"https://www.bsdnow.tv/239","content_text":"OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.\n\nRSS Feeds:\n\nMP3 Feed | iTunes Feed | HD Vid Feed | HD Torrent Feed\n\nBecome a supporter on Patreon:\n\n\n\n- Show Notes: -\n\nHeadlines\n\nPreventing Windows 10 and untrusted software from having full access to the internet using OpenBSD\n\n\n  Whilst setting up one of my development laptops to port some software to Windows I noticed Windows 10 doing crazy things like installing or updating apps and games by default after initial setup. The one I noticed in particular was Candy Crush Soda Saga which for those who don't know of it is some cheesy little puzzle game originally for consumer devices. I honestly did not want software like this near to a development machine. It has also been reported that Windows 10 now also updates core system software without notifying the user. Surely this destroys any vaguely deterministic behaviour, in my opinion making Windows 10 by default almost useless for development testbeds.\n  \n  Deciding instead to start from scratch but this time to set the inbuilt Windows Firewall to be very restrictive and only allow a few select programs to communicate. In this case all I really needed to be online was Firefox, Subversion and Putty. To my amusement (and astonishment) I found out that the Windows firewall could be modified to give access very easily by programs during installation (usually because this task needs to be done with admin privileges). It also seems that Windows store Apps can change the windows firewall settings at any point. One way to get around this issue could be to install a 3rd party firewall that most software will not have knowledge about and thus not attempt to break through. However the only decent firewall I have used was Sygate Pro which unfortunately is no longer supported by recent operating systems. The last supported versions was 2003, XP and 2000. In short, I avoid 3rd party firewalls.\n  \n  Instead I decided to trap Windows 10 (and all of it's rogue updaters) behind a virtual machine running OpenBSD. This effectively provided me with a full blown firewall appliance. From here I could then allow specific software I trusted through the firewall (via a proxy) in a safe, controlled and deterministic manner. For other interested developers (and security conscious users) and for my own reference, I have listed the steps taken here:\n\n\n\n1) First and foremost disable the Windows DHCP service - this is so no IP can be obtained on any interface. This effectively stops any communication with any network on the host system. This can be done by running services.msc with admin privileges and stopping and disabling the service called DHCP Client.\n2) Install or enable your favorite virtualization software - I have tested this with both VirtualBox and Hyper-V. Note that on non-server versions of Windows, in order to get Hyper-V working, your processor also needs to support SLAT which is daft so to avoid faffing about, I recommend using VirtualBox to get round this seemingly arbitrary restriction.\n3) Install OpenBSD on the VM - Note, if you decide to use Hyper-V, its hardware support isn't 100% perfect to run OpenBSD and you will need to disable a couple of things in the kernel. At the initial boot prompt, run the following commands.\n\n\n\nconfig -e -o /bsd /bsd\ndisable acpi\ndisable mpbios\n\n\n\n4) Add a host only virtual adapter to the VM - This is the one which we are going to connect through the VM with. Look at the IP that VirtualBox assigns this in network manager on the host machine. Mine was [b]192.168.56.1[/b]. Set up the adapter in the OpenBSD VM to have a static address on the same subnet. For example [b]192.168.56.2[/b]. If you are using Hyper-V and OpenBSD, make sure you add a \"Legacy Interface\" because no guest additions are available. Then set up a virtual switch which is host only.\n5) Add a bridged adapter to the VM - then assign it to whichever interface you wanted to connect to the external network with. Note that if using Wireless, set the bridged adapters MAC address to the same as your physical device or the access point will reject it. This is not needed (or possible) on Hyper-V because the actual device is \"shared\" rather than bridged so the same MAC address is used. Again, if you use Hyper-V, then add another virtual switch and attach it to your chosen external interface. VMs in Hyper-V \"share\" an adapter within a virtual switch and there is the option to also disable the hosts ability to use this interface at the same time which is fine for an additional level of security if those pesky rogue apps and updaters can also enable / disable DHCP service one day which wouldn't be too surprising.\n6) Connect to your network in the host OS - In case of Wireless, select the correct network from the list and type in a password if needed. Windows will probably say \"no internet available\", it also does not assign an IP address which is fine.\n7) Install the Squid proxy package on the OpenBSD guest and enable the daemon\n\n\n```\n\npkg_add squid\n\necho 'squid_flags=\"\"' &gt;&gt; /etc/rc.conf.local\n\n/etc/rc.d/squid start\n\n```\n\n\n  We will use this service for a limited selection of \"safe and trusted\" programs to connect to the outside world from within the Windows 10 host. You can also use putty on the host to connect to the VM via SSH and create a SOCKS proxy which software like Firefox can also use to connect externally.\n\n\n\n8) Configure the software you want to be able to access the external network with\n\nFirefox - go to the connection settings and specify the VMs IP address for the proxy.\nSubversion - modify the %HOME%\\AppData\\Roaming\\Subversion\\servers file and change the HTTP proxy field to the VMs IP. This is important to communicate with GitHub via https:// (Yes, GitHub also supports Subversion). For svn:// addresses you can use Putty to port forward.\nChromium/Chrome - unfortunately uses the global Windows proxy settings which defeats much of the purpose of this exercise if we were going to allow all of Windows access to the internet via the proxy. It would become mayhem again. However we can still use Putty to create a SOCKS proxy and then launch the browser with the following flags:\n\n\n\n--proxy-server=\"socks5://&lt;VM IP&gt;:&lt;SOCKS PORT&gt;\"\n--host-resolver-rules=\"MAP * 0.0.0.0 , EXCLUDE &lt;VM IP&gt;\"\n\n\n\n9) Congratulations, you are now done - Admittedly this process can be a bit fiddly to set up but it completely prevents Windows 10 from making a complete mess. This solution is probably also useful for those who like privacy or don't like the idea of their software \"phoning home\". Hope you find this useful and if you have any issues, please feel free to leave questions in the comments.\n\n\n\n\nLLDB restoration and return to ptrace(2)\n\n\n  I've managed to unbreak the LLDB debugger as much as possible with the current kernel and hit problems with ptrace(2) that are causing issues with further work on proper NetBSD support. Meanwhile, I've upstreamed all the planned NetBSD patches to sanitizers and helped other BSDs to gain better or initial support.\n\n\n\nLLDB\n\n\n\n  Since the last time I worked on LLDB, we have introduced many changes to the kernel interfaces (most notably related to signals) that apparently fixed some bugs in Go and introduced regressions in ptrace(2). Part of the regressions were noted by the existing ATF tests. However, the breakage was only marked as a new problem to resolve. For completeness, the ptrace(2) code was also cleaned up by Christos Zoulas, and we fixed some bugs with compat32.\n  \n  I've fixed a crash in *NetBSD::Factory::Launch(), triggered on startup of the lldb-server application.\n  \n  Here is the commit message:\n\n\n```\nWe cannot call process_up-&gt;SetState() inside\nthe NativeProcessNetBSD::Factory::Launch\nfunction because it triggers a NULL pointer\ndeference.\n\nThe generic code for launching a process in:\nGDBRemoteCommunicationServerLLGS::LaunchProcess\nsets the mdebuggedprocessup pointer after\na successful call to  mprocessfactory.Launch().\nIf we attempt to call processup-&gt;SetState()\ninside a platform specific Launch function we\nend up dereferencing a NULL pointer in\nNativeProcessProtocol::GetCurrentThreadID().\n\nUse the proper call processup-&gt;SetState(,false)\nthat sets notifydelegates to false.\n```\n\n\nSanitizers\n\n\n\n  I suspended development of new features in sanitizers last month, but I was still in the process of upstreaming of local patches. This process was time-consuming as it required rebasing patches, adding dedicated tests, and addressing all other requests and comments from the upstream developers.\n  \n  I'm not counting hot fixes, as some changes were triggering build or test issues on !NetBSD hosts. Thankfully all these issues were addressed quickly. The final result is a reduction of local delta size of almost 1MB to less than 100KB (1205 lines of diff). The remaining patches are rescheduled for later, mostly because they depend on extra work with cross-OS tests and prior integration of sanitizers with the basesystem distribution. I didn't want to put extra work here in the current state of affairs and, I've registered as a mentor for Google Summer of Code for the NetBSD Foundation and prepared Software Quality improvement tasks in order to outsource part of the labour.\n\n\n\nUserland changes\n\n\n\n  I've also improved documentation for some of the features of NetBSD, described in man-pages. These pieces of information were sometimes wrong or incomplete, and this makes covering the NetBSD system with features such as sanitizers harder as there is a mismatch between the actual code and the documented code.\n  \n  Some pieces of software also require better namespacing support, these days mostly for the POSIX standard. I've fixed few low-hanging fruits there and requested pullups to NetBSD-8(BETA).\n  \n  I thank the developers for improving the landed code in order to ship the best solutions for users.\n\n\n\nBSD collaboration in LLVM\n\n\n\n  A One-man-show in human activity is usually less fun and productive than collaboration in a team. This is also true in software development. Last month I was helping as a reviewer to port LLVM features to FreeBSD and when possible to OpenBSD. This included MSan/FreeBSD, libFuzzer/FreeBSD, XRay/FreeBSD and UBSan/OpenBSD.\n  \n  I've landed most of the submitted and reviewed code to the mainstream LLVM tree.\n  \n  Part of the code also verified the correctness of NetBSD routes in the existing porting efforts and showed new options for improvement. This is the reason why I've landed preliminary XRay/NetBSD code and added missing NetBSD bits to ToolChain::getOSLibName(). The latter produced setup issues with the prebuilt LLVM toolchain, as the directory name with compiler-rt goodies were located in a path like ./lib/clang/7.0.0/lib/netbsd8.99.12 with a varying OS version. This could stop working after upgrades, so I've simplified it to \"netbsd\", similar to FreeBSD and Solaris.\n\n\n\nPrebuilt toolchain for testers\n\n\n\n  I've prepared a build of Clang/LLVM with LLDB and compiler-rt features prebuilt on NetBSD/amd64 v. 8.99.12:\n\n\nllvm-clang-compilerrt-lldb-7.0.0beta_2018-02-28.tar.bz2\n\n\nPlan for the next milestone\n\n\n\n  With the approaching NetBSD 8.0 release I plan to finish backporting a few changes there from HEAD:\n\n\n\nRemove one unused feature from ptrace(2), PTSETSIGMASK &amp; PTGETSIGMASK. I've originally introduced these operations with criu/rr-like software in mind, but they are misusing or even abusing ptrace(2) and are not regular process debuggers. I plan to remove this operation from HEAD and backport this to NetBSD-8(BETA), before the release, so no compat will be required for this call. Future ports of criu/rr should involve dedicated kernel support for such requirements.\nFinish the backport of UCMACHINE_FP() to NetBSD-8. This will allow use of the same code in sanitizers in HEAD and NetBSD-8.0.\nBy popular demand, improve the regnsub(3) and regasub(3) API, adding support for more or less substitutions than 10.\n\n\n\n  Once done, I will return to ptrace(2) debugging and corrections.\n\n\n\n\nDigitalOcean\n\nWorking with the NetBSD kernel\n\n\nOverview\n\n\n\n  When working on complex systems, such as OS kernels, your attention span and cognitive energy are too valuable to be wasted on inefficiencies pertaining to ancillary tasks. After experimenting with different environmental setups for kernel debugging, some of which were awkward and distracting from my main objectives, I have arrived to my current workflow, which is described here. This approach is mainly oriented towards security research and the study of kernel internals.\n  \n  Before delving into the details, this is the general outline of my environment:\n  \n  My host system runs Linux. My target system is a QEMU guest.\n  \n  I’m tracing and debugging on my host system by attaching GDB (with NetBSD x86-64 ABI support) to QEMU’s built-in GDB server.\n  I work with NetBSD-current. All sources are built on my host system with the cross-compilation toolchain produced by build.sh.\n  I use NFS to share the source tree and the build artifacts between the target and the host.\n  I find IDEs awkward, so for codebase navigation I mainly rely on vim, tmux and ctags.\n  For non-intrusive instrumentation, such as figuring out control flow, I’m using dtrace.\n\n\n\nPreparing the host system\n\nQEMU\nGDB\nNFS Exports\nBuilding NetBSD-current\nA word of warning\n\nNow is a great time to familiarize yourself with the build.sh tool and its options. Be especially carefull with the following options:\n\n\n\n    -r          Remove contents of TOOLDIR and DESTDIR before building.\n    -u          Set MKUPDATE=yes; do not run \"make clean\" first.\n        Without this, everything is rebuilt, including the tools.\n\n\n\n  Chance are, you do not want to use these options once you’ve successfully built the cross-compilation toolchain and your entire userland, because building those takes time and there aren’t many good reasons to recompile them from scratch. Here’s what to expect:\n  \n  On my desktop, running a quad-core Intel i5-3470 at 3.20GHz with 24GB of RAM and underlying directory structure residing on a SSD drive, the entire process took about 55 minutes. I was running make with -j12, so the machine was quite busy.\n  On an old Dell D630 laptop, running Intel Core 2 Duo T7500 at 2.20GHz with 4GB of RAM and a slow hard drive (5400RPM), the process took approximatelly 2.5 hours. I was running make with -j4. Based on the temperature alerts and CPU clock throttling messages, it was quite a struggle.\n\n\n\nAcquiring the sources\nCompiling the sources\n\nPreparing the guest system\nProvisioning your guest\nPkgin and NFS shares\nTailoring the kernel for debugging\nInstalling the new kernel\nConfiguring DTrace\nDebugging the guest’s kernel\n\n\n\n\nNews Roundup\n\nAdd support for the experimental Internet-Draft \"TCP Alternative Backoff”\n\n```\nAdd support for the experimental Internet-Draft \"TCP Alternative Backoff with\nECN (ABE)\" proposal to the New Reno congestion control algorithm module.\nABE reduces the amount of congestion window reduction in response to\nECN-signalled congestion relative to the loss-inferred congestion response.\n\nMore details about ABE can be found in the Internet-Draft:\nhttps://tools.ietf.org/html/draft-ietf-tcpm-alternativebackoff-ecn\n\nThe implementation introduces four new sysctls:\n\n\nnet.inet.tcp.cc.abe defaults to 0 (disabled) and can be set to non-zero to\nenable ABE for ECN-enabled TCP connections.\nnet.inet.tcp.cc.newreno.beta and net.inet.tcp.cc.newreno.betaecn set the\nmultiplicative window decrease factor, specified as a percentage, applied to\nthe congestion window in response to a loss-based or ECN-based congestion\nsignal respectively. They default to the values specified in the draft i.e.\nbeta=50 and betaecn=80.\nnet.inet.tcp.cc.abe_frlossreduce defaults to 0 (disabled) and can be set to\nnon-zero to enable the use of standard beta (50% by default) when repairing\nloss during an ECN-signalled congestion recovery episode. It enables a more\nconservative congestion response and is provided for the purposes of\nexperimentation as a result of some discussion at IETF 100 in Singapore.\n\n\nThe values of beta and betaecn can also be set per-connection by way of the\nTCPCCALGOOPT TCP-level socket option and the new CCNEWRENOBETA or\nCCNEWRENOBETA_ECN CC algo sub-options.\n\nSubmitted by:    Tom Jones tj@enoti.me\nTested by:    Tom Jones tj@enoti.me, Grenville Armitage garmitage@swin.edu.au\nRelnotes:    Yes\nDifferential Revision:    https://reviews.freebsd.org/D11616\n```\n\n\n\nMeltdown-mitigation syspatch/errata now available\n\n\n  The recent changes in -current mitigating the Meltdown vulnerability have been backported to the 6.1 and 6.2 (amd64) releases, and the syspatch update (for 6.2) is now available.\n\n\n\n6.1\n\n\n```\nChanges by:    bluhm@cvs.openbsd.org   2018/02/26 05:36:18\nLog message:\nImplement a workaround against the Meltdown flaw in Intel CPUs.\nThe following changes have been backported from OpenBSD -current.\n\nChanges by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13\nLog message:\nHandle %gs like %[def]s and reset set it in cpu_switchto() instead of on\nevery return to userspace.\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20\nLog message:\nAdd identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs\nthat should help mitigate spectre. This is just the detection piece, these\nfeatures are not yet used.\nPart of a larger ongoing effort to mitigate meltdown/spectre. i386 will\ncome later; it needs some machdep.c cleanup first.\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19\nLog message:\nremove all PG_G global page mappings from the kernel when running on\nIntel CPUs. Part of an ongoing set of commits to mitigate the Intel\n\"meltdown\" CVE. This diff does not confer any immunity to that\nvulnerability - subsequent commits are still needed and are being\nworked on presently.\nok guenther, deraadt\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30\nLog message:\nIBRS -&gt; IBRS,IBPB in identifycpu lines\n\nChanges by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15\nLog message:\nMeltdown: implement user/kernel page table separation.\nOn Intel CPUs which speculate past user/supervisor page permission checks,\nuse a separate page table for userspace with only the minimum of kernel code\nand data required for the transitions to/from the kernel (still marked as\nsupervisor-only, of course):\n- the IDT (RO)\n- three pages of kernel text in the .kutext section for interrupt, trap,\nand syscall trampoline code (RX)\n- one page of kernel data in the .kudata section for TLB flush IPIs (RW)\n- the lapic page (RW, uncachable)\n- per CPU: one page for the TSS+GDT (RO) and one page for trampoline\nstacks (RW)\nWhen a syscall, trap, or interrupt takes a CPU from userspace to kernel the\ntrampoline code switches page tables, switches stacks to the thread's real\nkernel stack, then copies over the necessary bits from the trampoline stack.\nOn return to userspace the opposite occurs: recreate the iretq frame on the\ntrampoline stack, switch stack, switch page tables, and return to userspace.\nmlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing\nissues on MP in particular, and drove the final push to completion.\nMany rounds of testing by naddy@, sthen@, and others\nThanks to Alex Wilson from Joyent for early discussions about trampolines\nand their data requirements.\nPer-CPU page layout mostly inspired by DragonFlyBSD.\nok mlarkin@ deraadt@\n\nChanges by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59\nLog message:\nThe GNU assembler does not understand 1ULL, so replace the constant\nwith 1.  Then it compiles with gcc, sign and size do not matter\nhere.\n\nChanges by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14\nLog message:\nThe compile time assertion for cpu info did not work with gcc.\nRephrase the condition in a way that both gcc and clang accept it.\n\nChanges by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40\nLog message:\nSet the PG_G (global) bit on the special page table entries that are shared\nbetween the u-k and u+k tables, because they're actually in all tables.\n\nOpenBSD 6.1 errata 037\n```\n\n\n6.2\n\n\n```\nChanges by:    bluhm@cvs.openbsd.org   2018/02/26 05:29:48\nLog message:\nImplement a workaround against the Meltdown flaw in Intel CPUs.\nThe following changes have been backported from OpenBSD -current.\n\nChanges by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13\nLog message:\nHandle %gs like %[def]s and reset set it in cpu_switchto() instead of on\nevery return to userspace.\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20\nLog message:\nAdd identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs\nthat should help mitigate spectre. This is just the detection piece, these\nfeatures are not yet used.\nPart of a larger ongoing effort to mitigate meltdown/spectre. i386 will\ncome later; it needs some machdep.c cleanup first.\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19\nLog message:\nremove all PG_G global page mappings from the kernel when running on\nIntel CPUs. Part of an ongoing set of commits to mitigate the Intel\n\"meltdown\" CVE. This diff does not confer any immunity to that\nvulnerability - subsequent commits are still needed and are being\nworked on presently.\n\nChanges by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30\nLog message:\nIBRS -&gt; IBRS,IBPB in identifycpu lines\n\nChanges by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15\nLog message:\nMeltdown: implement user/kernel page table separation.\nOn Intel CPUs which speculate past user/supervisor page permission checks,\nuse a separate page table for userspace with only the minimum of kernel code\nand data required for the transitions to/from the kernel (still marked as\nsupervisor-only, of course):\n- the IDT (RO)\n- three pages of kernel text in the .kutext section for interrupt, trap,\nand syscall trampoline code (RX)\n- one page of kernel data in the .kudata section for TLB flush IPIs (RW)\n- the lapic page (RW, uncachable)\n- per CPU: one page for the TSS+GDT (RO) and one page for trampoline\nstacks (RW)\nWhen a syscall, trap, or interrupt takes a CPU from userspace to kernel the\ntrampoline code switches page tables, switches stacks to the thread's real\nkernel stack, then copies over the necessary bits from the trampoline stack.\nOn return to userspace the opposite occurs: recreate the iretq frame on the\ntrampoline stack, switch stack, switch page tables, and return to userspace.\nmlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing\nissues on MP in particular, and drove the final push to completion.\nMany rounds of testing by naddy@, sthen@, and others\nThanks to Alex Wilson from Joyent for early discussions about trampolines\nand their data requirements.\nPer-CPU page layout mostly inspired by DragonFlyBSD.\n\nChanges by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59\nLog message:\nThe GNU assembler does not understand 1ULL, so replace the constant\nwith 1.  Then it compiles with gcc, sign and size do not matter\nhere.\n\nChanges by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14\nLog message:\nThe compile time assertion for cpu info did not work with gcc.\nRephrase the condition in a way that both gcc and clang accept it.\n\nChanges by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40\nLog message:\nSet the PG_G (global) bit on the special page table entries that are shared\nbetween the u-k and u+k tables, because they're actually in all tables.\n\nOpenBSD 6.2 errata 009\n```\n\n\nsyspatch\n\n\n\n\niXsystems\n\na2k18 Hackathon Report: Ken Westerback on dhclient and more\n\n\n  Ken Westerback (krw@) has sent in the first report from the (recently concluded) a2k18 hackathon:\n\n\n\nYYZ -&gt; YVR -&gt; MEL -&gt; ZQN -&gt; CHC -&gt; DUD -&gt; WLG -&gt; AKL -&gt; SYD -&gt; BNE -&gt; YVR -&gt; YYZ\nFor those of you who don’t speak Airport code:\nToronto -&gt; Vancouver -&gt; Melbourne -&gt; Queenstown -&gt; Christchurch -&gt; Dunedin\nThen: Dunedin -&gt; Wellington -&gt; Auckland -&gt; Sydney -&gt; Brisbane -&gt; Vancouver -&gt; Toronto\n\n\n```\n\nWhew.\n\nOnce in Dunedin the hacking commenced. The background was a regular tick of new meltdown diffs to test in addition to whatever work one was actually engaged in. I was lucky (?) in that none of the problems with the various versions cropped up on my laptop.\n```\n\n```\nI worked with rpe@ and tb@ to make the install script create the 'correct' FQDN when dhclient was involved. I worked with tb@ on some code cleanup in various bits of the base. dhclient(8) got some nice cleanup, further pruning/improving log messages in particular. In addition the oddball -q option was flipped into the more normal -v. I.e. be quiet by default and verbose on request.\n\nMore substantially the use of recorded leases was made less intrusive by avoiding continual reconfiguration of the interface with the same information. The 'request', 'require' and 'ignore' dhclient.conf(5) statement were changed so they are cumulative, making it easier to build longer lists of affected options.\n\nI tweaked softraid(4) to remove a handrolled version of duid_format().\n\nI sprinkled a couple of M_WAITOK into amd64 and i386 mpbios to document that there is really no need to check for NULL being returned from some malloc() calls.\n\nI continued to help test the new filesystem quiescing logic that deraadt@ committed during the hackathon.\n\nI only locked myself out of my room once!\n\nFueled by the excellent coffee from local institutions The Good Earth Cafe and The Good Oil Cafe, and the excellent hacking facilities and accommodations at the University of Otago it was another enjoyable and productive hackathon south of the equator. And I even saw penguins.\n\nThanks to Jim Cheetham and the support from the project and the OpenBSD Foundation that made it all possible\n```\n\n\n\nPoetic License\n\n\n  I found this when going through old documents. It looks like I wrote it and never posted it. Perhaps I didn’t consider it finished at the time. But looking at it now, I think it’s good enough to share. It’s a redrafting of the BSD licence, in poetic form. Maybe I had plans to do other licences one day; I can’t remember.\n  \n  I’ve interleaved it with the original license text so you can see how true, or otherwise, I’ve been to it. Enjoy :-)\n\n\n```\nCopyright (c) , \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions\nare met:\n```\n\n\n  You may redistribute and use –\n  as source or binary, as you choose,\n  and with some changes or without –\n  this software; let there be no doubt.\n  But you must meet conditions three,\n  if in compliance you wish to be.\n\n\n\n1. Redistributions of source code must retain the above copyright\n   notice, this list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright\n  notice, this list of conditions and the following disclaimer in the\n  documentation and/or other materials provided with the distribution.\n3. Neither the name of the  nor the names of its\n   contributors may be used to endorse or promote products derived\n   from this software without specific prior written permission.\n\n\n\n  The first is obvious, of course –\n  To keep this text within the source.\n  The second is for binaries\n  Place in the docs a copy, please.\n  A moral lesson from this ode –\n  Don’t strip the copyright on code.\n  \n  The third applies when you promote:\n  You must not take, from us who wrote,\n  our names and make it seem as true\n  we like or love your version too.\n  (Unless, of course, you contact us\n  And get our written assensus.)\n\n\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS  IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS\nFOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE\nCOPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,\nINCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,\nBUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN\nANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE\nPOSSIBILITY OF SUCH DAMAGE.\n\n\n\n  One final point to be laid out\n  (You must forgive my need to shout):\n  THERE IS NO WARRANTY FOR THIS\n  WHATEVER THING MAY GO AMISS.\n  EXPRESS, IMPLIED, IT’S ALL THE SAME –\n  RESPONSIBILITY DISCLAIMED.\n  \n  WE ARE NOT LIABLE FOR LOSS\n  NO MATTER HOW INCURRED THE COST\n  THE TYPE OR STYLE OF DAMAGE DONE\n  WHATE’ER THE LEGAL THEORY SPUN.\n  THIS STILL REMAINS AS TRUE IF YOU\n  INFORM US WHAT YOU PLAN TO DO.\n  \n  When all is told, we sum up thus –\n  Do what you like, just don’t sue us.\n\n\n\n\n\n\nBeastie Bits\n\n\nAsiaBSDCon 2018 Videos\nThe January/February 2018 FreeBSD Journal is Here\nAnnouncing the pkgsrc-2017Q4 release (2018-01-04)\nBSD Hamburg Event\nZFS User conference\nUnreal Engine 4 Being Brought Natively To FreeBSD By Independent Developer\n\n\n\n\nTarsnap ad\n\n\n\nFeedback/Questions\n\n\nPhilippe - I heart FreeBSD and other questions\nCyrus - BSD Now is excellent\nArchitect - Combined Feedback\nDale - ZFS on Linux moving to ZFS on FreeBSD\nTommi - New BUG in Finland\n\n\n\n\n\nSend questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv\n\n\n","content_html":"<p>OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.</p>\n\n<h3>RSS Feeds:</h3>\n\n<p><a href=\"http://feeds.feedburner.com/BsdNowMp3\">MP3 Feed</a> <strong>|</strong> <a href=\"https://itunes.apple.com/us/podcast/bsd-now-mp3/id701045710?mt=2\">iTunes Feed</a> <strong>|</strong> <a href=\"http://feeds.feedburner.com/BsdNowHd\">HD Vid Feed</a> <strong>|</strong> <a href=\"http://bitlove.org/jupiterbroadcasting/bsdnowhd/feed\">HD Torrent Feed</a></p>\n\n<h3><a href=\"http://www.patreon.com/jupitersignal\">Become a supporter on Patreon</a>:</h3>\n\n<p><a href=\"http://www.patreon.com/jupitersignal\" rel=\"Support us on Patreon\"><img src=\"http://i.imgur.com/2ioAf3Q.png\" alt=\"Patreon\" /></a></p>\n\n<h3>- Show Notes: -</h3>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://www.ibm.com/developerworks/community/blogs/karsten/entry/Preventing_Windows_10_and_untrusted_software_from_having_full_access_to_the_internet?lang=en\">Preventing Windows 10 and untrusted software from having full access to the internet using OpenBSD</a></h3>\n\n<blockquote>\n  <p>Whilst setting up one of my development laptops to port some software to Windows I noticed Windows 10 doing crazy things like installing or updating apps and games by default after initial setup. The one I noticed in particular was Candy Crush Soda Saga which for those who don't know of it is some cheesy little puzzle game originally for consumer devices. I honestly did not want software like this near to a development machine. It has also been reported that Windows 10 now also updates core system software without notifying the user. Surely this destroys any vaguely deterministic behaviour, in my opinion making Windows 10 by default almost useless for development testbeds.</p>\n  \n  <p>Deciding instead to start from scratch but this time to set the inbuilt Windows Firewall to be very restrictive and only allow a few select programs to communicate. In this case all I really needed to be online was Firefox, Subversion and Putty. To my amusement (and astonishment) I found out that the Windows firewall could be modified to give access very easily by programs during installation (usually because this task needs to be done with admin privileges). It also seems that Windows store Apps can change the windows firewall settings at any point. One way to get around this issue could be to install a 3rd party firewall that most software will not have knowledge about and thus not attempt to break through. However the only decent firewall I have used was Sygate Pro which unfortunately is no longer supported by recent operating systems. The last supported versions was 2003, XP and 2000. In short, I avoid 3rd party firewalls.</p>\n  \n  <p>Instead I decided to trap Windows 10 (and all of it's rogue updaters) behind a virtual machine running OpenBSD. This effectively provided me with a full blown firewall appliance. From here I could then allow specific software I trusted through the firewall (via a proxy) in a safe, controlled and deterministic manner. For other interested developers (and security conscious users) and for my own reference, I have listed the steps taken here:</p>\n</blockquote>\n\n<ul>\n<li><p>1) First and foremost disable the Windows DHCP service - this is so no IP can be obtained on any interface. This effectively stops any communication with any network on the host system. This can be done by running services.msc with admin privileges and stopping and disabling the service called DHCP Client.</p></li>\n<li><p>2) Install or enable your favorite virtualization software - I have tested this with both VirtualBox and Hyper-V. Note that on non-server versions of Windows, in order to get Hyper-V working, your processor also needs to support SLAT which is daft so to avoid faffing about, I recommend using VirtualBox to get round this seemingly arbitrary restriction.</p></li>\n<li><p>3) Install OpenBSD on the VM - Note, if you decide to use Hyper-V, its hardware support isn't 100% perfect to run OpenBSD and you will need to disable a couple of things in the kernel. At the initial boot prompt, run the following commands.</p></li>\n</ul>\n\n<p><code>\nconfig -e -o /bsd /bsd\ndisable acpi\ndisable mpbios\n</code></p>\n\n<ul>\n<li><p>4) Add a host only virtual adapter to the VM - This is the one which we are going to connect through the VM with. Look at the IP that VirtualBox assigns this in network manager on the host machine. Mine was [b]192.168.56.1[/b]. Set up the adapter in the OpenBSD VM to have a static address on the same subnet. For example [b]192.168.56.2[/b]. If you are using Hyper-V and OpenBSD, make sure you add a \"Legacy Interface\" because no guest additions are available. Then set up a virtual switch which is host only.</p></li>\n<li><p>5) Add a bridged adapter to the VM - then assign it to whichever interface you wanted to connect to the external network with. Note that if using Wireless, set the bridged adapters MAC address to the same as your physical device or the access point will reject it. This is not needed (or possible) on Hyper-V because the actual device is \"shared\" rather than bridged so the same MAC address is used. Again, if you use Hyper-V, then add another virtual switch and attach it to your chosen external interface. VMs in Hyper-V \"share\" an adapter within a virtual switch and there is the option to also disable the hosts ability to use this interface at the same time which is fine for an additional level of security if those pesky rogue apps and updaters can also enable / disable DHCP service one day which wouldn't be too surprising.</p></li>\n<li><p>6) Connect to your network in the host OS - In case of Wireless, select the correct network from the list and type in a password if needed. Windows will probably say \"no internet available\", it also does not assign an IP address which is fine.</p></li>\n<li><p>7) Install the Squid proxy package on the OpenBSD guest and enable the daemon</p></li>\n</ul>\n\n<p>```</p>\n\n<h4>pkg_add squid</h4>\n\n<h4>echo 'squid_flags=\"\"' >> /etc/rc.conf.local</h4>\n\n<h4>/etc/rc.d/squid start</h4>\n\n<p>```</p>\n\n<blockquote>\n  <p>We will use this service for a limited selection of \"safe and trusted\" programs to connect to the outside world from within the Windows 10 host. You can also use putty on the host to connect to the VM via SSH and create a SOCKS proxy which software like Firefox can also use to connect externally.</p>\n</blockquote>\n\n<ul>\n<li><p>8) Configure the software you want to be able to access the external network with</p>\n\n<ul><li>Firefox - go to the connection settings and specify the VMs IP address for the proxy.</li>\n<li>Subversion - modify the %HOME%\\AppData\\Roaming\\Subversion\\servers file and change the HTTP proxy field to the VMs IP. This is important to communicate with GitHub via https:// (Yes, GitHub also supports Subversion). For svn:// addresses you can use Putty to port forward.</li>\n<li>Chromium/Chrome - unfortunately uses the global Windows proxy settings which defeats much of the purpose of this exercise if we were going to allow <em>all</em> of Windows access to the internet via the proxy. It would become mayhem again. However we can still use Putty to create a SOCKS proxy and then launch the browser with the following flags:</li></ul></li>\n</ul>\n\n<p><code>\n--proxy-server=\"socks5://&lt;VM IP&gt;:&lt;SOCKS PORT&gt;\"\n--host-resolver-rules=\"MAP * 0.0.0.0 , EXCLUDE &lt;VM IP&gt;\"\n</code></p>\n\n<ul>\n<li>9) Congratulations, you are now done - Admittedly this process can be a bit fiddly to set up but it completely prevents Windows 10 from making a complete mess. This solution is probably also useful for those who like privacy or don't like the idea of their software \"phoning home\". Hope you find this useful and if you have any issues, please feel free to leave questions in the comments.</li>\n</ul>\n\n<p><hr /></p>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/lldb_restoration_and_return_to\">LLDB restoration and return to ptrace(2)</a></h3>\n\n<blockquote>\n  <p>I've managed to unbreak the LLDB debugger as much as possible with the current kernel and hit problems with ptrace(2) that are causing issues with further work on proper NetBSD support. Meanwhile, I've upstreamed all the planned NetBSD patches to sanitizers and helped other BSDs to gain better or initial support.</p>\n</blockquote>\n\n<ul>\n<li>LLDB</li>\n</ul>\n\n<blockquote>\n  <p>Since the last time I worked on LLDB, we have introduced many changes to the kernel interfaces (most notably related to signals) that apparently fixed some bugs in Go and introduced regressions in ptrace(2). Part of the regressions were noted by the existing ATF tests. However, the breakage was only marked as a new problem to resolve. For completeness, the ptrace(2) code was also cleaned up by Christos Zoulas, and we fixed some bugs with compat32.</p>\n  \n  <p>I've fixed a crash in *NetBSD::Factory::Launch(), triggered on startup of the lldb-server application.</p>\n  \n  <p>Here is the commit message:</p>\n</blockquote>\n\n<p>```\nWe cannot call process_up->SetState() inside\nthe NativeProcessNetBSD::Factory::Launch\nfunction because it triggers a NULL pointer\ndeference.</p>\n\n<p>The generic code for launching a process in:\nGDBRemoteCommunicationServerLLGS::LaunchProcess\nsets the m<em>debugged</em>process<em>up pointer after\na successful call to  m</em>process<em>factory.Launch().\nIf we attempt to call process</em>up->SetState()\ninside a platform specific Launch function we\nend up dereferencing a NULL pointer in\nNativeProcessProtocol::GetCurrentThreadID().</p>\n\n<p>Use the proper call process<em>up->SetState(,false)\nthat sets notify</em>delegates to false.\n```</p>\n\n<ul>\n<li>Sanitizers</li>\n</ul>\n\n<blockquote>\n  <p>I suspended development of new features in sanitizers last month, but I was still in the process of upstreaming of local patches. This process was time-consuming as it required rebasing patches, adding dedicated tests, and addressing all other requests and comments from the upstream developers.</p>\n  \n  <p>I'm not counting hot fixes, as some changes were triggering build or test issues on !NetBSD hosts. Thankfully all these issues were addressed quickly. The final result is a reduction of local delta size of almost 1MB to less than 100KB (1205 lines of diff). The remaining patches are rescheduled for later, mostly because they depend on extra work with cross-OS tests and prior integration of sanitizers with the basesystem distribution. I didn't want to put extra work here in the current state of affairs and, I've registered as a mentor for Google Summer of Code for the NetBSD Foundation and prepared Software Quality improvement tasks in order to outsource part of the labour.</p>\n</blockquote>\n\n<ul>\n<li>Userland changes</li>\n</ul>\n\n<blockquote>\n  <p>I've also improved documentation for some of the features of NetBSD, described in man-pages. These pieces of information were sometimes wrong or incomplete, and this makes covering the NetBSD system with features such as sanitizers harder as there is a mismatch between the actual code and the documented code.</p>\n  \n  <p>Some pieces of software also require better namespacing support, these days mostly for the POSIX standard. I've fixed few low-hanging fruits there and requested pullups to NetBSD-8(BETA).</p>\n  \n  <p>I thank the developers for improving the landed code in order to ship the best solutions for users.</p>\n</blockquote>\n\n<ul>\n<li>BSD collaboration in LLVM</li>\n</ul>\n\n<blockquote>\n  <p>A One-man-show in human activity is usually less fun and productive than collaboration in a team. This is also true in software development. Last month I was helping as a reviewer to port LLVM features to FreeBSD and when possible to OpenBSD. This included MSan/FreeBSD, libFuzzer/FreeBSD, XRay/FreeBSD and UBSan/OpenBSD.</p>\n  \n  <p>I've landed most of the submitted and reviewed code to the mainstream LLVM tree.</p>\n  \n  <p>Part of the code also verified the correctness of NetBSD routes in the existing porting efforts and showed new options for improvement. This is the reason why I've landed preliminary XRay/NetBSD code and added missing NetBSD bits to ToolChain::getOSLibName(). The latter produced setup issues with the prebuilt LLVM toolchain, as the directory name with compiler-rt goodies were located in a path like ./lib/clang/7.0.0/lib/netbsd8.99.12 with a varying OS version. This could stop working after upgrades, so I've simplified it to \"netbsd\", similar to FreeBSD and Solaris.</p>\n</blockquote>\n\n<ul>\n<li>Prebuilt toolchain for testers</li>\n</ul>\n\n<blockquote>\n  <p>I've prepared a build of Clang/LLVM with LLDB and compiler-rt features prebuilt on NetBSD/amd64 v. 8.99.12:</p>\n</blockquote>\n\n<p><code>llvm-clang-compilerrt-lldb-7.0.0beta_2018-02-28.tar.bz2</code></p>\n\n<ul>\n<li>Plan for the next milestone</li>\n</ul>\n\n<blockquote>\n  <p>With the approaching NetBSD 8.0 release I plan to finish backporting a few changes there from HEAD:</p>\n</blockquote>\n\n<ul>\n<li>Remove one unused feature from ptrace(2), PT<em>SET</em>SIGMASK &amp; PT<em>GET</em>SIGMASK. I've originally introduced these operations with criu/rr-like software in mind, but they are misusing or even abusing ptrace(2) and are not regular process debuggers. I plan to remove this operation from HEAD and backport this to NetBSD-8(BETA), before the release, so no compat will be required for this call. Future ports of criu/rr should involve dedicated kernel support for such requirements.\nFinish the backport of <em>UC</em>MACHINE_FP() to NetBSD-8. This will allow use of the same code in sanitizers in HEAD and NetBSD-8.0.</li>\n<li>By popular demand, improve the regnsub(3) and regasub(3) API, adding support for more or less substitutions than 10.</li>\n</ul>\n\n<blockquote>\n  <p>Once done, I will return to ptrace(2) debugging and corrections.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><strong>DigitalOcean</strong></p>\n\n<h3><a href=\"https://t.pagef.lt/working-with-the-netbsd-kernel/\">Working with the NetBSD kernel</a></h3>\n\n<ul>\n<li>Overview</li>\n</ul>\n\n<blockquote>\n  <p>When working on complex systems, such as OS kernels, your attention span and cognitive energy are too valuable to be wasted on inefficiencies pertaining to ancillary tasks. After experimenting with different environmental setups for kernel debugging, some of which were awkward and distracting from my main objectives, I have arrived to my current workflow, which is described here. This approach is mainly oriented towards security research and the study of kernel internals.</p>\n  \n  <p>Before delving into the details, this is the general outline of my environment:</p>\n  \n  <p>My host system runs Linux. My target system is a QEMU guest.</p>\n  \n  <p>I’m tracing and debugging on my host system by attaching GDB (with NetBSD x86-64 ABI support) to QEMU’s built-in GDB server.\n  I work with NetBSD-current. All sources are built on my host system with the cross-compilation toolchain produced by build.sh.\n  I use NFS to share the source tree and the build artifacts between the target and the host.\n  I find IDEs awkward, so for codebase navigation I mainly rely on vim, tmux and ctags.\n  For non-intrusive instrumentation, such as figuring out control flow, I’m using dtrace.</p>\n</blockquote>\n\n<ul>\n<li><p>Preparing the host system</p>\n\n<ul><li>QEMU</li>\n<li>GDB</li>\n<li>NFS Exports</li></ul></li>\n<li><p>Building NetBSD-current</p></li>\n<li><p>A word of warning</p>\n\n<ul><li>Now is a great time to familiarize yourself with the build.sh tool and its options. Be especially carefull with the following options:</li></ul></li>\n</ul>\n\n<p><code>\n    -r          Remove contents of TOOLDIR and DESTDIR before building.\n    -u          Set MKUPDATE=yes; do not run \"make clean\" first.\n        Without this, everything is rebuilt, including the tools.\n</code></p>\n\n<blockquote>\n  <p>Chance are, you do not want to use these options once you’ve successfully built the cross-compilation toolchain and your entire userland, because building those takes time and there aren’t many good reasons to recompile them from scratch. Here’s what to expect:</p>\n  \n  <p>On my desktop, running a quad-core Intel i5-3470 at 3.20GHz with 24GB of RAM and underlying directory structure residing on a SSD drive, the entire process took about 55 minutes. I was running make with -j12, so the machine was quite busy.\n  On an old Dell D630 laptop, running Intel Core 2 Duo T7500 at 2.20GHz with 4GB of RAM and a slow hard drive (5400RPM), the process took approximatelly 2.5 hours. I was running make with -j4. Based on the temperature alerts and CPU clock throttling messages, it was quite a struggle.</p>\n</blockquote>\n\n<ul>\n<li>Acquiring the sources</li>\n<li><p>Compiling the sources</p>\n\n<ul><li>Preparing the guest system</li></ul></li>\n<li>Provisioning your guest</li>\n<li>Pkgin and NFS shares</li>\n<li>Tailoring the kernel for debugging</li>\n<li>Installing the new kernel</li>\n<li>Configuring DTrace</li>\n<li>Debugging the guest’s kernel</li>\n</ul>\n\n<p><hr /></p>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&amp;revision=331214\">Add support for the experimental Internet-Draft \"TCP Alternative Backoff”</a></h3>\n\n<p>```\nAdd support for the experimental Internet-Draft \"TCP Alternative Backoff with\nECN (ABE)\" proposal to the New Reno congestion control algorithm module.\nABE reduces the amount of congestion window reduction in response to\nECN-signalled congestion relative to the loss-inferred congestion response.</p>\n\n<p>More details about ABE can be found in the Internet-Draft:\nhttps://tools.ietf.org/html/draft-ietf-tcpm-alternativebackoff-ecn</p>\n\n<p>The implementation introduces four new sysctls:</p>\n\n<ul>\n<li><p>net.inet.tcp.cc.abe defaults to 0 (disabled) and can be set to non-zero to\nenable ABE for ECN-enabled TCP connections.</p></li>\n<li><p>net.inet.tcp.cc.newreno.beta and net.inet.tcp.cc.newreno.beta<em>ecn set the\nmultiplicative window decrease factor, specified as a percentage, applied to\nthe congestion window in response to a loss-based or ECN-based congestion\nsignal respectively. They default to the values specified in the draft i.e.\nbeta=50 and beta</em>ecn=80.</p></li>\n<li><p>net.inet.tcp.cc.abe_frlossreduce defaults to 0 (disabled) and can be set to\nnon-zero to enable the use of standard beta (50% by default) when repairing\nloss during an ECN-signalled congestion recovery episode. It enables a more\nconservative congestion response and is provided for the purposes of\nexperimentation as a result of some discussion at IETF 100 in Singapore.</p></li>\n</ul>\n\n<p>The values of beta and beta<em>ecn can also be set per-connection by way of the\nTCP</em>CCALGOOPT TCP-level socket option and the new CC<em>NEWRENO</em>BETA or\nCC<em>NEWRENO</em>BETA_ECN CC algo sub-options.</p>\n\n<p>Submitted by:    Tom Jones <a href=\"&#x6D;&#x61;i&#x6C;&#x74;&#111;:&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;\">&#x74;&#x6A;&#64;&#x65;&#x6E;&#x6F;&#x74;&#105;.&#x6D;&#101;</a>\nTested by:    Tom Jones <a href=\"&#x6D;&#97;&#105;&#x6C;&#x74;&#x6F;:&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;\">&#116;&#x6A;&#64;&#101;&#x6E;&#111;&#116;&#105;&#x2E;&#x6D;&#101;</a>, Grenville Armitage <a href=\"&#109;&#x61;&#105;&#x6C;&#x74;&#x6F;:&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;\">&#103;&#97;&#x72;&#109;&#x69;ta&#x67;&#x65;&#64;&#x73;&#119;&#105;&#x6E;.&#x65;d&#117;.&#97;&#117;</a>\nRelnotes:    Yes\nDifferential Revision:    https://reviews.freebsd.org/D11616\n```</p>\n\n<p><hr /></p>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20180228225937\">Meltdown-mitigation syspatch/errata now available</a></h3>\n\n<blockquote>\n  <p>The recent changes in -current mitigating the Meltdown vulnerability have been backported to the 6.1 and 6.2 (amd64) releases, and the syspatch update (for 6.2) is now available.</p>\n</blockquote>\n\n<ul>\n<li><a href=\"https://marc.info/?l=openbsd-cvs&amp;m=151964860620856&amp;w=2\">6.1</a></li>\n</ul>\n\n<p>```\nChanges by:    bluhm@cvs.openbsd.org   2018/02/26 05:36:18\nLog message:\nImplement a workaround against the Meltdown flaw in Intel CPUs.\nThe following changes have been backported from OpenBSD -current.</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13\nLog message:\nHandle %gs like %[def]s and reset set it in cpu_switchto() instead of on\nevery return to userspace.</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20\nLog message:\nAdd identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs\nthat should help mitigate spectre. This is just the detection piece, these\nfeatures are not yet used.\nPart of a larger ongoing effort to mitigate meltdown/spectre. i386 will\ncome later; it needs some machdep.c cleanup first.</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19\nLog message:\nremove all PG_G global page mappings from the kernel when running on\nIntel CPUs. Part of an ongoing set of commits to mitigate the Intel\n\"meltdown\" CVE. This diff does not confer any immunity to that\nvulnerability - subsequent commits are still needed and are being\nworked on presently.\nok guenther, deraadt</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30\nLog message:\nIBRS -> IBRS,IBPB in identifycpu lines</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15\nLog message:\nMeltdown: implement user/kernel page table separation.\nOn Intel CPUs which speculate past user/supervisor page permission checks,\nuse a separate page table for userspace with only the minimum of kernel code\nand data required for the transitions to/from the kernel (still marked as\nsupervisor-only, of course):\n- the IDT (RO)\n- three pages of kernel text in the .kutext section for interrupt, trap,\nand syscall trampoline code (RX)\n- one page of kernel data in the .kudata section for TLB flush IPIs (RW)\n- the lapic page (RW, uncachable)\n- per CPU: one page for the TSS+GDT (RO) and one page for trampoline\nstacks (RW)\nWhen a syscall, trap, or interrupt takes a CPU from userspace to kernel the\ntrampoline code switches page tables, switches stacks to the thread's real\nkernel stack, then copies over the necessary bits from the trampoline stack.\nOn return to userspace the opposite occurs: recreate the iretq frame on the\ntrampoline stack, switch stack, switch page tables, and return to userspace.\nmlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing\nissues on MP in particular, and drove the final push to completion.\nMany rounds of testing by naddy@, sthen@, and others\nThanks to Alex Wilson from Joyent for early discussions about trampolines\nand their data requirements.\nPer-CPU page layout mostly inspired by DragonFlyBSD.\nok mlarkin@ deraadt@</p>\n\n<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59\nLog message:\nThe GNU assembler does not understand 1ULL, so replace the constant\nwith 1.  Then it compiles with gcc, sign and size do not matter\nhere.</p>\n\n<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14\nLog message:\nThe compile time assertion for cpu info did not work with gcc.\nRephrase the condition in a way that both gcc and clang accept it.</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40\nLog message:\nSet the PG_G (global) bit on the special page table entries that are shared\nbetween the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>\n\n<p>OpenBSD 6.1 errata 037\n```</p>\n\n<ul>\n<li>6.2</li>\n</ul>\n\n<p>```\nChanges by:    bluhm@cvs.openbsd.org   2018/02/26 05:29:48\nLog message:\nImplement a workaround against the Meltdown flaw in Intel CPUs.\nThe following changes have been backported from OpenBSD -current.</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/01/06 15:03:13\nLog message:\nHandle %gs like %[def]s and reset set it in cpu_switchto() instead of on\nevery return to userspace.</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/06 18:08:20\nLog message:\nAdd identcpu.c and specialreg.h definitions for the new Intel/AMD MSRs\nthat should help mitigate spectre. This is just the detection piece, these\nfeatures are not yet used.\nPart of a larger ongoing effort to mitigate meltdown/spectre. i386 will\ncome later; it needs some machdep.c cleanup first.</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/07 12:56:19\nLog message:\nremove all PG_G global page mappings from the kernel when running on\nIntel CPUs. Part of an ongoing set of commits to mitigate the Intel\n\"meltdown\" CVE. This diff does not confer any immunity to that\nvulnerability - subsequent commits are still needed and are being\nworked on presently.</p>\n\n<p>Changes by:     mlarkin@cvs.openbsd.org 2018/01/12 01:21:30\nLog message:\nIBRS -> IBRS,IBPB in identifycpu lines</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/02/21 12:24:15\nLog message:\nMeltdown: implement user/kernel page table separation.\nOn Intel CPUs which speculate past user/supervisor page permission checks,\nuse a separate page table for userspace with only the minimum of kernel code\nand data required for the transitions to/from the kernel (still marked as\nsupervisor-only, of course):\n- the IDT (RO)\n- three pages of kernel text in the .kutext section for interrupt, trap,\nand syscall trampoline code (RX)\n- one page of kernel data in the .kudata section for TLB flush IPIs (RW)\n- the lapic page (RW, uncachable)\n- per CPU: one page for the TSS+GDT (RO) and one page for trampoline\nstacks (RW)\nWhen a syscall, trap, or interrupt takes a CPU from userspace to kernel the\ntrampoline code switches page tables, switches stacks to the thread's real\nkernel stack, then copies over the necessary bits from the trampoline stack.\nOn return to userspace the opposite occurs: recreate the iretq frame on the\ntrampoline stack, switch stack, switch page tables, and return to userspace.\nmlarkin@ implemented the pmap bits and did 90% of the debugging, diagnosing\nissues on MP in particular, and drove the final push to completion.\nMany rounds of testing by naddy@, sthen@, and others\nThanks to Alex Wilson from Joyent for early discussions about trampolines\nand their data requirements.\nPer-CPU page layout mostly inspired by DragonFlyBSD.</p>\n\n<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:18:59\nLog message:\nThe GNU assembler does not understand 1ULL, so replace the constant\nwith 1.  Then it compiles with gcc, sign and size do not matter\nhere.</p>\n\n<p>Changes by:     bluhm@cvs.openbsd.org   2018/02/22 13:27:14\nLog message:\nThe compile time assertion for cpu info did not work with gcc.\nRephrase the condition in a way that both gcc and clang accept it.</p>\n\n<p>Changes by:     guenther@cvs.openbsd.org        2018/02/22 13:36:40\nLog message:\nSet the PG_G (global) bit on the special page table entries that are shared\nbetween the u-k and u+k tables, because they're actually in <em>all</em> tables.</p>\n\n<p>OpenBSD 6.2 errata 009\n```</p>\n\n<ul>\n<li><a href=\"https://man.openbsd.org/syspatch\">syspatch</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p><strong>iXsystems</strong></p>\n\n<h3><a href=\"https://undeadly.org/cgi?action=article;sid=20180302002131\">a2k18 Hackathon Report: Ken Westerback on dhclient and more</a></h3>\n\n<blockquote>\n  <p>Ken Westerback (krw@) has sent in the first report from the (recently concluded) a2k18 hackathon:</p>\n</blockquote>\n\n<ul>\n<li><p><a href=\"http://www.gcmap.com/mapui?P=YYZ-YVR-MEL-ZQN-CHC-DUD,DUD-WLG-AKL-SYD-BNE-YVR-YYZ\">YYZ -> YVR -> MEL -> ZQN -> CHC -> DUD -> WLG -> AKL -> SYD -> BNE -> YVR -> YYZ</a></p></li>\n<li><p>For those of you who don’t speak Airport code:</p></li>\n<li>Toronto -> Vancouver -> Melbourne -> Queenstown -> Christchurch -> Dunedin</li>\n<li>Then: Dunedin -> Wellington -> Auckland -> Sydney -> Brisbane -> Vancouver -> Toronto</li>\n</ul>\n\n<p>```</p>\n\n<p>Whew.</p>\n\n<p>Once in Dunedin the hacking commenced. The background was a regular tick of new meltdown diffs to test in addition to whatever work one was actually engaged in. I was lucky (?) in that none of the problems with the various versions cropped up on my laptop.\n```</p>\n\n<p>```\nI worked with rpe@ and tb@ to make the install script create the 'correct' FQDN when dhclient was involved. I worked with tb@ on some code cleanup in various bits of the base. dhclient(8) got some nice cleanup, further pruning/improving log messages in particular. In addition the oddball -q option was flipped into the more normal -v. I.e. be quiet by default and verbose on request.</p>\n\n<p>More substantially the use of recorded leases was made less intrusive by avoiding continual reconfiguration of the interface with the same information. The 'request', 'require' and 'ignore' dhclient.conf(5) statement were changed so they are cumulative, making it easier to build longer lists of affected options.</p>\n\n<p>I tweaked softraid(4) to remove a handrolled version of duid_format().</p>\n\n<p>I sprinkled a couple of M_WAITOK into amd64 and i386 mpbios to document that there is really no need to check for NULL being returned from some malloc() calls.</p>\n\n<p>I continued to help test the new filesystem quiescing logic that deraadt@ committed during the hackathon.</p>\n\n<p>I only locked myself out of my room once!</p>\n\n<p>Fueled by the excellent coffee from local institutions The Good Earth Cafe and The Good Oil Cafe, and the excellent hacking facilities and accommodations at the University of Otago it was another enjoyable and productive hackathon south of the equator. And I even saw penguins.</p>\n\n<p>Thanks to Jim Cheetham and the support from the project and the OpenBSD Foundation that made it all possible\n```</p>\n\n<p><hr /></p>\n\n<h3><a href=\"https://blog.gerv.net/2018/03/poetic-license/\">Poetic License</a></h3>\n\n<blockquote>\n  <p>I found this when going through old documents. It looks like I wrote it and never posted it. Perhaps I didn’t consider it finished at the time. But looking at it now, I think it’s good enough to share. It’s a redrafting of the BSD licence, in poetic form. Maybe I had plans to do other licences one day; I can’t remember.</p>\n  \n  <p>I’ve interleaved it with the original license text so you can see how true, or otherwise, I’ve been to it. Enjoy :-)</p>\n</blockquote>\n\n<p>```\nCopyright (c) <YEAR>, <OWNER>\nAll rights reserved.</p>\n\n<p>Redistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions\nare met:\n```</p>\n\n<blockquote>\n  <p>You may redistribute and use –\n  as source or binary, as you choose,\n  and with some changes or without –\n  this software; let there be no doubt.\n  But you must meet conditions three,\n  if in compliance you wish to be.</p>\n</blockquote>\n\n<p><code>\n1. Redistributions of source code must retain the above copyright\n   notice, this list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright\n  notice, this list of conditions and the following disclaimer in the\n  documentation and/or other materials provided with the distribution.\n3. Neither the name of the  nor the names of its\n   contributors may be used to endorse or promote products derived\n   from this software without specific prior written permission.\n</code></p>\n\n<blockquote>\n  <p>The first is obvious, of course –\n  To keep this text within the source.\n  The second is for binaries\n  Place in the docs a copy, please.\n  A moral lesson from this ode –\n  Don’t strip the copyright on code.</p>\n  \n  <p>The third applies when you promote:\n  You must not take, from us who wrote,\n  our names and make it seem as true\n  we like or love your version too.\n  (Unless, of course, you contact us\n  And get our written assensus.)</p>\n</blockquote>\n\n<p><code>\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS  IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS\nFOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE\nCOPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,\nINCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,\nBUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\nLIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN\nANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE\nPOSSIBILITY OF SUCH DAMAGE.\n</code></p>\n\n<blockquote>\n  <p>One final point to be laid out\n  (You must forgive my need to shout):\n  THERE IS NO WARRANTY FOR THIS\n  WHATEVER THING MAY GO AMISS.\n  EXPRESS, IMPLIED, IT’S ALL THE SAME –\n  RESPONSIBILITY DISCLAIMED.</p>\n  \n  <p>WE ARE NOT LIABLE FOR LOSS\n  NO MATTER HOW INCURRED THE COST\n  THE TYPE OR STYLE OF DAMAGE DONE\n  WHATE’ER THE LEGAL THEORY SPUN.\n  THIS STILL REMAINS AS TRUE IF YOU\n  INFORM US WHAT YOU PLAN TO DO.</p>\n  \n  <p>When all is told, we sum up thus –\n  Do what you like, just don’t sue us.</p>\n</blockquote>\n\n<p><hr /></p>\n\n<p><hr /></p>\n\n<h2>Beastie Bits</h2>\n\n<ul>\n<li><a href=\"https://www.youtube.com/playlist?list=PLnTFqpZk5ebDZwT-bmYcIwv76yhmTfl0l\">AsiaBSDCon 2018 Videos</a></li>\n<li><a href=\"https://www.freebsdfoundation.org/past-issues/storage/\">The January/February 2018 FreeBSD Journal is Here</a></li>\n<li><a href=\"https://mail-index.netbsd.org/pkgsrc-users/2018/01/04/msg026073.html\">Announcing the pkgsrc-2017Q4 release (2018-01-04)</a></li>\n<li><a href=\"https://www.bsdhh.org/bsdhh-de-index.html\">BSD Hamburg Event</a></li>\n<li><a href=\"http://zfs.datto.com/\">ZFS User conference</a></li>\n<li><a href=\"https://www.phoronix.com/scan.php?page=news_item&amp;px=Unreal-Engine-4-FreeBSD\">Unreal Engine 4 Being Brought Natively To FreeBSD By Independent Developer</a></li>\n</ul>\n\n<p><hr /></p>\n\n<p>Tarsnap ad</p>\n\n<p><hr /></p>\n\n<h2>Feedback/Questions</h2>\n\n<ul>\n<li>Philippe - <a href=\"http://dpaste.com/2643BF5#wrap\">I heart FreeBSD and other questions</a></li>\n<li>Cyrus - <a href=\"http://dpaste.com/3NTH14J#wrap\">BSD Now is excellent</a></li>\n<li>Architect - <a href=\"http://dpaste.com/317BP8X#wrap\">Combined Feedback</a></li>\n<li>Dale - <a href=\"http://dpaste.com/284G4TQ#wrap\">ZFS on Linux moving to ZFS on FreeBSD</a></li>\n<li>Tommi - <a href=\"http://dpaste.com/1KGMRGM#wrap\">New BUG in Finland</a></li>\n</ul>\n\n<p><hr /></p>\n\n<ul>\n<li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href=\"mailto:feedback@bsdnow.tv\">feedback@bsdnow.tv</a></li>\n</ul>\n\n<p><hr /></p>","summary":"OpenBSD firewalling Windows 10, NetBSD’s return to ptrace, TCP Alternative Backoff, the BSD Poetic license, and AsiaBSDcon 2018 videos available.","date_published":"2018-03-29T11:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/17c4fe12-c4ee-47a7-8d14-1a73407e86f4.mp3","mime_type":"audio/mp3","size_in_bytes":44655271,"duration_in_seconds":5563}]},{"id":"0684a07f-969f-4edf-b14b-601353ebdea4","title":"1: BGP & BSD","url":"https://www.bsdnow.tv/1","content_text":"We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!\n\nHeadlines\n\nRadeon KMS commited\n\n\nCommitted by Jean-Sebastien Pedron\nBrings kernel mode setting to -CURRENT, will be in 10.0-RELEASE (ETA 12/2013)\n10-STABLE is expected to be branched in October, to begin the process of stabilizing development\nInitial testing shows it works well\nMay be merged to 9.X, but due to changes to the VM subsystem this will require a lot of work, and is currently not a priority for the Radeon KMS developer\nStill suffers from the syscons / KMS switcher issues, same as Intel video\nMore info: https://wiki.freebsd.org/AMD_GPU\n***\n\n\nVeriSign Embraces FreeBSD\n\n\n\"BSD is quite literally at the very core foundation of what makes the Internet work\"\nUsing BSD and Linux together provides reliability and diversity\nVerisign gives back to the community, runs vBSDCon\n\"You get comfortable with something because it works well for your particular purposes and can find a good community that you can interact with. That all rang true for us with FreeBSD.\"\n***\n\n\nfetch/libfetch get a makeover\n\n\nAdds support for SSL certificate verification\nRequires root ca bundle (security/root_ca_nss)\nStill missing TLS SNI support (Server Name Indication, allows name based virtual hosts over SSL) \n***\n\n\nFreeBSD Foundation Semi-Annual Newsletter\n\n\nThe FreeBSD Foundation took the 20th anniversary of FreeBSD as an opportunity to look at where the project is, and where it might want to go\nThe foundation sets out some basic goals that the project should strive towards:\n\n\nUnify User Experience\n\n\n“ensure that knowledge gained mastering one task translates to the next”\n“if we do pay attention to consistency, not only will FreeBSD be easier to use, it will be easier to learn”\n\nDesign for Human and Programmatic Use\n\n\n200 machines used to be considered a large deployment, with high density servers, blades, virtualization and the cloud, that is not so anymore\n“the tools we provide for status reporting, configuration, and control of FreeBSD just do not scale or fail to provide the desired user experience”\n“The FreeBSD of tomorrow needs to give programmability and human interaction equal weighting as requirements”\n\nEmbrace New Ways to Document FreeBSD\n\n\nMore ‘Getting Started’ sections in documentation\nLink to external How-Tos and other documentation\n“upgrade the cross-referencing and search tools built into FreeBSD, so FreeBSD, not an Internet search engine, is the best place to learn about FreeBSD”\n\n\nSpring Fundraising Campaign, April 17 - May 31, raised a total of $219,806 from 12 organizations and 365 individual donors. In the same period last year we raised a total of $23,422 from 2 organizations and 53 individuals\nFunds donated to the FreeBSD Foundation have been used on these projects recently:\nCapsicum security-component framework\nTransparent superpages support of the FreeBSD/ARM architecture\nExpanded and faster IPv6\nNative in-kernel iSCSI stack\nFive New TCP Congestion Control Algorithms\nDirect mapped I/O to avoid extra memory copies\nUnified Extensible Firmware Interface (UEFI) boot environment\nPorting FreeBSD to the Genesi Efika MX SmartBook laptop (ARM-based)\nNAND Flash filesystem and storage stack\nFunds were also used to sponsor a number of BSD focused conferences: BSDCan, EuroBSDCon, AsiaBSDCon, BSDDay, NYCBSDCon, vBSDCon, plus Vendor summits and Developer summits\nIt is important that the foundation receive donations from individuals, to maintain their tax exempt status in the USA. Even a donation of $5 helps make it clear that the FreeBSD Foundation is backed by a large community, not only a few vendors\nDonate Today \n***\n\n\nThe place to B...SD\n\nOhio Linuxfest, Sept. 13-15, 2013\n\n\nVery BSD friendly\nKirk McKusick giving the keynote\nBSD Certification on the 15th, all other stuff on the 14th\nMultiple BSD talks\n***\n\n\nLinuxCon, Sept. 16-18, 2013\n\n\nDru Lavigne and Kris Moore will be manning a FreeBSD booth\nNumber of talks of interest to BSD users, including ZFS coop\n\n\nEuroBSDCon, Sept. 26-29, 2013\n\n\nTutorials on the 26 &amp; 27th (plus private FreeBSD DevSummit)\n43 talks spread over 3 tracks on the 28 &amp; 29th\nKeynote by Theo de Raadt\nHosted in the picturesque St. Julians Area, Malta (Hilton Conference Centre)\n***\n\n\nInterview - Peter Hessler - phessler@openbsd.org / @phessler\n\nUsing BGP to distribute spam blacklists and whitelists\n\n\n\nTutorial\n\nUsing stunnel to hide your traffic from Deep Packet Inspection\n\n\n\nNews Roundup\n\nNetBSD 6.1.1 released\n\n\nFirst security/bug fix update of the NetBSD 6.1 release branch\nFixes 4 security vulnerabilities\nAdds 4 new sysctls to avoid IPv6 DoS attacks\nMisc. other updates\n***\n\n\nSudo Mastery\n\n\nMWL is a well-known author of many BSD books\nAlso does SSH, networking, DNSSEC, etc.\nNext book is about sudo, which comes from OpenBSD (did you know that?)\nAvailable for preorder now at a discounted price\n***\n\n\nDocumentation Infrastructure Enhancements\n\n\nGábor Kövesdán has completed a funded project to improve the infrastructure behind the documentation project\nWill upgrade documentation from DocBook 4.2 to DocBook 4.5 and at the same time migrate to proper XML tools.\nDSSSL is an old and dead standard, which will not evolve any more.\nDocBook 5.0 tree added\n***\n\n\nFreeBSD FIBs get new features\n\n\nFIBs (as discussed earlier in the interview) are Forward Information Bases (technical term for a routing table)\nThe FreeBSD kernel can be compiled to allow you to maintain multiple FIBs, creating separate routing tables for different processes or jails\nIn r254943 ps(1) is extended to support a new column ‘fib’, to display which routing table a process is using\n***\n\n\nFreeNAS 9.1.0 and 9.1.1 released\n\n\nMany improvements in nearly all areas, big upgrade\nBased on FreeBSD 9-STABLE, lots of new ZFS features\nCherry picked some features from 10-CURRENT\nNew volume manager and easy to use plugin management system\n9.1.1 released shortly thereafter to fix a few UI and plugin bugs\n***\n\n\nBSD licensed \"patch\" becomes default\n\n\nbsdpatch has become mature, does what GNU patch can do, but has a much better license\nApproved by portmgr@ for use in ports\nAdded WITH_GNU_PATCH build option for people who still need it\n***\n","content_html":"<p>We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!</p>\n\n<h2>Headlines</h2>\n\n<h3><a href=\"https://lists.freebsd.org/pipermail/svn-src-head/2013-August/050931.html\" rel=\"nofollow\">Radeon KMS commited</a></h3>\n\n<ul>\n<li>Committed by Jean-Sebastien Pedron</li>\n<li>Brings kernel mode setting to -CURRENT, will be in 10.0-RELEASE (ETA 12/2013)</li>\n<li>10-STABLE is expected to be branched in October, to begin the process of stabilizing development</li>\n<li>Initial testing shows it works well</li>\n<li>May be merged to 9.X, but due to changes to the VM subsystem this will require a lot of work, and is currently not a priority for the Radeon KMS developer</li>\n<li>Still suffers from the syscons / KMS switcher issues, same as Intel video</li>\n<li>More info: <a href=\"https://wiki.freebsd.org/AMD_GPU\" rel=\"nofollow\">https://wiki.freebsd.org/AMD_GPU</a>\n***</li>\n</ul>\n\n<h3><a href=\"http://www.eweek.com/enterprise-apps/verisign-embraces-open-source-freebsd-for-diversity/\" rel=\"nofollow\">VeriSign Embraces FreeBSD</a></h3>\n\n<ul>\n<li>&quot;BSD is quite literally at the very core foundation of what makes the Internet work&quot;</li>\n<li>Using BSD and Linux together provides reliability and diversity</li>\n<li>Verisign gives back to the community, runs vBSDCon</li>\n<li>&quot;You get comfortable with something because it works well for your particular purposes and can find a good community that you can interact with. That all rang true for us with FreeBSD.&quot;\n***</li>\n</ul>\n\n<h3><a href=\"http://freshbsd.org/commit/freebsd/r253680\" rel=\"nofollow\">fetch/libfetch get a makeover</a></h3>\n\n<ul>\n<li>Adds support for SSL certificate verification</li>\n<li>Requires root ca bundle (security/root_ca_nss)</li>\n<li>Still missing TLS SNI support (Server Name Indication, allows name based virtual hosts over SSL) \n***</li>\n</ul>\n\n<h3><a href=\"http://www.freebsdfoundation.org/press/2013Jul-newsletter\" rel=\"nofollow\">FreeBSD Foundation Semi-Annual Newsletter</a></h3>\n\n<ul>\n<li>The FreeBSD Foundation took the 20th anniversary of FreeBSD as an opportunity to look at where the project is, and where it might want to go</li>\n<li>The foundation sets out some basic goals that the project should strive towards:\n\n<ul>\n<li>Unify User Experience\n\n<ul>\n<li>“ensure that knowledge gained mastering one task translates to the next”</li>\n<li>“if we do pay attention to consistency, not only will FreeBSD be easier to use, it will be easier to learn”</li>\n</ul></li>\n<li>Design for Human and Programmatic Use\n\n<ul>\n<li>200 machines used to be considered a large deployment, with high density servers, blades, virtualization and the cloud, that is not so anymore</li>\n<li>“the tools we provide for status reporting, configuration, and control of FreeBSD just do not scale or fail to provide the desired user experience”</li>\n<li>“The FreeBSD of tomorrow needs to give programmability and human interaction equal weighting as requirements”</li>\n</ul></li>\n<li>Embrace New Ways to Document FreeBSD\n\n<ul>\n<li>More ‘Getting Started’ sections in documentation</li>\n<li>Link to external How-Tos and other documentation</li>\n<li>“upgrade the cross-referencing and search tools built into FreeBSD, so FreeBSD, not an Internet search engine, is the best place to learn about FreeBSD”</li>\n</ul></li>\n</ul></li>\n<li>Spring Fundraising Campaign, April 17 - May 31, raised a total of $219,806 from 12 organizations and 365 individual donors. In the same period last year we raised a total of $23,422 from 2 organizations and 53 individuals</li>\n<li>Funds donated to the FreeBSD Foundation have been used on these projects recently:</li>\n<li>Capsicum security-component framework</li>\n<li>Transparent superpages support of the FreeBSD/ARM architecture</li>\n<li>Expanded and faster IPv6</li>\n<li>Native in-kernel iSCSI stack</li>\n<li>Five New TCP Congestion Control Algorithms</li>\n<li>Direct mapped I/O to avoid extra memory copies</li>\n<li>Unified Extensible Firmware Interface (UEFI) boot environment</li>\n<li>Porting FreeBSD to the Genesi Efika MX SmartBook laptop (ARM-based)</li>\n<li>NAND Flash filesystem and storage stack</li>\n<li>Funds were also used to sponsor a number of BSD focused conferences: BSDCan, EuroBSDCon, AsiaBSDCon, BSDDay, NYCBSDCon, vBSDCon, plus Vendor summits and Developer summits</li>\n<li>It is important that the foundation receive donations from individuals, to maintain their tax exempt status in the USA. Even a donation of $5 helps make it clear that the FreeBSD Foundation is backed by a large community, not only a few vendors</li>\n<li><a href=\"http://www.freebsdfoundation.org/donate\" rel=\"nofollow\">Donate Today </a>\n***</li>\n</ul>\n\n<h2>The place to B...SD</h2>\n\n<h4><a href=\"http://ohiolinux.org/schedule\" rel=\"nofollow\">Ohio Linuxfest, Sept. 13-15, 2013</a></h4>\n\n<ul>\n<li>Very BSD friendly</li>\n<li>Kirk McKusick giving the keynote</li>\n<li>BSD Certification on the 15th, all other stuff on the 14th</li>\n<li>Multiple BSD talks\n***</li>\n</ul>\n\n<h4><a href=\"http://events.linuxfoundation.org/events/linuxcon-north-america\" rel=\"nofollow\">LinuxCon, Sept. 16-18, 2013</a></h4>\n\n<ul>\n<li>Dru Lavigne and Kris Moore will be manning a FreeBSD booth</li>\n<li>Number of talks of interest to BSD users, <a href=\"http://linuxconcloudopenna2013.sched.org/event/b50b23f3ed3bd728fa0052b54021a2cc?iframe=yes&w=900&sidebar=yes&bg=no\" rel=\"nofollow\">including ZFS coop</a></li>\n</ul>\n\n<h4><a href=\"http://2013.eurobsdcon.org/eurobsdcon-2013/talks/\" rel=\"nofollow\">EuroBSDCon, Sept. 26-29, 2013</a></h4>\n\n<ul>\n<li>Tutorials on the 26 &amp; 27th (plus private FreeBSD DevSummit)</li>\n<li>43 talks spread over 3 tracks on the 28 &amp; 29th</li>\n<li>Keynote by Theo de Raadt</li>\n<li>Hosted in the picturesque St. Julians Area, Malta (Hilton Conference Centre)\n***</li>\n</ul>\n\n<h2>Interview - Peter Hessler - <a href=\"mailto:phessler@openbsd.org\" rel=\"nofollow\">phessler@openbsd.org</a> / <a href=\"https://twitter.com/phessler\" rel=\"nofollow\">@phessler</a></h2>\n\n<p>Using BGP to distribute spam blacklists and whitelists</p>\n\n<hr>\n\n<h2>Tutorial</h2>\n\n<h3><a href=\"http://www.bsdnow.tv/tutorials/stunnel\" rel=\"nofollow\">Using stunnel to hide your traffic from Deep Packet Inspection</a></h3>\n\n<hr>\n\n<h2>News Roundup</h2>\n\n<h3><a href=\"https://blog.netbsd.org/tnf/entry/netbsd_6_1_1_released\" rel=\"nofollow\">NetBSD 6.1.1 released</a></h3>\n\n<ul>\n<li>First security/bug fix update of the NetBSD 6.1 release branch</li>\n<li>Fixes 4 security vulnerabilities</li>\n<li>Adds 4 new sysctls to avoid IPv6 DoS attacks</li>\n<li>Misc. other updates\n***</li>\n</ul>\n\n<h3><a href=\"http://blather.michaelwlucas.com/archives/1792\" rel=\"nofollow\">Sudo Mastery</a></h3>\n\n<ul>\n<li>MWL is a well-known author of many BSD books</li>\n<li>Also does SSH, networking, DNSSEC, etc.</li>\n<li>Next book is about sudo, which comes from OpenBSD (did you know that?)</li>\n<li>Available for preorder now at a discounted price\n***</li>\n</ul>\n\n<h3><a href=\"http://freebsdfoundation.blogspot.com/2013/08/new-funded-project-documentation.html\" rel=\"nofollow\">Documentation Infrastructure Enhancements</a></h3>\n\n<ul>\n<li>Gábor Kövesdán has completed a funded project to improve the infrastructure behind the documentation project</li>\n<li>Will upgrade documentation from DocBook 4.2 to DocBook 4.5 and at the same time migrate to proper XML tools.</li>\n<li>DSSSL is an old and dead standard, which will not evolve any more.</li>\n<li>DocBook 5.0 tree added\n***</li>\n</ul>\n\n<h3><a href=\"https://svnweb.freebsd.org/base?view=revision&revision=254943\" rel=\"nofollow\">FreeBSD FIBs get new features</a></h3>\n\n<ul>\n<li>FIBs (as discussed earlier in the interview) are Forward Information Bases (technical term for a routing table)</li>\n<li>The FreeBSD kernel can be compiled to allow you to maintain multiple FIBs, creating separate routing tables for different processes or jails</li>\n<li>In r254943 ps(1) is extended to support a new column ‘fib’, to display which routing table a process is using\n***</li>\n</ul>\n\n<h3><a href=\"http://www.ixsystems.com/resources/ix/news/ixsystems-announces-revolutionary-freenas-910-release.html\" rel=\"nofollow\">FreeNAS 9.1.0 and 9.1.1 released</a></h3>\n\n<ul>\n<li>Many improvements in nearly all areas, big upgrade</li>\n<li>Based on FreeBSD 9-STABLE, lots of new ZFS features</li>\n<li>Cherry picked some features from 10-CURRENT</li>\n<li>New volume manager and easy to use plugin management system</li>\n<li>9.1.1 released shortly thereafter to fix a few UI and plugin bugs\n***</li>\n</ul>\n\n<h3><a href=\"http://freshbsd.org/commit/freebsd/r253689\" rel=\"nofollow\">BSD licensed &quot;patch&quot; becomes default</a></h3>\n\n<ul>\n<li>bsdpatch has become mature, does what GNU patch can do, but has a much better license</li>\n<li>Approved by portmgr@ for use in ports</li>\n<li>Added WITH_GNU_PATCH build option for people who still need it\n***</li>\n</ul>","summary":"We kick off the first episode with the latest BSD news, show you how to avoid intrusion detection systems and talk to Peter Hessler about BGP spam blacklists!","date_published":"2013-09-04T00:00:00.000-04:00","attachments":[{"url":"https://aphid.fireside.fm/d/1437767933/c91b88f1-e824-4815-bcb8-5227818d6010/0684a07f-969f-4edf-b14b-601353ebdea4.mp3","mime_type":"audio/mpeg","size_in_bytes":81975517,"duration_in_seconds":6831}]}]}